Fair Credit Reporting Act: Rights and Responsibilities

The purpose of the Fair Credit Reporting Act (FCRA) is “to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information.” The FCRA establishes consumers’ rights in relation to their credit reports, as well as permissible uses of credit reports. It also imposes certain responsibilities on those who collect, furnish, and use the information contained in consumers’ credit reports. Additionally, it requires disclosure of credit scores in certain circumstances, including when adverse credit actions are based partly on a credit score.

The FCRA has been amended several times over the last decade. The Fair and Accurate Credit Transactions Act of 2003 (FACT Act, P.L. 108-159) amended the FCRA to include a number of provisions aimed at preventing identity theft and assisting victims. The Credit Card Accountability Responsibility and Disclosure Act of 2009 (Credit CARD Act, P.L. 111-24) strengthened protections for young consumers and advertising disclosures regarding free credit reports from consumer reporting agencies. More recently, the Consumer Financial Protection Act of 2010, part of the Dodd-Frank Wall Street Reform and Consumer Protection Act (P.L. 111-203), established the Consumer Financial Protection Bureau (Bureau) and transferred administrative functions, including most rulemaking and reporting, as well as certain enforcement functions, from other federal agencies, such as the FTC and the Federal Reserve Board, to the Bureau. For more information on the functions of the new Bureau, see CRS Report R41338, The Dodd-Frank Wall Street Reform and Consumer Protection Act: Title X, The Consumer Financial Protection Bureau, by David H. Carpenter.

This report discusses consumers’ rights under the FCRA, as well as the type of information included in credit reports and credit scores, permissible uses of credit reports, disclosure requirements for credit reports and credit scores, and requirements for users of consumer credit reports and furnishers of information. It also addresses FCRA provisions aimed at preventing identity theft and assisting victims of identity theft. For further information on laws and issues related to identity theft, see CRS Report R40599, Identity Theft: Trends and Issues, by Kristin M. Finklea, and CRS Report RL31919, Federal Laws Related to Identity Theft, by Gina Stevens. For information on data security and the legislative efforts regarding such, see CRS Report RL34120, Federal Information Security and Data Breach Notification Laws, by Gina Stevens, and CRS Report RL33273, Data Security: Federal Legislative Approaches, by Gina Stevens.

Fair Credit Reporting Act: Rights and Responsibilities

April 10, 2013 (RL31666)

Summary

The purpose of the Fair Credit Reporting Act (FCRA) is "to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information." The FCRA establishes consumers' rights in relation to their credit reports, as well as permissible uses of credit reports. It also imposes certain responsibilities on those who collect, furnish, and use the information contained in consumers' credit reports. Additionally, it requires disclosure of credit scores in certain circumstances, including when adverse credit actions are based partly on a credit score.

The FCRA has been amended several times over the last decade. The Fair and Accurate Credit Transactions Act of 2003 (FACT Act, P.L. 108-159) amended the FCRA to include a number of provisions aimed at preventing identity theft and assisting victims. The Credit Card Accountability Responsibility and Disclosure Act of 2009 (Credit CARD Act, P.L. 111-24) strengthened protections for young consumers and advertising disclosures regarding free credit reports from consumer reporting agencies. More recently, the Consumer Financial Protection Act of 2010, part of the Dodd-Frank Wall Street Reform and Consumer Protection Act (P.L. 111-203), established the Consumer Financial Protection Bureau (Bureau) and transferred administrative functions, including most rulemaking and reporting, as well as certain enforcement functions, from other federal agencies, such as the FTC and the Federal Reserve Board, to the Bureau. For more information on the functions of the new Bureau, see CRS Report R41338, The Dodd-Frank Wall Street Reform and Consumer Protection Act: Title X, The Consumer Financial Protection Bureau, by [author name scrubbed].

This report discusses consumers' rights under the FCRA, as well as the type of information included in credit reports and credit scores, permissible uses of credit reports, disclosure requirements for credit reports and credit scores, and requirements for users of consumer credit reports and furnishers of information. It also addresses FCRA provisions aimed at preventing identity theft and assisting victims of identity theft. For further information on laws and issues related to identity theft, see CRS Report R40599, Identity Theft: Trends and Issues, by Kristin M. Finklea, and CRS Report RL31919, Federal Laws Related to Identity Theft, by [author name scrubbed]. For information on data security and the legislative efforts regarding such, see CRS Report RL34120, Federal Information Security and Data Breach Notification Laws, by [author name scrubbed], and CRS Report RL33273, Data Security: Federal Legislative Approaches, by [author name scrubbed].


Fair Credit Reporting Act: Rights and Responsibilities

Introduction

The purpose of a credit report is to enable a creditor to determine whether a potential borrower/debtor is a good risk; the purpose of the Fair Credit Reporting Act (FCRA)1 is to ensure that information regarding a potential borrower/debtor is accurate and that procedures are in place to address and correct any inaccuracies.2 The FCRA establishes consumers' rights in relation to their credit reports and credit scores, as well as permissible uses of credit reports, disclosure requirements for credit reports and credit scores, and requirements for users of consumer credit reports and furnishers of information. The Fair and Accurate Credit Transactions Act of 2003 (FACT Act) amended the FCRA to include a number of provisions aimed at preventing identity theft and assisting victims.3 The Credit Card Accountability Responsibility and Disclosure Act of 2009 (Credit CARD Act)4 strengthened protections for young consumers and advertising disclosures regarding free credit reports from consumer reporting agencies. More recently, the Consumer Financial Protection Act of 2010,5 part of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act),6 established the Consumer Financial Protection Bureau (CFPB or the Bureau) and transferred administrative functions, including rulemaking and reporting, as well as certain enforcement functions, from other federal agencies such as the Federal Trade Commission (FTC) and the Federal Reserve Board, to the Bureau.7

The FCRA applies to the files maintained by "consumer reporting agencies," a term broadly defined to include anyone in the business of furnishing reports on the creditworthiness of consumers to third parties.8 Although the statute refers to "consumer reporting agencies" (CRAs), "credit reporting agencies" or "credit reporting bureaus" are synonymous with CRAs in popular usage. The terms "credit report" and "credit history" are similarly interchangeable in popular usage.

A CRA "is essentially a clearinghouse for information supplied by credit grantors and collection agencies, and culled by the bureau itself from public records."9 In addition to several thousand small bureaus that often serve limited geographic areas, there are three major CRAs that operate on a nationwide basis—Experian, Equifax, and Trans Union.10 Information on a particular consumer may be maintained by any one or all of the CRAs serving a particular geographic area.

Information in Consumer Credit Reports and Scores

Credit Reports

Consumer credit reports generally include information about consumers' "credit worthiness [sic], credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living."11 The FCRA explicitly excludes certain types of financial reports from the definition of a consumer report. For example, "any report containing information solely as to transactions or experiences between the consumer and the person making the report" is excluded from the definition of consumer report, as are communications of that information among persons related by common ownership or affiliated by corporate control.12 Authorizations or approvals of specific extensions of credit by the issuer of a credit card are also excluded from the definition of consumer report.13

With relatively few exceptions, there appears to be a consensus among the CRAs as to the types of information that should be included in a report.14 Information reported by a credit bureau commonly includes:

identifying information, usually the individual's full name, Social Security number, address, telephone number, and spouse's name; financial status and employment information, including income, spouse's income, place, position, and tenure of employment, other sources of income, duration, and income in former employment; credit history, including types of credit previously obtained, names of previous credit grantors, extent of previous credit, and complete payment history; existing lines of credit, including payment habits and all outstanding obligations; public record information, including pertinent newspaper clippings, arrest and conviction records,15 bankruptcies, tax liens, and lawsuits; and finally a listing of bureau subscribers that have previously asked for a credit report on the individual.16

The FCRA limits the amount of time that adverse or negative information can be included in a consumer's credit report. Generally, a CRA is prohibited from reporting adverse information that is more than seven years old, or in the case of bankruptcies, more than ten years old.17 If a bankruptcy filed under title 11 of the United States Code is included on a consumer's report, the report shall also identify the chapter under which the case arose, if such information is provided by the source of the information.18 If a bankruptcy case or filing under title 11 of the United States Code is withdrawn by the consumer before a final judgment, the report must include the fact that the case or filing was withdrawn.19

In addition to adverse credit information, CRAs are also allowed to include information on a consumer's failure to pay overdue child support, if such information has been provided to the CRA by a state or local child support enforcement agency or verified by any state or federal government agency. This information remains on the consumer report for up to seven years.20

Medical information may be included in consumer reports under certain circumstances and if CRAs and creditors follow statutory and regulatory procedures and conditions to protect the confidentiality of such information.21

Credit Scores

For the purpose of disclosure requirements under the FCRA, credit scores are defined as "a numerical value or a categorization derived from a statistical tool or modeling system used by a person who makes or arranges a loan to predict the likelihood of certain credit behaviors, including default (and the numerical value or the categorization derived from such analysis may also be referred to as a 'risk predictor' or 'risk score') . . . ."22 This definition excludes mortgage scores or ratings of an automated underwriting system that considers other factors in addition to credit information, such as the loan to value ratio, the amount of down payment, or the financial assets of a consumer, as well as other elements of the underwriting process or decision.

A common misunderstanding is that there is a single credit score or perhaps a few scores, one generated by Fair, Isaac & Company (FICO), the firm that initially developed a credit score algorithm to evaluate and predict credit behavior by prospective borrowers/debtors, and one by each of the major credit reporting companies, Equifax, Experian, and TransUnion. However, many different algorithms/models may be developed to evaluate credit risk for different types of loans or other purposes, each including different factors or weighting the same factors differently. Additionally, aside from the major credit-score producers, there are other businesses generating and selling credit scores. Also, lender/creditors may develop their own in-house algorithms/models and generate their own scores rather than purchasing them from FICO, for example. These credit scoring algorithms/models and the credit scores generated by them constitute proprietary information of the firms developing them and/or the licensed users and retailers of such algorithms/models and the scores generated by them.23

According to the CFPB,24 several factors commonly are included in the calculation of a credit score:

  • history for timeliness or delinquency in paying bills;
  • number, types, available credit, current balances, and duration of credit accounts;
  • percentage of available credit being used;
  • recent credit activity such as applications for credit or opening new credit accounts; and
  • existence and age of negative information, such as debt collection, foreclosure, or bankruptcy actions or other judgments or liens.

A credit score represents a snapshot of a consumer's creditworthiness based on the credit report/history at the time the score was calculated. Therefore, it can change over time as a consumer's credit history continues to evolve. Different definitions of "good" and "bad" credit behavior and different uses of these attributes among scoring algorithms/models can affect the resulting score or range of scores produced with respect to a given consumer.

Credit scores may be based partly on the information in a credit report and are used to evaluate creditworthiness. Therefore, the factors that may be used in calculating credit scores are subject to restrictions on credit reports under the FCRA, noted above, to the degree that they are derived from such reports, and are subject to prohibitions against discrimination under the Equal Credit Opportunity Act (ECOA).25 The ECOA prohibitions include discriminating against any credit applicant on the basis of race, color, religion, national origin, sex or marital status, or age (provided the applicant has the capacity to contract); because all or part of the applicant's income derives from any public assistance program; or because the applicant has in good faith exercised any right under the ECOA.26

As required by the Dodd-Frank Act, the Bureau issued a report in 2011 on the nature, range, and size of variations between credit scores sold to creditors and those sold to consumers by CRAs and whether such variations disadvantage consumers.27 The report summarized the types, uses, and FCRA disclosure requirements for credit scores and analyzed how a consumer could be adversely affected by the potential differences between an educational score purchased by the consumer and the actual score used by a prospective lender/creditor in determining whether to extend credit to the consumer or what the terms for credit will be. As noted above, there are various reasons for the differences among the scores that may be generated for a given consumer. All this is aside from any differences that may result from inaccuracies in the items comprising a credit report/history. A credit score purchased by a consumer that is different from the score purchased or generated by a lender/creditor could give the consumer a misleading impression of his/her creditworthiness. This could result in the consumer applying for a loan amount for which he/she will be denied, if the consumer-purchased score is more favorable than the one used by the lender/creditor. On the other hand, a consumer may be discouraged from applying for credit if a purchased score that is less favorable than the one generated by the algorithm used by the lender/creditor.

The CFPB issued a follow-up report in 2012 that analyzed credit score variations over approximately 200,000 credit files from three nationwide CRAs, Equifax, Experian, and TransUnion, representing scores typically sold to consumers and to lender/creditors.28 The study concluded that for the majority of consumers "the scores produced by different scoring models provide similar information about the relative creditworthiness of the consumers. . . . For a substantial minority, however, different scoring models gave meaningfully different results."29 Because consumers cannot know in advance whether the score he/she has purchased will be significantly different from the score the lender/creditor will use, the study cautioned that consumers should be wary of relying solely on the scores they purchase in assessing their creditworthiness when determining whether to apply for credit and what terms to expect.30 The report further advised consumers to (1) be aware that many scores exist in the marketplace; (2) check credit reports for accuracy, taking advantage of the annual free credit report, and dispute any errors since these are the basis for credit scores; and (3) shop for credit, because even if lenders use the same score, they may offer different loan terms based on other factors, such as different competitive pressures or risk models.31 Finally, the report emphasized that providers of educational scores should make clear to consumers that there is a potential for differences, sometimes significant, between the scores they purchase and the ones a lender/creditor might use.

Permissible Uses of Consumer Credit Reports

The FCRA outlines the purposes for which a consumer credit report may be furnished to a requester.32 In general, a CRA may furnish a copy of a consumer's report to a person the CRA has reason to believe intends to use the information for the purpose of extending credit to the consumer or for reviewing or collecting the consumer's credit account.33 Consumer credit reports may also be issued where there is another "legitimate business need" for the information contained in the report in connection with a business transaction initiated by the consumer, or for purposes of reviewing an existing account to determine whether the consumer continues to meet the terms of the account.34 Reports may be furnished to executive branch departments and agencies in connection with the issuance of government-sponsored travel charge cards that are billed to employees.35 An insurer may receive a report in connection with the underwriting of an insurance policy involving the consumer for which the consumer has applied.36 Various other uses are permitted, including, among others, a response to a court order, a decision regarding a consumer's employment, and determination by a government agency of a consumer's ability to make child support payments.37

Reports may be issued in connection with transactions not initiated by the consumer only if authorized by the consumer, or if the transaction is a firm offer for credit or insurance and the consumer has not elected to have his name removed from lists provided by the CRA for this purpose.38 A consumer may elect to have his name removed from such lists by notifying the CRA that he does not consent to the release of reports for this purpose.39 If the consumer has not authorized the release of such reports and has not elected to have his name removed from the lists, the CRA may release only certain information about the consumer. Information released in connection with transactions not initiated by the consumer is limited to the name and address of the consumer, an identifier that is not unique to the consumer and that is used solely for the purpose of verifying the consumer's identity, and other information pertaining to the consumer that does not identify his/her relationship or experience with respect to a particular creditor or other entity.40 The Credit CARD Act of 2009 added protections from prescreened offers for persons under 21 years of age. Credit reports for such consumers cannot be issued in connection with such offers unless the consumer has consented.41

In addition to reports issued for the commercial purposes discussed above, a CRA may also issue a report to a person it has reason to believe "intends to use the information in connection with a determination of the consumer's eligibility for a license or other benefit granted by a governmental entity required by law to consider an applicant's financial responsibility or status."42

The FCRA also authorizes consumer credit reports to be released for certain legal purposes. Specifically, the act authorizes consumer credit reports to be released "in response to the order of a court having jurisdiction to issue such an order," or in response to "a subpoena issued in connection with proceedings before a Federal grand jury."43 Reports may also be issued to state or local child support enforcement agencies if needed to establish the consumer's capacity to pay child support or to determine the amount of such payments.44

If certain requirements are met, reports may also be issued for employment purposes.45 In order to obtain a report for employment purposes, the requester must certify that the report will not be used in violation of any state or federal law.46 The consumer must be told by the prospective employer that a report may be obtained and must consent to the procurement of a report by the employer.47 If the employer intends to take adverse action based in whole or in part on the report, the consumer must be provided with a copy of the report and a description of the rights afforded to consumers under the FCRA.48

A consumer report may also be issued to the Federal Deposit Insurance Corporation or the National Credit Union Administration as part of its powers, as conservator, receiver, or liquidating agent for an insured depository institution or insured credit union or in connection with the resolution or liquidation of a failed or failing insured depository institution or insured credit union.49

Consumer Rights Regarding Credit Reports and Scores

The FCRA outlines consumers' rights in relation to their credit reports and credit scores. Under the FCRA, consumers have the right to access all information in their credit reports, including the sources of the information, and the right to disclosure of their credit scores.50 A consumer may request one free credit report, not including a free credit score, each year from each of the nationwide CRAs.51 Pursuant to an amendment by the Credit CARD Act of 2009,52 advertisements for a free credit report in any medium, including television, radio, and the internet, must include a disclosure to the effect that free annual reports are available under federal law at "AnnualCreditReport.com" or other sources authorized by federal law and that the privately advertised service is not the free report required by law. Free reports may also be obtained under certain circumstances, such as notice of an adverse action based on information in a credit report or a consumer's request for a credit report in conjunction with a fraud alert.53 Absent one of these circumstances, a consumer may be charged up to $11.50 for additional copies of his or her credit report.54

Except in certain circumstances, a CRA may charge a fair and reasonable fee, as determined by the Bureau, for providing a consumer's current credit score or the one most recently calculated for an extension of credit.55 This paid disclosure must include a notice that the credit score purchased by the consumer may differ from a score purchased and used by a lender or other user of credit reports and scores.56 Certain mortgage lenders must disclose to a consumer without charge the credit score used for the purpose of the loan.57 Also, when users of credit reports take an adverse action or offer credit on terms less favorable than usual, they must disclose the credit score on which such actions were based.58

In addition to the disclosure of information contained in the consumer's credit report, a consumer is also entitled to receive information identifying each person who obtained a consumer credit report for employment purposes during the previous two years or for any other purpose during the previous year.59 Additional information that must be disclosed to the consumer upon request includes "the dates, original payees, and amounts of any checks upon which is based any adverse characterization of the consumer, included in the file at the time of the disclosure;" and "a record of all inquiries received by the agency during the one-year period preceding the request that identified the consumer in connection with a credit or insurance transaction that was not initiated by the consumer."60

Consumers have the right to dispute the completeness or accuracy of information contained in their files.61 Once a consumer notifies the CRA of the dispute, the CRA must reinvestigate and record the current status of the disputed information, or delete it from the consumer's file within 30 days.62 The CRA must also notify the furnisher of the disputed information of the consumer's dispute and provide the furnisher with all relevant information the CRA has received from the consumer regarding the dispute.63

In conducting the reinvestigation, the CRA must review and consider all relevant information submitted by the consumer.64 The CRA may terminate the reinvestigation if it reasonably determines that the dispute is frivolous or irrelevant, or if the consumer fails to provide sufficient information to investigate the disputed information.65 Should the CRA determine that the dispute is frivolous or irrelevant, it must notify the consumer of the determination not later than five business days after making such determination.66 If the reinvestigation leads to a determination that the disputed information is in fact inaccurate, incomplete, or unverifiable, the CRA must delete that item of information from the consumer's credit file.67

The CRA must provide written notice of the results of the reinvestigation to the consumer within five days of completing the reinvestigation.68 The notice must include a statement that the reinvestigation is completed; a copy of the consumer report reflecting the information in the consumer's file revised during the reinvestigation; a notice that, if requested by the consumer, a description of the procedure used to determine the accuracy and completeness of the information can be provided; a notice that the consumer has the right to add a statement to his/her file disputing the accuracy or completeness of the information contained therein; and a notice that the consumer has the right to request that the CRA send notices regarding deleted information to specified parties.69

Responsibilities of Consumer Reporting Agencies

Certain provisions of the FCRA are aimed at ensuring that the information in consumers' credit files is accurate and complete. As discussed above, under the FCRA, CRAs must conduct a reasonable reinvestigation if a consumer disputes the accuracy of any information in his/her file.70 The agencies also must notify requesters of consumer reports of any substantial discrepancies between the address the CRA has on file for a consumer and the consumer's address included in the request.71

In addition to their responsibilities related to the accuracy of information in consumers' files, credit reporting agencies must also ensure that consumer credit reports are released only for the purposes discussed above.72 In order to ensure that the reports are used for permissible purposes, the credit reporting agencies must require that the prospective users of the information identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose.73

CRAs also have a duty to notify furnishers of information in the files and users of consumer reports of their responsibilities under the FCRA.74

In addition to the general responsibilities discussed above, a CRA has responsibilities with regard to investigative consumer reports and reports provided for employment purposes. Prior to collecting information for or preparing an investigative consumer report, the CRA must disclose to the consumer the nature and scope of the requested investigation and the fact that such a report may be made.75 A CRA may not prepare or furnish an investigative consumer report unless it has received certification from the requesting party that the required disclosures have been made to the consumer.76 With regard to reports prepared for employment purposes, a CRA must take precautions to insure the accuracy of public record information that may be included in the report.77 The consumer must be notified that such information is being reported and be given the name and address of the person to whom the information is being reported; or the CRA must "maintain strict procedures designed to insure that whenever public information which is likely to have an adverse effect on the consumer's ability to obtain employment is reported it is complete and up to date."78

Responsibilities of Furnishers of Information

Many types of businesses and organizations contribute information to consumers' credit files. The major credit reporting agencies classify contributors of information into the following categories:

automobile dealers; banks, clothing, department, and variety stores; finance agencies; grocery and home furnishing dealers; insurers; jewelry and camera stores; contractors; lumber, building materials, and hardware suppliers; medical-care providers; national credit card companies and airlines; oil companies (credit card divisions); personal services other than medical; mail-order houses; real estate agents; hotel keepers; sporting goods and farm and garden supply dealers; utilities; fuel distributors; government agencies (e.g. the Federal Housing Administration and the Veterans Administration); wholesalers; advertisers; and collection agencies.79

Generally, any person who has information related to a consumer's financial activities can report information about his or her transactions and experiences with the consumer to a CRA. However, a person or business with information about a consumer is not required to report that information to a CRA. If negative information is reported, the furnisher must notify the consumer in writing.80

Persons who furnish information to CRAs have a duty to provide accurate information. Under the FCRA, a furnisher may not provide any information relating to a consumer to a CRA if the person knows or has reasonable cause to believe that the information is inaccurate.81 Furnishers of information are also prohibited from providing information if the consumer has notified them that the information is inaccurate.82 Furnishers are also prohibited from providing information that the consumer reports as resulting from identity theft, unless the furnisher subsequently knows or is informed by the consumer that the information is correct.83 The FCRA requires furnishers of information to adopt reasonable procedures to prevent information resulting from identity theft from being refurnished after notification from a CRA that such information resulted from identity theft.84

In addition to the reinvestigation requirements imposed on CRAs, furnishers of information are also required to investigate disputed information. After a furnisher of information receives notice from a CRA regarding disputed information in a consumer report, the person furnishing the information must investigate and report the results to the CRA.85 If the furnisher finds that the information is incomplete or inaccurate, the furnisher must report those results to all other CRAs to which the incomplete or inaccurate information was furnished.86 Furnishers of information must also notify CRAs when an account is closed by the consumer, and when delinquent accounts are being placed for collection, charged to profit or loss, or subjected to any other similar action.87

The FCRA also allows consumers to dispute the accuracy of information directly with the furnisher. Furnishers must investigate the disputed information and report the results to the consumer within a specified period of time.88 If the information is found to be inaccurate, the furnisher must notify each CRA to which the information was originally furnished and provide the correct information.89

Requirements for Users of Consumer Reports

As noted above, consumer credit reports can be used only for the purposes specified in the FCRA. Despite these limitations, users of consumer credit reports vary widely. The most common users of consumer reports are credit grantors, such as credit card companies. Other common users include insurers, employers, collection agencies, and government agencies.90 The FCRA imposes specific requirements on persons who use consumer report information.

Users of consumer reports must follow the requirements set forth in the FCRA if they take any adverse action with respect to any consumer that is based in whole or in part on any information contained in the consumer's report.91 If such action is taken, the user must provide the consumer with oral, written, or electronic notice of the adverse action.92 The notice must include the name, address, and telephone number of the CRA that furnished the report to the user; and a statement that the CRA did not take the adverse action and is unable to provide the consumer with specific reasons why the adverse action was taken.93 The consumer must be notified of his or her right to obtain a free copy of the consumer report from the CRA that furnished the report and of the consumer's right to dispute the accuracy or completeness of that report.94 The consumer must also be given written or electronic disclosure of a credit score used in any adverse action based in whole or in part on any information in the consumer report, including the range of credit scores, the factors adversely affecting the score, the date the score was created, and the provider of the credit score.95

A notice must also be provided by users who grant, extend, or otherwise provide credit on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that user.96 The notice must inform the consumer that the terms offered to the consumer were set based on information from a consumer report; identify the CRA that furnished the report; inform the consumer that he or she may obtain a free copy of the consumer report from that CRA; provide the contact information specified by the CRA for obtaining such reports; and provide the credit score used in deciding the credit terms, the range of credit scores, the factors adversely affecting the score, the date the score was created, and the provider of the credit score.97

The FCRA also imposes duties on users of consumer reports when reports are used in connection with a credit or insurance transaction not initiated by the consumer. Written solicitations made to consumers regarding credit or insurance transactions not initiated by the consumer must include a "clear and conspicuous statement" that information from the consumer's credit report was used in connection with the transaction; the consumer received the offer for credit or insurance because he or she satisfied specified criteria; and the credit or insurance may not be extended if, after the consumer responds to the offer, the consumer does not meet additional criteria used to determine creditworthiness or insurability.98 The statement must also inform the consumer of his or her right to prohibit information contained in his or her file from being used in connection with any transaction he or she did not initiate and how he/she may exercise this right.99

Identity Theft Provisions

The FCRA includes a number of provisions aimed at preventing identity theft and assisting victims of identity theft.100 These provisions mirror laws passed by state legislatures and create a national standard for addressing consumer concerns with regard to identity theft and other types of fraud.101 They impose responsibilities on CRAs, furnishers of information, and users of consumer credit reports, and provide consumers with rights for protecting the information in their files and insuring that the information contained in them is accurate.

Credit card issuers are required to follow certain procedures when they receive a request for an additional or replacement card within a short period of time following notification of a change of address for the same account.102 In a further effort to prevent identity theft, credit card account numbers must be truncated on electronically printed receipts,103 and, upon request, social security numbers must be truncated on credit reports provided to a consumer.104 Because hundreds of apparently frivolous lawsuits were being brought for willful noncompliance where the expiration date of a credit card was on a receipt although the number was truncated and there was no allegation of injury to consumers, a 2008 amendment to the FCRA clarified that the mere printing of the expiration date did not constitute willful noncompliance if the receipt otherwise complied with the FCRA.105 In United States v. Bornes,106 a recent U.S. Supreme Court case, the plaintiff alleged that the federal government violated the FCRA prohibition against printing the expiration date of a consumer's credit card on a receipt provided at the point of sale or transaction. The plaintiff/respondent had received electronic internet and email receipts displaying the expiration date of the personal credit card that he used to pay government filing fees for a client's lawsuit. The Court held that the Little Tucker Act, 28 U.S.C. 1346(a)(2), does not waive the sovereign immunity of the United States with respect to damages actions for violations of the FCRA.107 The Court remanded the case to the U.S. Court of Appeals for the Seventh Circuit to consider whether the FCRA itself waives the federal government's immunity.

Consumers who have been victims of identity theft, or expect that they may become victims, can have fraud alerts placed in their files.108 A consumer may request a fraud alert from one CRA and that CRA is required to notify the other nationwide CRAs of the alert.109 In general, fraud alerts are to be maintained in the file for 90 days, but a consumer may request an extended alert which is maintained for up to seven years. The fraud alert becomes a part of the consumer's credit file and is thus passed along to all users of the report. The alert must also be included with any credit score generated using the consumer's file.110

In addition to the fraud alert, victims of identity theft may have information resulting from the crime blocked from their credit reports.111 After receiving proof of the consumer's identity, a copy of an identity theft report, the identification of the alleged fraudulent information, and a statement by the consumer that this particular information does not relate to any transaction he/she conducted, a CRA must block this particular information from being reported and must notify the furnisher of the information in question that it may be the result of identity theft. Requests to block information must also be referred to other CRAs.112

Victims of identity theft may request information about the alleged crime. A business entity is required, upon request and subject to verification of the victim's identity, to provide copies of application and business transaction records evidencing any transaction alleged to be a result of identity theft to the victim without charge or to any law enforcement agency investigating the theft and authorized by the victim to receive the records in question.113

Pursuant to FACT Act amendments in 2003,114 the federal agencies regulating the financial services industry promulgated guidelines and regulations, known as the Red Flags Rule, requiring financial institutions and creditors to establish reasonable policies and procedures to prevent identity theft.115 The Red Flags Rule had an effective date of January 1, 2008, and a mandatory compliance date of November 1, 2008, but the mandatory compliance date was delayed several times due in part to controversy over the scope of entities covered by the rule as creditors.116 The final mandatory compliance date was December 31, 2010, permitting time for Congress to enact the Red Flag Program Clarification Act of 2010,117 clarifying that creditors covered by the rule do not include businesses that advance funds for expenses incidental to the services they offer, such as lawyers, doctors, dentists, etc. Creditors subject to the rule are entities that "regularly and in the ordinary course of business" obtain credit reports in connection with credit transactions, furnish information to CRAs in connection with credit transactions, and extend credit based on an obligation to repay.

Legislative Proposals

Various proposals have been made in the 113th Congress regarding regulating credit report information and use. H.R. 645 would restrict using credit report information for employment unless an employee's personal creditworthiness is relevant to employment responsibilities.118 H.R. 1002/S. 471 would require CRAs to provide one free credit score a year to a consumer upon his or her request in addition to the free annual credit report that CRAs must currently provide to consumers.119 In addition, because lenders increasingly use credit scores as thresholds for loan eligibility as well as to determine appropriate loan terms, there has been interest in Congress in regulating how credit scores are calculated. For example, S. 160 would bar including certain medical debt in credit reports on the grounds that people generally do not intentionally incur medical or health care expenses but rather incur them through "no fault of the consumer" or by an "act of God."120 By restricting medical debt that has been in collection and subsequently paid or settled from being included in credit reports, S. 160 would effectively exclude such medical debt from credit score calculations.121

There are, however, several concerns with regulating credit reports and scores. First, because credit scores are calculated pursuant to proprietary formulae, requiring CRAs to provide free scores may amount to an unconstitutional taking of property in violation of the Fifth Amendment of the U.S. Constitution. While this concern was raised during Congress' consideration of the FACT Act provision requiring CRAs to provide free annual credit reports,122 courts do not appear to have resolved this issue yet.

Second, a consumer does not have a single credit score. As noted above, creditor/lenders formulate or contract with third parties for credit score algorithms that reflect the creditor/lender's particular needs. As a consequence, consumers may have many credit scores, reflecting various algorithms that weigh factors differently. Thus, even if CRAs were statutorily required to provide a free credit score or even a range of free credit scores to consumers, these scores may not reflect the score that a creditor/lender actually uses to determine whether and under what terms to extend a loan to a consumer.

Third, restricting or dictating how credit scores are formulated would arguably undermine a creditor/lender's ability to use credit scores to assess quickly a potential debtor/borrower's creditworthiness. While there may be legitimate concerns about credit score accuracy and fairness, limiting how creditor/lenders determine such scores precludes them from ascertaining risk factors that they deem relevant for assessing creditworthiness. Although a creditor/lender could always rely on the full credit report, a more detailed loan application, or interviews with the potential borrower/debtor, these alternatives could increase the creditor/lender's costs. In addition, dictating the content of proprietary formulas would set precedent for intervening legislatively in this type of financial product.123 Restricting certain items from appearing in credit reports would similarly affect the access of a creditor/lender to a complete and accurate picture of the creditworthiness of a debtor/borrower.

Footnotes

1.

P.L. 91-508, Title VI, §601, 84 Stat. 1128 (1970), codified as amended at 15 U.S.C. §§1681–1681x.

2.

The purpose of the FCRA is "to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information." 15 U.S.C. §1681(b).

3.

P.L. 108-159, 117 Stat. 1952. These provisions are discussed in detail infra at Identity Theft Provisions. More information on these provisions and other issues related to identity theft can be found in CRS Report R40599, Identity Theft: Trends and Issues, by Kristin M. Finklea; CRS Report RL31919, Federal Laws Related to Identity Theft, by [author name scrubbed]. For information on data security generally and related legislative proposals, see CRS Report RL34120, Federal Information Security and Data Breach Notification Laws, by [author name scrubbed], and CRS Report RL33273, Data Security: Federal Legislative Approaches, by [author name scrubbed].

4.

P.L. 111-24, 123 Stat. 1734 (2009).

5.

P.L. 111-203, Title X, §§1001–1100H, 124 Stat. 1376–2113 (2010).

6.

P.L. 111-203, 124 Stat. 1376 (2010).

7.

Id., §§1024-1027, 1029, and 1061 provide for the certain functions of the CFPB and the transfer of functions from the other federal financial services agencies and the FTC to the CFPB. The changes to administrative enforcement authority for the FCRA made by §1088 of the Dodd-Frank Act are codified at 15 U.S.C. §1681s. The Dodd-Frank Act did not transfer to the Bureau the rulemaking authority for the Red Flag guidelines and regulations pursuant to 15 U.S.C. §1681m(e) and for the disposal of records pursuant to 15 U.S.C. §1681w. Also, the FTC retained rulemaking authority over auto dealers pursuant to §1029 of the Dodd-Frank Act. Pursuant to §1024(c)(3) of the Dodd-Frank Act, the CFPB and the FTC recently concluded a Memorandum of Understanding to establish a framework for coordinating enforcement and regulatory efforts, which is available at http://www.ftc.gov/os/2012/01/120123ftc-cfpb-mou.pdf, while the press release is available at http://www.ftc.gov/opa/2012/01/ftccfpb.shtm. Regulation V, the Fair Credit Reporting Regulations, are now at 12 C.F.R. part 1022, part of the CFPB's regulations that are promulgated at 76 Fed. Reg. 79308 (2011).

For more information on the transfer of functions to the CFPB, see CFPB, Streamlining Inherited Regulations, 76 Fed. Reg. 75825 (2011); CFPB, Identification of Enforceable Rules and Orders, 76 Fed. Reg. 43569 (2011); CFPB, Agencies Issue Statement to Clarify Supervisory and Enforcement Responsibilities For Federal Consumer Financial Laws, at http://www.consumerfinance.gov/pressrelease/agencies-issue-statement-to-clarify-supervisory-and-enforcement-responsibilities-for-federal-consumer-financial-laws; and CRS Report R41338, The Dodd-Frank Wall Street Reform and Consumer Protection Act: Title X, The Consumer Financial Protection Bureau, by [author name scrubbed]. The FTC issued a report on its experiences administering and enforcing the FCRA, Forty Years of Experience with the Fair Credit Reporting Act: An FTC Staff Report and Summary of Interpretations (2011), while simultaneously rescinding its official staff interpretations in the Code of Federal Regulations, in anticipation of the transfer of certain regulatory functions to the CFPB. The FTC's report and rescission are available at http://www.ftc.gov/opa/2011/07/fcra.shtm.

8.

15 U.S.C. §1681a(f) (defining a CRA as "any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.").

9.

Frederick H. Miller, et al., Consumer Law: Cases, Problems, and Materials, p. 296 (1998).

10.

In July 2012, the CFPB posted a list of consumer reporting companies on its website. See http://www.consumerfinance.gov/blog/so-how-many-consumer-reporting-companies-are-there and http://files.consumerfinance.gov/f/201207_cfpb_list_consumer-reporting-agencies.pdf. The Bureau cautions that the list does not cover every company in the consumer reporting industry, just those that have identified themselves as consumer reporting companies or that provide consumers access to their reports. Id.

11.

15 U.S.C. §1681a(d)(1).

12.

Id. §1681a(d)(2)(A); see Debtor-Creditor Law §16.02[3] (Matthew Bender & Co. 2011) ("The first type of excluded information [among persons related by common ownership] is information based on first-hand experience of one of the affiliates. The second type [among persons affiliated by corporate control] is any other information shared by affiliates, provided that the sharing is disclosed to the consumer and the consumer is given the opportunity to direct that the information not be shared among related entities.").

13.

15 U.S.C. §1681a(d)(2)(B).

14.

Miller, supra note 9.

15.

Experian does not maintain information concerning criminal records; see http://www.experian.com/credit-education/credit-report-faqs.html.

16.

Miller, supra note 9.

17.

15 U.S.C. §1681c(a). The seven- and ten-year reporting limitations do not apply to transactions involving, or which may be expected to involve, an amount greater than $150,000; the underwriting of life insurance involving, or which may involve, an amount of $150,000 or more; or to the employment of any individual at an annual salary which equals, or may be expected to equal, more than $75,000. 15 U.S.C. 1681c(b). Information regarding certain types of student loans may be reported until the loan is paid in full. 20 U.S.C. §1087cc(c)(3).

18.

15 U.S.C. §1681c(d).

19.

Id.

20.

Id. §1681s-1.

21.

The FACT Act of 2003, P.L. 108-159, §§411 and 412, 117 Stat. 1999-2003, amending 15 U.S.C. §§1681a(d)(3) and (i), 1681b(g), 1681c(a)(6), and 1681s-2(a)(9).

22.

15 U.S.C. §1681g(f)(2)(A)(i).

23.

See H. Rep. No. 108-263, at 82-92 (2003) (memorandum on constitutional taking implications by Pepperdine University Law Professor Douglas W. Kmiec) and, e.g., Black v. JP Morgan Chase & Co., 2011 U.S. Dist. LEXIS 103727 at 170-171 (W.D. Pa. Aug. 10, 2011) ("Similarly here, VantageScore's only 'product' was its intellectual property—a credit scoring model/algorithm—which it licensed exclusively to the three credit reporting agencies, for their use in calculating consumers' credit scores. The VantageScore® algorithm was not the final product that was being marketed by the credit reporting agencies for retail sale in Pennsylvania; rather, the credit reporting agencies were offering credit scores for sale, which were calculated by utilizing VantageScore's patented intellectual property.") and FTC v. 1st Guar. Mortg. Corp., 2011 U.S. Dist. LEXIS 38152 at 39, 2011-1 Trade Cas. (CCH) P77400 (S.D. Fla. Mar. 30, 2011) ("Even if the defendants had such documentation from consumers, they still could not predict how their credit repair efforts would impact consumers' credit scores because the analytics for deriving credit scores are proprietary to credit reporting agencies and were not transparent to the defendants.").

24.

FAQs for consumers, What information goes into my credit score?, available at http://www.consumerfinance.gov/askcfpb/317/what-information-goes-into-my-credit-score.print.html and discussed in the CFPB report, infra note 27, at 5.

25.

15 U.S.C. §1691 et seq.

26.

Id. §1691(a).

27.

The Dodd-Frank Act, P.L. 111-203, §1078, 124 Stat. 1376, 2076 (2010), required the study and report by the Bureau, Report to Congress: The impact of differences between consumer- and creditor-purchased credit scores, available at http://www.consumerfinance.gov/report/the-impact-of-differences-between-consumer-and-creditor-purchased-credit-scores.

28.

CFPB, Analysis of Differences between Consumer-and Creditor-Purchased Credit Scores, available at http://www.consumerfinance.gov/reports/analysis-of-differences-between-consumer-and-creditor-purchased-credit-scores.

29.

Id. at 20 ("The study found that for 73-80% of consumers different scoring models place consumers in the same category of credit quality. Different scoring models place consumers in credit-quality categories that are off by one category 19-24% of the time. And from 1% to 3% of consumers are placed in categories that are two or more categories apart.").

30.

Id. at 20.

31.

Id. at 20-21.

32.

15 U.S.C. §1681b.

33.

Id. §1681b(a)(3)(A).

34.

Id. §1681b(a)(3)(F).

35.

Id. §1681b(a)(3)(G).

36.

Id. §1681b(a)(3)(C). For more information on the use of consumer credit information by the insurance industry, see CRS Report RS21341, Credit Scores: Credit-Based Insurance Scores, by [author name scrubbed].

37.

Id. §1681b(a).

38.

Id. 1681b(c)(1). This provision allows "prescreening" by a consumer reporting agency. "Prescreening" is the process "whereby a consumer reporting agency compiles or edits a list of consumers who meet specific criteria and provides this list to the client or third party on behalf of the client for use in soliciting these consumers for the client's products or services." 55 Fed. Reg. 18,815 (1990). Prescreening is permissible under the FCRA if the client agrees in advance that each consumer on the list will receive an offer of credit. See CCH Consumer Credit Guide, ¶ 25,050.

39.

Id. §1681b(e). Pursuant to the 2003 amendment to the FCRA, persons who use consumer reports for prescreening purposes must provide the consumer with a statement including the address and telephone number where the consumer may request to be excluded from prescreened lists. The consumer's election to be excluded from such lists is effective for five years. FACT Act of 2003, P.L. 108-159, §213, 117 Stat. 1978, codified as amended at 15 U.S.C. §1681m(d)(2).

40.

Id. §1681b(c)(2).

41.

Id. §1681b(c)(1)(B)(iv). Subparagraph (iv) was added by the Credit CARD Act of 2009, P.L. 111-24, §302, 123 Stat. 1748.

42.

Id. §1681b(a)(3)(D).

43.

Id. §1681b(a)(1).

44.

Id. §1681b(a)(4). In order for reports to be released for this purpose, the paternity of the consumer must have been established or acknowledged by the consumer; the consumer must be given notice of the request; and the report must be kept confidential and used only for this purpose. Id.

45.

15 U.S.C. §1681b(a)(3)(B). Under the FCRA, "employment purposes" mean "a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee." Id. §1681a(h).

46.

Id. §1681b(b)(1).

47.

Id. §1681b(b)(2).

48.

Id. §1681b(b)(3).

49.

Id. §1681b(a)(6).

50.

Id. §1681g(a). Credit scores must be made available to consumers pursuant to an amendment in the FACT Act of 2003, P.L. 108-159, §212(a), (b), 117 Stat. 1973, codified as amended at 15 U.S.C. §1681g(a), (f). Prior to this amendment, CRAs were under no obligation to release credit scores. For a discussion of how credit scores are used, see CRS Report RS21298, Credit Scores: Development, Use, and Policy Issues, by [author name scrubbed].

51.

15 U.S.C. §1681j(a), as amended by the FACT Act of 2003, P.L. 108-159, §211(a), 117 Stat. 1968. For more information on free credit reports, see CRS Report RL32008, A Consumer's Access to a Free Credit Report: A Legal and Economic Analysis, by Loretta Nott and Angie A. Welborn (pdf). The free credit report is not required to include the consumer's credit score. The credit score must be disclosed upon request, but a reasonable fee may be imposed for the disclosure. P.L. 108-159, §212(b), 117 Stat. 1973-1975, codified as amended at 15 U.S.C. §1681g(f)(8).

52.

The Credit CARD Act of 2009, P.L. 111-24, §205, 123 Stat. 1734, 1747 (2009), codified as amended at 15 U.S.C. §1681j(g). This requirement responded to consumer confusion about whether certain free credit reports, offered by consumer reporting agencies in conjunction with the sale of other credit information or monitoring services, were the statutorily required free annual reports. See also the related rule at 12 C.F.R. §1022.138.

53.

See 15 U.S.C. §1681j(b), (c), and (d).

54.

15 U.S.C. §1681j(f) and, Notice regarding charges for certain disclosures under the Fair Credit Reporting Act, 77 Fed. Reg. 74831 (2012) (notice of the annual adjustment, based on the Consumer Price Index, of the maximum reasonable fee that can be charged for disclosures under 15 U.S.C. §1681g, other than the free annual credit report and notices and disclosures required by the FCRA). The Dodd-Frank Act, §1088, 124 Stat. 1376, 2086-92 (2010), transferred the responsibility for the annual fee adjustment from the FTC to the CFPB (see 15 U.S.C. §1681j(f)(2)).

55.

15 U.S.C. §1681g(f)(8). In its 2009 regulatory plan and unified agenda, the FTC noted that it was required by the FACT Act to determine a fair and reasonable fee for credit scores and had issued a Notice of Proposed Rulemaking in 2004. However, the FTC determined that the prices in the credit score market were already reasonable and competitive and chose to monitor the market rather than establish a specific fee. 74 Fed. Reg. 64131, 64367 (2009) ("The Commission was required to determine a fair and reasonable fee to be charged by a consumer reporting agency for providing the credit score information required under FACTA. On November 8, 2004, the Commission issued an NPRM on reasonable fees for credit scores. 69 FR 64698. The comment period ended on January 5, 2005. Staff reviewed the comments and is monitoring the credit score market, where prices have continued to remain reasonable and competitive.").

56.

Id. §1681g(f)(1).

57.

Id. §1681g(g).

58.

Discussed infra notes 95 and 97.

59.

15 U.S.C. §1681g(a)(3).

60.

Id. §1681g(a)(4), (5).

61.

Id. §1681i.

62.

Id. §1681i(a)(1)(A).

63.

Id. §1681i(a)(2)(A).

64.

Id. §1681i(a)(4).

65.

Id. §1681i(a)(3)(A).

66.

Id. §1681i(a)(3)(B).

67.

Id. §1681i(a)(5).

68.

Id. §1681i(a)(6)(A).

69.

Id. §1681i(a)(6)(B).

70.

Id. §1681i(a)(1)(A).

71.

Id. §1681c(h).

72.

Id. §1681e(a)

73.

Id.

74.

15 U.S.C. §1681e(d). For discussions of the responsibilities of furnishers of information and users of credit reports, see infra.

75.

15 U.S.C. §1681d(a), (b).

76.

Id. §1681d(d).

77.

Id. §1681k.

78.

Id. §1681k(a)(1), (2).

79.

Miller, supra note 9, p. 298.

80.

15 U.S.C. §1681s–2(a)(7).

81.

15 U.S.C. §1681s–2(a)(1).

82.

Id.

83.

15 U.S.C. §1681s–2(a)(6).

84.

Id.

85.

15 U.S.C. §1681s-2(b)(1).

86.

Id.

87.

15 U.S.C. §1681s-2(a)(4), (5).

88.

15 U.S.C. §1681s-2(a)(8)(E).

89.

Id.

90.

For descriptions of how each uses the information contained in consumer reports, see Miller, supra note 9, pp. 300–301.

91.

In general, an adverse action is any negative action, such as a denial or termination, taken with respect to the consumer's application or continued coverage for credit, insurance, or employment. The FCRA provides a detailed definition of adverse action at 15 U.S.C. §1681a(k).

92.

15 U.S.C. §1681m(a)(1).

93.

15 U.S.C. §1681m(a)(3). Particular requirements relate to adverse actions based on information received from third parties other than CRAs. These requirements generally impose a duty on the user to disclose the reasons for the adverse action and the nature of the information received from the third party. See 15 U.S.C. §1681m(b).

94.

15 U.S.C. §1681m(a)(4).

95.

Id. §1681m(a)(2). The requirement for credit score disclosure was added by the Dodd-Frank Act, P.L. 111-203, §1100F, 124 Stat. 1376, 2112 (2010).

96.

Id. §1681m(h)(1).

97.

15 U.S.C. §1681m(h)(5). The subparagraph requiring credit score disclosure (15 U.S.C. §1681m(h)(5)(E)) was added by the Dodd-Frank Act, P.L. 111-203, §1100F, 124 Stat. 1376, 2112 (2010).

98.

15 U.S.C. §1681m(d)(1).

99.

Id.; see also 15 U.S.C. §1681b(e).

100.

For more information on identity theft issues and the Red Flags Rule, discussed infra in this section, see CRS Report R40599, Identity Theft: Trends and Issues, by Kristin M. Finklea.

101.

Generally, many of these federal provisions preempt similar state laws. For more information on the preemptive effects of the Fair Credit Reporting Act, see CRS Report RS21449, Fair Credit Reporting Act: Preemption of State Law, by [author name scrubbed].

102.

15 U.S.C. §1681m(e)(1)(C) (pertaining to the Red Flag guidelines and rules designed to prevent identity theft).

103.

Id. §1681c(g).

104.

Id. §1681g(a)(1)(A).

105.

Credit and Debit Card Receipt Clarification Act, P.L. 110-241, §3(a), 122 Stat. 1565 (2008) (codified at 15 U.S.C. 1681n(d)).

106.

___ U.S. ___, 133 S. Ct. 12, 184 L. Ed. 2d 317 (2012).

107.

The Court held that where a specific statutory scheme, in this case, the remedial scheme of the FCRA, provided for the details of a judicial action, the limits of the liability Congress intended to create can only be divined from the text of the statute, i.e., the FCRA, itself. The plaintiff could not "mix and match FCRA's provisions with the Little Tucker Act's immunity waiver to create an action against the United States. Since FCRA is a detailed remedial scheme, only its own text can determine whether the damages liability Congress crafted extends to the Federal Government. To hold otherwise--to permit plaintiffs to remedy the absence of a waiver of sovereign immunity in specific, detailed statutes by pleading general Tucker Act jurisdiction--would transform the sovereign-immunity landscape." 133 S. Ct. at 19.

108.

15 U.S.C. §1681c-1.

109.

Id. §§1681c-1(a)(1)(B) and 1681s(f)(1).

110.

Id. §1681c-1(a)(1)(A).

111.

Id. §1681c-2.

112.

Id. §1681s(f)(1).

113.

Id. §1681g(e).

114.

The FACT Act, P.L. 108-159, §114, 117 Stat. 1952, 1960-61 (2003), made amendments codified at 15 U.S.C. §1681m(e).

115.

72 Fed. Reg. 63718 (2007). The Dodd-Frank Act did not transfer authority to prescribe regulations with regard to the Red Flags requirements to the CFPB. Such authority is retained by the federal banking agencies as well as the National Credit Union Administration, the FTC, the Commodity Futures Trading Commission, and the Securities and Exchange Commission.

116.

See 156 Cong. Rec. H8059-60 (daily ed. December 7, 2010); 156 Cong. Rec. S8288-89 (daily ed. November 30, 2010); FTC, FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule (2010), at http://www.ftc.gov/opa/2010/05/redflags.shtm; FTC, FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule (2009), at http://www.ftc.gov/opa/2009/10/redflags.shtm.

117.

P.L. 111-319, 124 Stat. 3457 (2010), codified at 15 U.S.C. §1681m(e)(4).

118.

H.R. 645, 113th Congress. Relevant employment would include a job that requires a national security or Federal Deposit Insurance Corporation clearance; a state/local government agency job that requires use of a credit report; or a supervisory, managerial, professional, or executive position at a financial institution.

119.

H.R. 1002/S. 471, 113th Congress, which would require a consumer reporting agency to provide a consumer, upon request, with any credit score or risk score in the consumer's file and to maintain such a score for at least one year from the date when the score is generated. Aside from the score included with the free annual credit report, a fair and reasonable fee could be charged for these requested scores. Currently, a consumer reporting agency need only the current score or the one most recently calculated in connection with an extension of credit and is not required to maintain credit scores in consumer files.

120.

S. 160, 113th Congress.

121.

S. 160, 113th Congress.

122.

See H. Rep. No. 108-263, supra note 23, at 82-92.

123.

See various views on regulation of credit scores in Keeping Score on Credit Scores: An Overview of Credit Scores, Credit Reports, and Their Impact on Consumers, Hearing before the Subcomm. on Financial Institutions and Consumer Credit of the House Comm. on Financial Services, Serial No. 111-117, 111th Cong. (2010).