Changes to the Fair Credit Reporting Act: Important Steps Forward at a High Cost
By Consumers Union on Wednesday, January 7th, 2004
Important Steps Forward at a High Cost
With passage of HR 2622, the Fair and Accurate Credit Transactions Act, Congress significantly amended the Fair Credit Reporting Act (15 USC 1681 et seq.), which provides consumer protections regarding the use, accuracy and privacy of consumer credit reports. This law, originally passed in 1970, ensures that consumers have access to information about them that lenders, insurers, and others obtain from credit bureaus and use to make decisions about providing credit and other services. Amendments passed in 1996 provided new consumer rights to improve accuracy of reports, but in exchange for these increased consumer rights, states were temporarily preempted from passing stronger protections in a few specific areas of the law. Those preemptions were scheduled to expire on January 1, 2004, which thrust this important law into the spotlight in 2003 as industry lobbyists sought to make those preemptions permanent.
The changes to the Fair Credit Reporting Act passed by Congress this year make some improvements for consumers to increase the accuracy of credit reports, prevent identity theft, and restrict the marketing of financial products using sensitive information that is shared with affiliates. In addition the FCRA amendments provide for one free credit report per year from each agency and guarantee consumers access to credit scores at a reasonable fee. However, these improvements come at the very high price of permanent preemption of state action in the areas preempted since 1996, as well as expansion of preemption to include several new areas addressed in this year’s legislation. In addition, many of the new consumer protections provided in the 2003 amendments solely rely on agency enforcement and explicitly do not allow consumers a federal private right of action to sue violators.
Except where specifically indicated, these changes will be effective within one year of enactment. The Federal Reserve Board and the Federal Trade Commission (FTC) have two months to issue regulations establishing effective dates for each section, which should occur as early as possible, but no later than ten months after the issuance of these regulations or no later than 365 days following the signing of Public Law 108-159 on 4 December 2003.
The following is a summary prepared by Consumer Federation of America, Consumers Union and U.S. PIRG of the principal changes made to the FCRA by enactment of the FACT Act.
Prior to enactment of the FACT Act, Congress had only enacted one law in response to the growing crime of identity theft. In 1998, Congress made identity theft a felony and ordered the FTC to coordinate federal efforts to monitor the crime. The FACT Act makes several changes to the FCRA, largely based on already-enacted state laws.
One Call Fraud Alerts: Establishes the right of any consumer to request a fraud alert for 90 days or, if a consumer provides an “identity theft report” (which could include an FTC ID theft affidavit if filed with a law enforcement agency), the consumer could place an extended fraud alert of seven years in his or her credit file. The alert must be included with a credit report and with the delivery of a credit score. Users of reports and scores have a new duty to honor fraud alerts. They cannot issue a new credit line, extension of credit, new cards or a requested higher credit limit on existing accounts unless the consumer is called or other reasonable verification steps are taken. Any national credit bureau contacted by a consumer must inform other bureaus that a fraud alert has been placed (one-call fraud alert). Non-national bureaus are required to advise consumers how to contact national bureaus. Persons who file an extended fraud alert are automatically opted out of pre-screening for five years. Active duty military personnel gain the right to request one-year “active-duty” alerts. All consumers who place an alert may receive a free credit report. Persons who place an extended fraud alert may also get two free reports in the first year.
Trade Line Blocking: Requires Consumer Reporting Agencies (CRAs, or credit bureaus) to block fraudulent trade lines when a consumer provides an identity theft report, provided that it has been filed with a law enforcement agency.
Business Records Disclosure: Allows ID theft victims with a police report (a higher standard than “identity theft report”) to request and get copies of records from businesses where a thief opened accounts or obtained goods or services, to help clear their names. The business may insist on a police report, and may take 30 days to provide the information.
Red Flag Guidelines for New Accounts and Change of Address Verification: Regulators are required to establish guidelines for issuers to follow to identify patterns and practices leading to identity theft. The regulations will require reasonable procedures to comply with the guidelines. The regulations will also require card issuers to verify changes of address in certain circumstances (e.g. when a request for a new card comes within 30 days following a change of address).
Credit Card Number Truncation On Consumer Reports: Requires credit card machines to truncate all credit and debit card numbers on non-manual receipts by 2007.
Social Security Number Truncation: Allows a consumer to request that the credit report disclosed to the consumer truncate any included Social Security Numbers.
Prohibits Sale or Collection of ID Theft Debts: Prohibits any person or business from selling, transferring, or placing for collection any item subject to an identity theft trade line block or debt which resulted from identity theft once the block has been placed and the creditor has notice of the block. (However, there is an exemption for information provided in the securitization of debts )
Debt Collector Notice Requirements: Any third party debt collector that is notified that the debt they are trying to collect may be fraudulent must notify the third party and also must provide the consumer upon request with notice of his or her rights in debt collection.
Prevention of Repollution: Creditors and others who furnish information to a CRA and who are notified by a CRA of the existence of an identity theft trade line block must maintain reasonable procedures to prevent refurnishing (repollution) of the information arising from the ID theft. A furnisher receiving an identity theft report at a proper address may not refurnish such information unless it subsequently verifies that information.
Accuracy, Access to Reports and Reinvestigations
Studies have shown that credit reports and resulting credit scores are often inaccurate or incomplete, resulting in consumers paying too much for credit. Further, consumers face difficulty fixing mistakes. (The major provision of the 1996 amendments was the imposition, for the first time, of duties on companies providing information to credit bureaus, known as furnishers.) The following FACT Act amendments address accuracy, access and reinvestigations.
Annual Free Credit Reports: Each national credit bureau must provide a free report upon request within 15 days of a request by phone, Internet, or mail through a one-call centralized source to be established by the FTC within a year. Reports will also be available from specialty bureaus, such as landlord – tenant or insurance reporting services, with the method of distribution to be established in regulations to be issued within six months, effective six to nine months thereafter. States are preempted from increasing the frequency of the provision of free reports (free report laws in Colorado, Georgia, Maine, Maryland, Massachusetts, New Jersey, Vermont are “grandfathered”).
Reinvestigations: CRAs have 45 days to conduct reinvestigations of disputed items resulting from free report requests (compared to 30-45 days for all other reinvestigations). This does not apply if the CRA has not been continuously providing consumer reports for 12 months preceding request.
FTC To Create Summary Of Rights For Consumers: These rights include the availability of free credit reports, the right to dispute information in a credit report, and how to request and obtain credit score. The summary of rights will be distributed with adverse action notices (if a consumer is denied or offered credit at less than favorable terms) and actively promoted by FTC and posted on its website. This summary must also tell consumers that they may have additional rights under state law.
Credit Bureaus Must Provide Credit Scores, and information on up to four key factors (or five factors if the number of inquiries was a factor and not among the four key factors) adversely affecting a consumer’s score. Bureaus can charge a “fair and reasonable fee” for score, as determined by the FTC. This does not apply to mortgage scores, such as those created by automated underwriting programs.
Mortgage Lenders Must Provide Credit Scores, and information on key factors lowering a consumer’s score to those who apply for mortgages. No fee is authorized for this disclosure. States are preempted from acting further regarding the disclosures of credit scores for credit granting purposes (California and Colorado statutes grandfathered). States are allowed to continue to act in the area of insurance scores, credit based scores used in connection with insurance, and credit score issues other than disclosure issues.
One-Time Written Notification That Negative Information Will Be Or Has Been Sent To Credit Bureaus: Any financial institution that submits negative information to national CRA must give consumers one-time written notice that they have done so or will do so. This notice may be included in a notice of default or a billing statement, but not with Truth in Lending disclosures.
New Risk Based Pricing Notice: Existing law provides that consumers who are denied credit or services or required to pay extra for credit due to their credit report receive an “adverse action notice” triggering their credit reporting rights. The FACT Act establishes a new notice for certain additional circumstances. Whenever credit is extended on terms “materially less favorable than the most favorable terms available to a substantial proportion of consumers” from that creditor, creditors must provide notice that the terms offered are based on information in a consumer’s credit report and that the consumer can request a free copy of the report. (No civil enforcement is allowed — federal enforcement only. States are preempted from acting further with respect to the notice.)
Guidelines/Regulations On Accuracy And Integrity Of Information: The FTC and financial regulators are to create guidelines for accuracy and integrity of information and require furnishers of information to establish reasonable policies and procedures to implement guidelines.
Higher Standard For Furnishers Of Information To CRAs: Under pre-revision rules, those who provide information to credit reporting agencies were not allowed to report inaccurate information if they knew or consciously avoided knowing that the information was inaccurate. The new standard prohibits reporting of inaccurate information if the furnisher “knows or has reasonable cause to believe that the information is inaccurate.”
Consumers Can Dispute Incorrect Information Directly With Furnisher: Under pre-revision rules, furnishers of information were only required to perform a reinvestigation of the accuracy of information if they received a complaint from a consumer via a credit reporting agency. The new law requires financial regulators and the FTC to prescribe regulations outlining circumstances when creditors and other furnishers of information to CRAs should reinvestigate complaints that come directly from a consumer. (Exempts disputes filed by credit repair organizations. This new right does not provide a private right of action .)
FTC Compilation And Report On Complaints Regarding Credit Reports: CRAs must report on the determinations made based on such complaints. Requires the FTC to compile an annual report on the outcome of these complaints.
Study Of Accuracy And Completeness Of Consumer Reports: The Federal Reserve Board and FTC must study and report to Congress (twelve months after enactment) on the compliance of CRAs and furnishers regarding the accuracy of items by consumers, the completeness of information provided to CRAs, and the correction and deletion of inaccurate or incomplete information.
Improved Disclosure Of Results Of Reinvestigation: CRAs must notify furnishers when changes are made because of a reinvestigation based on a consumer complaint about a credit reporting error.
Requirement For Furnishers To Update Records: Furnishers must change records, delete records, or permanently block reporting to CRAs of information found to be inaccurate or incomplete.
Notification Of Address Discrepancy: CRAs must notify anyone requesting a consumer’s report if the address on the request substantially differs from the address in the consumer’s file.
Reasonable Reinvestigation: Clarifies the obligation on CRAs to reinvestigate items of disputed accuracy by requiring a “reasonable reinvestigation”.
FTC Study And Report on Credit Reporting Issues: The FTC must submit a report within one year on ways to improve operation of the FCRA, including:
— Whether requiring requesters of credit reports to match more points of identifying information before a report is issued would increase accuracy and reduce ID theft;
— The impact of notifying consumers when negative information is added to a report on consumers’ ability to identify errors on credit reports and to remove fraudulent information from reports;
— The impact of requiring that consumers who suffer an adverse action based on a credit report immediately receive a copy of the credit report used for the decision on consumers’ ability to identify errors and remove fraudulent information;
— The impact of including non-traditional transaction information on determining consumers creditworthiness, and how to encourage voluntary reporting of such information, and
— A study on the use of biometrics and other technologies to fight ID theft.
Ongoing FTC Study Of And Reports On The Accuracy And Completeness Of Consumer Reports: An Interim report is due in one year, and biennially thereafter for eight years. The final report is due two years after that.
The FCRA also requires that users of credit reports have a “permissible purpose” to obtain them, mandates that CRAs maintain the security and integrity of consumer files, and allows consumers to limit certain uses of their reports.
Stronger Opt-Out For Prescreening Based On Credit Report Information: Prescreened offers of credit must contain a phone number to opt out of such offers in a simple and easy to understand format, as outlined by regulation within one year of enactment. Extends the duration of the telephone-initiated opt out from two years to five years. (Under current law, a mailed “notice of election” results in a permanent opt out.) FTC must take measures to increase awareness of the opt out number, and study the opt out process, including current mechanisms available for consumers to opt out, the extent to which consumers are utilizing these measures, the benefits and costs to consumers of receiving prescreened offers of credit or insurance, the impact of further restricting written offers on cost, availability, and consumer knowledge of new products, on competition, and on reaching underserved populations (report due within one year).
New Opt-Out For Marketing Solicitations That Are Based On Information Shared Among Affiliates: Consumers must be provided the opportunity to opt out of receiving solicitations for marketing purposes based on information shared among corporate affiliates, effective for at least five years, after which the consumer must be given notice and the opportunity to opt out again. Exempts marketing when a preexisting relationship has existed with customers within 18 months, for employee benefit plans, and to perform services on behalf of an affiliate (but one affiliate cannot solicit on behalf of an affiliate that is prohibited from soliciting), and in response to communications initiated by the consumer or in response to solicitations initiated by or requested by consumer. Does not apply to information received prior to the effective date of regulations. This notice can be combined with other notices. (Regulations will be issued within nine months; effective six months after issuance).
Study Of Information Sharing: Requires federal financial services agencies and the FTC to study the following: the purposes for which affiliate sharing information is used; the types of information shared with affiliates; choices provided to consumers regarding control of sharing and the degree to which consumers use options; if information is used for employment or hiring, or for general publication of such information; and the information sharing practices that financial institutions and other creditors and users of consumer reports employ for purposes of credit underwriting or evaluation. (Report due within three years, and required every three years thereafter in identifying changes in use of information and reduced need for credit reports as a result.)
Disposal Of Consumer Information And Records Containing Consumer Information: Final regulations due within one year, and will address methods of disposal but not require the destruction of records.
Medical Information Protections: Any medical information in a consumer report must be coded to obscure the specific healthcare provider and the nature of medical services provided. Creditors are prohibited from obtaining or using medical information in credit decisions. (Final regulations for limitation on creditors due within six months, effective 90 days thereafter.) Prohibits the sharing among affiliates of medical information, including individual or aggregate lists based on payments for products or services. (The remainder of the medical privacy section is effective 180 days after enactment.) Medical providers must identify themselves as such within 15 months.
Other Important Provisions
Statute of Limitations: Amended to overturn Supreme Court decision in Andrews vs. TRW and provide for opportunity to sue two years following discovery or five years following date of violation, whichever is earlier.
Credit Score Study: Requires the FTC, the Federal Reserve Board and HUD to study and report on (within two years) the effects of the use of credit scores and credit-based insurance scores on the availability and affordability of financial products and services for all Americans, and for various minority groups, as well as any negative or differential treatment of protected classes under the Equal Credit Opportunity Act.
Financial Literacy Improvement: Establishes a Financial Literacy Education Commission made up of representatives of various federal agencies, to be led by the Secretary of Treasury. The Commission is charged with developing a national strategy to promote financial literacy and education (within 18 months) and with disseminating financial literacy information. As part of the national strategy, the Treasury Department is allocated three million dollars to conduct a national public service multimedia campaign to improve financial literacy in 2004, 2005 and 2006. The Comptroller General must conduct a study (within three years) of the effectiveness of the Commission’s efforts and on how to improve financial literacy among consumers.
Workplace Investigations: The FACT Act weakens certain protections provided to employees when investigations are conducted in the workplace of alleged sexual harassment, embezzlement, drug use, etc.
The original 1970 FCRA provided that the law would provide minimum federal protections that the states could exceed. The 1996 amendments provided that states would be preempted from enacting stronger laws in seven particular provisions of the FCRA, but only until 1 January 2004, unless Congress acted to renew the preemptions.
1) The FACT Act makes permanent the seven preemptions enacted in 1996 and otherwise set to expire. These cover:
• Prescreening of consumer reports;
• The time frames for handling accuracy disputes;
• The duties of persons who take adverse actions (notices and disclosures);
• The duties of persons who use consumer reports in connection with credit or insurance transactions not initiated by a consumer;
• Information contained in consumer reports;
• The duties of furnishers of information to consumer reporting agencies, and
• The sharing information among affiliates (although the interplay between this provision and other federal laws, such as the Gramm-Leach-Bliley Act, authorizing state action has not been determined).
2) The FACT Act enacts the following new preemptions. These cover:
• The obligation on businesses who grant credit or provide goods or services to ID thieves to provide information to victims;
• Consumers’ rights to opt out of solicitations based on affiliate shared information ;
• Risk based pricing notices;
• Annual free credit reports (with grandfathering of existing laws), and
• Credit score disclosure by CRAs and by mortgage lenders when the score is for credit granting purposes;
3) The FACT Act enacts narrower ID theft preemptions, whereby state laws are restricted only with respect to the “conduct required by the specific provisions of” these identified sections of the FCRA:
• The truncation of credit or debit card numbers on receipts;
• The placement of fraud alerts and active duty military alerts;
• The blocking of information resulting from ID theft;
• Allowing consumer to request truncation of Social Security Numbers on communications sent to them;
• Red flag guidelines regarding ID theft;
• Prohibiting the sale or collection of debts resulting from ID theft and requiring third party debt collectors to notify creditors if they learn that a debt has resulted from ID theft;
• The referral process between CRAs regarding ID theft complaints, fraud alerts, and blocking of information;
• Various disclosures, including the summary of rights to obtain credit report and score and to dispute information, the summary of ID theft victim rights, and the right of ID theft victim to get information from businesses;
• Procedures to prevent refurnishing of information resulting from ID theft;
• Annual free credit reports for ID theft victims (this is listed in two parts of the bill), and
• The disposal of records containing information from credit reports.