| |
Consumer Finance Law Quarterly Report
*46 PRIVACY AND DEBT COLLECTION IMPLICATIONS OF THE FAIR CREDIT REPORTING ACT AND THE 2003 FACT ACT
Spring-Summer, 2004
Symposium: Privacy, Identity Theft, and the FACT Act
Copyright © 2004 by Conference on Consumer Finance Law; Stephen Gardner
Stephen Gardner [FNa1]
I. Introduction
This article discusses the interplay between credit reporting and consumer privacy, with a focus on the recent overhaul of the federal Fair Credit Reporting Act (FCRA or the Act). [FN1]
II. FCRA vs. Privacy
Many financial institutions, and other creditors, view the FCRA as a necessary evil, or perhaps a burdensome compliance necessity. The credit reporting agencies seem to view the FCRA as an impediment to their use of the financial data that they think they own. Consumers, however, view that same financial data as private data that belongs to them. Silly consumers? Not necessarily so.
The FCRA should be viewed by the financial community as a limited license permitting what otherwise would be an illegal invasion of privacy. Consider what Congress said when it passed the FCRA: "There is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy." [FN2] "Congress enacted the FCRA in 1970 to promote efficiency in the nation's banking system and to protect consumer privacy." [FN3] Consider also the get-out-of-jail-free card Congress gave, prohibiting any consumer claim for "defamation, invasion of privacy, or negligence with respect to the reporting of information" (as long as it was not with "malice or willful intent to injure" the consumer). [FN4] Courts agree: An "action under the statute must stand in lieu of any other action in the nature of invasion of privacy, negligence, or defamation." [FN5]
To plead a claim for invasion of privacy, generally a plaintiff must allege: (1) a public disclosure; (2) of private facts; (3) which is offensive to a person of reasonable sensibilities. [FN6] The tort of publication of private facts consists of giving "publicity to a matter concerning the private life of another...if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public." [FN7] "Publicity...means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge.... Thus it is not an invasion of the right of privacy, within the rule stated in this Section, to communicate a fact concerning the plaintiff's private life to a single person or even to a small group of persons." [FN8]
The "malice or willful" standard is no piece of cake for the plaintiff's lawyer. "While the term 'willful' is not defined under the FCRA, it has been interpreted in this context as requiring a showing that the agency knowingly and intentionally *47 committed an act in conscious disregard for the rights of others. Courts considering what constitutes 'malice' under this section have borrowed the meaning of the term used in the context of libel litigation: in other words, an allegedly defamatory statement will be deemed to have been made with malice if the speaker knew it was false or acted with reckless disregard of its truth or falsity." [FN9] "The Act limits common law liability. however, by giving credit agencies and others qualified immunity for actions based on information disclosed pursuant to the [FCRA]." [FN10] If any more convincing is needed:
While the Court believes that perhaps there should be some protection against the inevitable intrusions on privacy, in the general if not in the traditional legal sense, that occur during such investigations, the Fair Credit Reporting Act, as a product of political compromise enacted for the specific purpose of curbing only the worst abuses by the credit reporting industry and its clients, cannot be read as a broad congressional vindication of a right to absolute, inviolate personal privacy in every aspect of one's life." [FN11]
From a consumer standpoint, however, not all is lost:
When a consumer brings an action for violation of the disclosure provisions of the FCRA, the Act's purpose of protecting consumer confidentiality is implicated. In that respect, such cases are akin to invasion of privacy cases under state law-cases where the plaintiff alleges that the defendant unlawfully invaded the plaintiff's privacy by obtaining information deemed confidential. We implied so in Hansen v. Morgan....and at least three of our sister circuits have agreed with that characterization. [FN12]
In addition to its general provisions, the FCRA provides furnishers of credit reports with absolute immunity when fulfilling their statutory obligations to furnish information to consumer reporting agencies. [FN13] Thus, although consumers may feel that the information contained in their credit reports is private and theirs to control, thanks to the FCRA it is neither completely private nor completely within their control.
One of the most significant types of consumer fraud is identity theft--the "bastard child" of the exponential expansion of financial data and the use of credit reports over the past two decades. Identity theft would never have been possible on the scale that now exists were it not for the FCRA and the ready access to credit reports that it permits, coupled with the frequent futility consumers experience when trying to correct errors in their credit reports. Thus, when President Bush signed H.R. 2622, the Fair and Accurate Credit Transactions Act of 2003 (the FACT Act or H.R. 2622), [FN14] into law on December 4, 2003, it marked a significant change in the way the credit reporting industry--the reporting agencies, the institutions that use reports, and those companies that furnish information--is allowed to conduct business.
III. 2003 Amendments--H.R. 2622 (The FACT Act)
A. Introduction
The 2003 FCRA amendments in the FACT Act represent sweeping changes that will benefit many consumers. Of course, Congress being Congress, it could not pass legislation that only benefitted consumers, without also throwing a number of favors to the financial industry. As enacted, H.R. 2622 was over 160 pages long, far too long to attempt to summarize completely in this article. However, the primary changes will be noted, in approximate order of significance.
B. Effective Date
The Federal Trade Commission (FTC) and the Federal Reserve Board (FRB) are required to prescribe final regulations "before the end of the [two]-month period beginning on the date of enactment of this Act." [FN15] However, "date of enactment" was not defined, so it is not entirely clear whether the clock started ticking when both houses passed it or when it was signed into law by the President. Taking the latest date possible for enactment--the December 4, 2003 date it was signed--the FRB and the FTC were required to come up with final regulations by February 4, 2004. [FN16]
These regulations are required to establish effective dates that are "as early as possible, while allowing a reasonable time for the implementation of the provisions of this Act," but Congress set an outside limit--"in no case shall any such effective date be later than [ten] months after the date of issuance of such regulations in final form."
The FTC and the FRB issued joint regulations in February 2004. [FN17] Most of the FACT Act amendments take effect December 1, 2004. [FN18] One significant amendment took effect earlier. The FACT Act amended the statute of limitations language, as discussed in a later section of this article. That amendment took *48 effect March 31, 2004, as well as other minor provisions. [FN19]
The earliest effective date was December 31, 2003, in which the federal agencies acted with breakneck speed to insure that the existing provisions of the FCRA that preempted state laws did not sunset. [FN20] The FTC and the FRB commented that "the current preemption provisions in the FCRA expire on January 1, 2004. Delaying final action on these provisions of the FACT Act would undermine the purpose of these provisions and is likely to provoke substantial confusion about the applicability of some state laws in areas that Congress has determined should be governed by uniform nationwide standards. Adopting these rules in final form on an interim basis also will have the effect of preserving the current state of the law while comment is received." [FN21] Therefore, the agencies announced an "interim final rule" that took effect seven days after publication in the Federal Register, with comments due by January 12, 2004--after the "interim" rule had made all comments moot. [FN22] And some folks say federal agencies can't act quickly.
In one respect, the FTC didn't just drop the ball--it handed it off to the other side. With respect to the requirement of annual free reports, the FTC ignored Congress's mandate that the FACT Act amendments become fully effective by December 2004. Rather than implement the clear language of the FACT Act, the FTC decided to permit a rolling effective date, based on the state of the consumer's residence and not fully effective until September 1, 2005. This is described infra at Part III. K.
C. Rights of Identity Theft Victims
"Identity theft" essentially means a fraud committed using the identifying information of another person, [FN23] The FTC and FRB can expand on this definition. Under the FACT Act, identity theft victims have the right to file a fraud report with the credit reporting agencies. There are two types of fraud reports, which vary in scope and effect based on the amount of proof provided by the consumer. [FN24]
The first, short-lived type is called a "One-Call Fraud Report." If a consumer, or a representative, [FN25] who asserts in good faith a suspicion that the consumer has been or is about to become a victim of fraud or a related crime, including identity theft, a reporting agency must: (1) include a fraud alert in the file of that consumer, and also provide that alert along with any credit score generated in using that file, for at least ninety days, unless the consumer requests that it be removed; and (2) refer the information regarding the fraud alert to each of the other consumer reporting agencies. At the same time, the reporting agency must tell the consumer that he or she can get a free copy of that consumer's file and must disclose the file within three business days of a request.
The One-Call Fraud Report allows a consumer to institute an alert very quickly and simply. It also has a short duration. The law therefore provides for a second type of fraud report, called an "Extended Report," which is instigated when the consumer, or a representative, submits an "identity theft report" to a reporting agency. An "identity theft report" will be given final definition by the FTC and FRB, but means, at a minimum, a report: (1) that alleges an identity theft; and (2) that is a copy of an official, valid report filed by a consumer with an appropriate federal, state, or local law enforcement agency, the filing of which may subject the person filing the report to criminal penalties relating to the filing of false information.
Upon receipt of the identity theft report, the credit reporting agency must: (1) include a fraud alert in the file of that consumer, and also provide that alert along with any credit score generated in using that file, for a seven-year period, unless the consumer requests that it be removed; (2) for the next five years, exclude that consumer from any prescreening list, unless the consumer or representative requests otherwise; and (3) refer the information regarding the fraud alert to each of the other consumer reporting agencies.
In the case of an Extended Alert, the reporting agency must tell the consumer that he or she can get two free copies of that consumer's file during the first year after the Extended Alert is placed in the file, and must provide the file within three business days of a request.
All Extended Alerts must notify all prospective users of a report on the consumer that the consumer does not authorize: (1) the establishment of any new credit plan or extension of credit in the name of the consumer, other than an extension under an open end credit plan; (2) issuance of an additional credit card on an existing credit account requested by a consumer; or (3) any increase in a credit limit on an existing credit account requested by a consumer. If a consumer requesting the alert has given a telephone number to be used for identity verification purposes, before authorizing any new credit plan or extension described above in the name of such consumer, a user of the credit report must contact the consumer using that telephone number or take reasonable steps to verify the consumer's identity and confirm that the application for a new credit plan is not the result of an identity theft.
*49 D. Active Duty Military
The FACT Act treats active duty military personnel as a special subcategory of potential identity theft victim. An "active duty military consumer" is a consumer in military service who: (1) is on active duty or is a reservist performing duty under a call or order to active duty; and (2) is assigned to service away from the usual duty station of the consumer.
At the request of an active duty military consumer, or a representative of that consumer, a credit reporting agency must include an "active duty alert" in the file of that consumer, and must provide that alert along with any credit score generated in using that file. An "active duty alert" is the same as an identity theft alert, except of course that it notifies that the consumer is on active duty. The alert must remain in the file at least twelve months, unless the consumer or representative requests that it be removed. For a two year period, the reporting agency must exclude that consumer from any prescreening list, unless the consumer or representative requests otherwise.
As with fraud alerts, all active duty alerts must notify all prospective users of a consumer report on the consumer that the consumer does not authorize: (1) the establishment of any new credit plan or extension of credit in the name of the consumer, other than under an open end credit plan; (2) issuance of an additional card on an existing credit account requested by a consumer: or (3) any increase in the credit limit on an existing credit account requested by a consumer. If a consumer requesting the alert has given a telephone number to be used for identity verification purposes, before authorizing any new credit plan or extension of credit in the name of such consumer, a user of such consumer report shall contact the consumer using that telephone number or take reasonable steps to verify the consumer's identity and confirm that the application for a new credit plan is not the result of an identity theft.
E. Truncation of Credit or Debit Card and Social Security Numbers
Another step that the FACT Act takes in preventing identity theft is to provide for truncation of records of credit/debit card numbers and Social Security numbers.
No person that accepts credit cards or debit cards for the transaction of business may print more than the last five digits of the card number or the expiration date on any receipt provided to the cardholder at the point of sale. This provision applies only to receipts that are electronically printed, and does not apply to transactions in which the sole means of recording an account number is by handwriting or by an imprint or copy of the card. [FN26]
Social Security number truncation is more limited. If the consumer has requested a copy of his or her own file and requests that the first five digits of the social security number (or similar identification number) of the consumer not be included in the disclosure, the consumer reporting agency must truncate the number. [FN27]
F. Red Flag Guidelines
The federal banking agencies, the National Credit Union Administration, and the FTC are required to: (1) establish "Red Flag Guidelines" regarding identity theft with respect to account holders at, or customers of, the various entities they regulate; (2) prescribe regulations requiring each entity to establish reasonable policies and procedures to identify possible risks to account holders or customers or to the safety and soundness of the institution or customers; and (3) prescribe regulations applicable to card issuers to ensure that, if a card issuer receives notification of a change of address for an existing account, and within a short period of time (during at least the first thirty days after such notification is received) receives a request for an additional or replacement card for the same account, the card issuer may not issue the additional or replacement card, unless the card issuer has good reason to believe that the person requesting the card is the account holder. [FN28]
G. Blocking Information Resulting from Identity Theft
A reporting agency must block the reporting of any information in the file of a consumer that the consumer identifies as information that resulted from an alleged identity theft, not later than four business days after the date of receipt by such agency of: (1) proof of the identity of the consumer; (2) a copy of an identity theft report; (3) identification of such information by the consumer; and (4) a statement by the consumer that the information is not information relating to any transaction by the consumer. [FN29]
After blocking the information, the reporting agency must promptly notify the furnisher of information identified by the consumer: (1) that the information may be a result of identity theft; (2) that an identity theft report has been filed; (3) that a block has been requested under this section; and (4) the effective dates of the block.
A reporting agency can refuse/decline to block, or may rescind a block, if the reporting agency reasonably determines that: (1) the information was blocked in error or a block was requested by the consumer in error; (2) the information was *50 blocked, or a block was requested by the consumer, on the basis of a material misrepresentation of fact by the consumer relevant to the request to block; or (3) the consumer obtained possession of goods, services, or money as a result of the blocked transaction or transactions.
This will likely lead to problems. All three criteria leave the judgment to the reporting agency's apparent sole discretion. The only thing the agency must do is tell the consumer it has refused or removed the block. There is no provision for disputing this decision, short of the inevitable lawsuits.
H. Prevention of "Repollution" of Reports
Congress took steps to prevent what it called "repollution" of reports with blocked information. A company that furnishes information for credit reports must have reasonable procedures in place to prevent it from refurnishing blocked information relating to information resulting from identity theft. If a consumer submits an identity theft report to a furnisher stating that information maintained by the furnisher that purports to relate to the consumer resulted from identity theft, the furnisher may not furnish such information that purports to relate to the consumer to any reporting agency, unless the furnisher subsequently knows or is informed by the consumer that the information is correct. [FN30]
Up until the last clause, everything was going swimmingly. But the furnisher's subsequent knowledge is not according to any set of criteria, and leaves too much room for sloppiness and indiscretion.
I. Limits on Debt Collection of Identity Theft Accounts
Congress placed two significant limits on efforts to collect an account that results from identity theft.
First, "no person shall sell, transfer for consideration, or place for collection a debt that such person has been notified under [new blocking] [FCRA] section 605B has resulted from identity theft." [FN31]
Second, if a third-party debt collector is notified that any information relating to a debt that the person is attempting to collect may be fraudulent or may be the result of identity theft, the collector must: (1) notify the creditor that the information may be fraudulent or may be the result of identity theft; and (2) upon request of the identity theft consumer, provide to that consumer all information to which the consumer would be entitled if the consumer were not a victim of identity theft but wished to dispute the debt under provisions of law applicable to that person. [FN32]
These two sections provide a victim the ways and means to prevent collection of fraudulent debts and to obtain the information necessary to a successful dispute.
J. Clearer, and Possibly Longer, Statute of Limitations
Addressing a misbegotten Supreme Court case [FN33] that started the statute of limitations running when the defendant violated the FCRA, rather than when the consumer learned of the violation, Congress used the FACT Act to make the FCRA more rational. The old rule was that the consumer had to sue "within two years from the date on which the liability arises." The FACT Act amendment allows suit "not later than the earlier of" two years from the date the consumer discovers the violation, or five years after the date on which the violation occurs. [FN34]
K. Annual Free Report
A reporting agency must give each consumer a report once during any twelve-month period without charge to the consumer, within fifteen days of the request. [FN35]
As noted above, the FTC decided to give the agencies more time to provide free reports than Congress had mandated, by providing a rolling effective date, based on the state of the consumer's residence.
The final FTC regulation provides that free reports will become mandatory on the following schedule: Alaska, Arizona, California, Colorado, Hawaii, Idaho, Montana, Nevada, New Mexico, Oregon, Utah, Washington, and Wyoming consumers must wait until December 1, 2004; Illinois, Indiana, Iowa, Kansas, Michigan, Minnesota, Missouri, Nebraska, North Dakota, Ohio, South Dakota, and Wisconsin cool their heels until March 1, 2005; Alabama, Arkansas, Florida, Georgia, Kentucky, Louisiana, Mississippi, Oklahoma, South Carolina, Tennessee, and Texas must wait until June 1, 2005. And consumers who live in Connecticut, Delaware, District of Columbia, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, New York, North Carolina, Pennsylvania, Rhode Island, Vermont, Virginia, and West Virginia), Puerto Rico, and all U.S. territories must wait even longer, until September 1, 2005.
In its own words, the FTC wanted "to protect the nationwide CRAs [Consumer Reporting Agencies] from receiving a volume of free credit report requests beyond their capacity to process. [FN36] It therefore gave the industry at least one year and thoroughly ignored the rights of consumers who live in the Eastern portion of the country.
Consumer advocates roundly criticized this proposal. In joint comments, the Consumer Federation of America, Consumers Union, the National Association of Consumer Advocates, the Privacy Rights Clearinghouse, Privacy Times, and U.S. PIRG said: "We are *51 disappointed that, without any evidence, the proposed rule grants unnecessary deference to the claims of the consumer reporting agencies (CRAs) that free report requests will damage their ability to perform other duties. This will result in enormous delays in access to free credit reports for millions of Americans and confusion about the new rights of access that will diminish the effectiveness of the law."
The FTC ignored these criticisms and others, doing only that which favored the CRAs.
L. Disclosure of Credit Scores
If a consumer asks for a credit score, the reporting agency must give the consumer a statement indicating that the information and credit scoring model may be different than the credit score that may be used by the lender, and a notice that includes: (1) the current credit score [FN37] of the consumer or the most recent credit score of the consumer that was previously calculated by the reporting agency for a purpose related to the extension of credit; (2) the range of possible credit scores under the model used; (3) all of the key factors [FN38] (up to a maximum of four) that adversely affected the credit score of the consumer in the model used; (4) the date on which the credit score was created; and (5) the name of the person that provided the credit score or credit file upon which the credit score was created. [FN39]
If the consumer requests the credit file and not the credit score, the reporting agency must advise that the consumer may request and obtain the credit score. [FN40]
M. Opting-Out of Prescreening
The current notice of the right to opt out of prescreening is strengthened by a requirement to provide the address and toll-free telephone number of the system to use to opt out, presented in a simple and easy to understand form. [FN41] The opt-out period is extended from two to five years. [FN42]
N. Affiliate Sharing Limits
Sharing of consumer information between affiliated companies is permitted only if the possibility of sharing is clearly and conspicuously disclosed to the consumer and the consumer has the right to opt out. [FN43]
O. Furnisher's Obligation to Tell Consumer About Negative Information
Any financial institution that: (1) extends credit and regularly and in the ordinary course of business furnishes information to a reporting agency; and (2) furnishes negative information to an agency regarding credit extended to a customer, must give the consumer written notice that it furnished the negative information, within thirty days of when it sends the information to the agency. [FN44]
P. Accuracy Guidelines
The federal banking agencies, the National Credit Union Administration. and the FTC must: (1) establish and maintain guidelines for use by each person that furnishes information to a reporting agency regarding the accuracy and integrity of the information relating to consumers that such entities furnish to consumer reporting agencies, and update such guidelines as often as necessary; and (2) prescribe regulations requiring each person that furnishes information to a consumer reporting agency to establish reasonable policies and procedures for implementing the guidelines. [FN45]
Q. Increased Furnisher Liability
Congress made it tougher for a creditor to pretend that it did not know that it furnished inaccurate information to a reporting agency. The prior law stated that a "person shall not furnish any information relating to a consumer to any consumer reporting agency if the person knows or consciously avoids knowing that the information is inaccurate."
As amended by the FACT Act, the FCRA says that a "person shall not furnish any information relating to a consumer to any consumer reporting agency if the person knows or has reasonable cause to believe that the information is inaccurate." [FN46]
This means that ignorance is no longer bliss.
R. Reasonable Reinvestigation Required
To eliminate some weaseling by the credit reporting agencies. Congress changed the language about reinvestigation from "shall reinvestigate free of charge" to "shall, free of charge, conduct a reasonable reinvestigation to determine whether the disputed information is inaccurate." [FN47] One hopes the reporting agencies will finally get the message that something more is required of them in a reinvestigation than their *52 current practice of merely confirming that the creditor sticks with its story.
S. Disputes to Furnishers
The federal banking agencies, the National Credit Union Administration, and the FTC will jointly prescribe regulations to identify the circumstances under which a furnisher will be required to reinvestigate a dispute concerning the accuracy of information contained in a consumer report on the consumer, based on a direct request of a consumer. [FN48]
After receiving a notice of dispute from a consumer, the furnisher will now have an affirmative duty to: (1) conduct an investigation with respect to the disputed information; (2) review all relevant information provided by the consumer with the notice; (3) complete such person's investigation of the dispute and report the results of the investigation to the consumer; and (4) if the information was inaccurate, promptly notify each consumer reporting agency to which the person furnished the inaccurate information of that determination and provide to the agency any correction to that information that is necessary to make the information provided by the person accurate.
Continuing with its unreasoned bias against lawful credit repair organizations, Congress provided that these rights do not apply if the notice of the dispute is submitted by, is prepared on behalf of the consumer by, or is submitted on a form supplied to the consumer by, a credit repair organization. [FN49] Although there are certainly crooked credit repair organizations, there are also honest ones, and many consumers go to them because they can't afford to hire a lawyer to deal with the intransigence of the reporting agencies and the furnishers. Thus, this doctrinaire exclusion is regrettable, but it exists nonetheless.
T. Improved Disclosure of the Results of Reinvestigation
If the credit reporting agency's reinvestigation shows that there is an error, it will now have to take steps to insure that its source learns of the error. The old FCRA read:
If, after any reinvestigation under paragraph (1) of any information disputed by a consumer, an item of the information is found to be inaccurate or incomplete or cannot be verified, the consumer reporting agency shall promptly delete that item of information from the consumer's file or modify that item of information, as appropriate, based on the results of the reinvestigation. [FN50]
As amended, the FCRA now reads (with the new language highlighted):
If, after any reinvestigation under paragraph (1) of any information disputed by a consumer, an item of the information is found to be inaccurate or incomplete or cannot be verified, the consumer reporting agency shall (i) promptly delete that item of information from the file of the consumer, or modify that item of information, as appropriate, based on the results of the reinvestigation; and (ii) promptly notify the furnisher of that information that the information has been modified or deleted from the file of the consumer. [FN51]
Plus, the FCRA is further amended by additions to the list of the duties of furnishers. If an item of information disputed by a consumer is found to be inaccurate or incomplete or cannot be verified after any reinvestigation, the furnisher must now, before furnishing information on that account to a reporting agency, either modify the information, delete it, or permanently block it, "as appropriate, based on the results of the reinvestigation." [FN52]
In other words, unless the furnisher's independent reinvestigation confirms that it was fully accurately reporting the information, it must at a minimum correct the information. If the information was wrong, it must delete it. If necessary to avoid misreporting in the future, it must block the information, even if it is partially correct.
IV. Preemption
The 2003 FACT Act amendments generally improve the rights of consumers with respect to credit reports. But Congress did not want the industry to go home empty-handed, so it also enacted a sweeping preemption of state laws aimed at credit reporting abuses. Primarily, what Congress did was to make permanent the temporary preemptions it had put in place in 1996 but that were set to expire on January 1, 2004. These preemptions are primarily found in the FCRA at 15 U.S.C. section 1681t, which starts out well enough: Except as specifically provided, the FCRA "does not annul, alter, affect, or exempt any person subject to the provisions of this subchapter from complying with the laws of any State with respect to the collection, distribution, or use of any information on consumers or for the prevention or mitigation of identity theft, except to the extent that those laws are inconsistent with any provision of this subchapter, and then only to the extent of the inconsistency." [FN53]
Sounds good, but Congress then proceeded to provide specifically for many types of preemption. For example, the states are prohibited from passing or enforcing laws relating to:
- Prescreening.
- The time frames for handling accuracy disputes.
- *53 - The duties of persons who take adverse actions (notices and disclosures).
- Transactions not initiated by a consumer.
- Duties of persons who use consumer reports in connection with credit or insurance.
- Information contained in consumer reports.
- Duties of furnishers of information.
- Information-sharing among affiliates (although the precise impact of this provision on California's new financial privacy law has not yet been fully determined).
The preemptive provisions through this point are extensions of the 1996 preemption. The provisions that follow are new preemptions:
- The information that businesses who grant credit to identity thieves are required to provide to victims.
- Consumers' rights to opt out of solicitations based on affiliate shared information. • Risk-based pricing notices.
- Annual free credit report.
- Credit score disclosure for credit-granting purposes and by mortgage lenders.
As to identity theft, there is preemption only with respect to the "conduct required by specific provisions of certain identified sections." These specific new provisions are:
- Truncation of credit or debit card numbers on receipts.
- Placement of fraud alerts and active duty alerts.
- Blocking information resulting from identity theft.
- Allowing consumers to request truncation of their Social Security numbers on communications sent to them.
- Red Flag guidelines regarding identity theft.
- Prohibiting sale or collection of debts resulting from identity theft.
- Collectors to notify creditors if they learn that a debt resulted from identity theft.
- The referral process between reporting agencies regarding identity theft complaints. fraud alerts, and blocking of information.
- Various disclosures, such as the summary of rights to obtain one's credit report and score and to dispute information, a summary of identity theft victim rights, and the right of an identity theft victim to get information from businesses.
- Procedures to prevent refurnishing of the information resulting from identity theft.
- Free credit reports for identity theft victims.
- Disposal of credit report-related records.
V. Medical Information
The FACT Act amends the FCRA to provide greater protections for a consumer report that contains medical information. The details are in the FACT Act, but are beyond the scope of this article. [FN54]
VI. Financial Literacy and Education Commission
Congress devoted one entire title of the FACT Act to establishment of a new commission, the Financial Literacy and Education Commission, whose mission is to "serve to improve the financial literacy and education of persons in the United States through development of a national strategy to promote financial literacy and education." It is comprised of the Secretary of the Treasury and other apparatchiks. [FN55] Detailed discussion is beyond the scope of this article, and probably just a general waste of time.
VII. Conclusion
Although Congress certainly gave the credit reporting industry plenty of time to catch on to the changes to the FCRA, within a relatively short period of time consumers should see significant improvements in their access to credit reports, their right to correct errors, and their ability to protect themselves from identity fraud. Given the willingness of some sectors of the credit reporting industry to treat consumers as merely necessary components [FN56] of credit reports, we will also likely see an increase in significant violations of the FCRA, with the resulting increase of lawsuits and verdicts.
[FNa1]. Stephen Gardner is in practice as the Law Office of Stephen Gardner, PC. in Dallas. Texas. He received his B.A. from the University of Texas at Austin in 1972, and his J.D. from the University of Texas in 1975. He has been in private practice since 1992. He serves Of Counsel to the National Consumer Law Center, and was Assistant Dean of Clinical Education at Southern Methodist University School of Law, from 1994-1995. He was Visiting Assistant Professor of Law at Southern Methodist University School of Law, 1992-1995, and served as Assistant Attorney General. Consumer Protection Division. State of Texas, 1984- 1991. He was Assistant Attorney General, Bureau of Consumer Frauds. State of New York. 1982-1984, and a Director, Consumers Union. 1997-2000; Director, National Association of Consumer Advocates. 1996-2002; and served on the Consumer Advisory Council. Board of Governors, Federal Reserve System, 1986- 1989.
His publications include: THE PRACTICE OF CONSUMER LAW (National Consumer Law Center) (co- author): UNFAIR AND DECEPTIVE ACTS AND PRACTICES (National Consumer Law Center, 5th ed.) (contributing author); CONSUMER CLASS ACTIONS (National Consumer Law Center, 5th ed.) (contributing author); H. NEWBERG & A. CONTE, NEWBERG ON CLASS ACTIONS (4th ed. 2002) (contributing editor); Lost in the Supermarket: Consumer Confusion and Marketing Mania, in NUTRITION LABELING HANDBOOK 373 (Shapiro ed., 1995); See Dick and Jane Sue: A Primer on State Consumer Protection Laws, PRODUCT DISTRIBUTION AND MARKETING (American Law Institute, 1991; revised 1992).
[FN1]. 15 U.S.C. § 1681 et seq. The Act will be cited as "FCRA. 15 U.S.C. §___."
[FN2]. FCRA. 15 U.S.C. § 1681(a)(4) (emphasis added).
[FN3]. TRW Inc. v. Andrews, 534 U.S. 19, 23, 122 S.Ct. 441, 444 (2001) (emphasis added).
[FN4]. FCRA. 15 U.S.C. § 1681h(3)(e) (emphasis added).
[FN5]. Henry v. Forbes, 433 F.Supp. 5, at 7 a. 1 (D.Minn. 1976).
[FN6]. Sipple v. Chronicle Publishing Co., 154 Cal.App.3d 1040, 1045- 1046, 201 Cal.Rptr. 665 (1984).
[FN7]. Lake v. Wal-Mart Stores, Inc., 582 N.W.2d 231, 233 (Minn.1998).
[FN8]. Restatement (Second) of Torts § 652D. Comment a.
[FN9]. Whelan v. Trans Union Credit Reporting Agency, 862 F.Supp. 824, 834 (E.D.N.Y. 1994) (internal citations and quoting omitted).
[FN10]. Yeager v. TRW. Inc., 984 F.Supp. 517, 522 (E.D. Tex, 1997), citing Thornton v. Equifax, Inc., 619 F.2d 700. 703 (8th Cir. 1980), cert. denied. 449 U.S. 835, 101 S.Ct. 108. 66 L.Ed.2d 41 (1980).
[FN11]. Henry v. Forbes, 433 F.Supp. 5, 9 fn. 5 (D.Minn. 1976) (emphasis added, with an ironie tone).
[FN12]. Myers v. The Bennett Law Offices, 238 F.3d 1068, 1074 (9th Cir. 2001) (internal citations omitted).
[FN13]. FCRA, 15 U.S.C. § 16811(b)(1)(F).
[FN14]. Pub. L. No. 108-159.
[FN15]. Section 3 of H.R. 2622.
[FN16]. Effective dates for the Fair and Accurate Credit Transactions Act of 2003, 69 Fed. Reg. 6526 (Feb. 11, 2004) (to be endified at 16 CFR Pt. 602).
[FN17]. 69 Fed. Reg. 6526 (Feb. 11, 2004).
[FN18]. Id. at 6530-6531.
[FN19]. Id., at 6530. The other provisions effective March 31 were section 111 (definitions), sections 312(d), (e), and (f) (the furnisher liability exception, liability and enforcement, and rule of construction, respectively), section 313(a) (action regarding complaints), section 611 (communications for certain employee investigations), and section 811 (clerical amendments).
[FN20]. 68 Fed. Reg. 74467 (Dec. 24, 2003).
[FN21]. Id., at 77469.
[FN22]. Id.
[FN23]. FCRA, 15 U.S.C. § 1681a. Where possible, this article will provide citations for new provisions as they will be codified, rather than to the section of the enactment.
[FN24]. The fraud and military report sections are in a new FCRA section 605A, to be inserted between 15 U.S.C. § 1681c and § 1681d, possibly as § 1681c-1.
[FN25]. The FACT Act makes clear that the credit reporting agency must respond to "an individual acting on behalf of or as a personal representative of a consumer." as long as the "agency has received appropriate proof of the identity of the requester for such purpose." This should remedy the refusal of reporting agencies to deal with anyone other than the consumer, in some cases even the consumer's law yer.
[FN26]. This provision has a delayed effective date cumpared to must other provisions of the Act. It is effective December 4, 2006, for any device in use before January 1, 2005, and is effective December 4, 2004, for any device "that is first put into use on or after January 1, 2005." Yes, as written, in December 2004, the bill becomes effective as to machines that don't yet exist.
[FN27]. FCRA, 15 U.S.C. § 1681g(a)(1)(A).
[FN28]. FCRA, 15 U.S.C. § 1681m(e). To determine the identity of the person requesting a new card, the card issuer must: (1) notify the cardholder of the request at the former address of the cardholder and provide the cardholder a means of promptly reporting incorrect address changes; (2) notify the cardholder of the request by such other means of communication as the cardholder and the card issuer previously agreed to; or (3) use another means of assessing the validity of the change of address, in accordance with reasonable policies and procedures established by the card issuer.
[FN29]. New FCRA § 605B, to be insened between 15 U.S.C. § 1681c and § 1681d. possibly as § 1681c-2.
[FN30]. FCRA, 15 U.S.C. § 1681s-2(a)(6).
[FN31]. Id. § 1681m(f).
[FN32]. Id. § 1681m(g).
[FN33]. TRW Inc. v. Andrews, 534 U.S. 19, 122 S.Ct. 441 (2001).
[FN34]. FCRA, 15 U.S.C. § 1681p.
[FN35]. Id. § 1681j(a).
[FN36]. See FTC Proposed Rule. Free Annual File Disclosures, 69 Fed. Reg. 13, 192, at 13,198 (Mar. 19, 2004).
[FN37]. The term "credit score" means "a numerical value or a categorization derived from a statistical tool or modeling system used by a person who makes or arranges a loan to predict the likelihood of certain credit behaviors, including default (and the numerical value or the categorization derived from such analysis may also be referred to as a 'risk predictor' or 'risk score')." It does not include "any mortgage score or rating of an automated underwriting system that considers one or more factors in addition to credit information, including the loan to value ratio, the amount of down payment, or the financial assets of a consumer; or any other elements of the underwriting process or underwriting decision." FCRA, 15 U.S.C. § 1681g(f)(2)(A). FCRA, 15 U.S.C. § 1681g(g) provides detailed requirements for disclosure of credit scores by residential mortgage lenders.
[FN38]. The term "key factors" means all relevant elements or reasons adversely affecting the credit score for the particular individual, listed in the order of their importance based on their effect on the credit score. FCRA, 15 U.S.C. § 1681g(f)(2)(A).
[FN39]. FCRA, 15 U.S.C. 1681g(f).
[FN40]. Id. § 1681g(a)(6).
[FN41]. Id. § 1681m(d)(2).
[FN42]. Id. § 1681b(e).
[FN43]. FACT Act § 624.
[FN44]. FCRA. 15 U.S.C. § 1681s-2(a)(7).
[FN45]. Id. § 1681s-2(e).
[FN46]. FCRA, 15 U.S.C. § 1681s-2(a)(1). The term "reasonable cause to believe that the information is inaccurate" means "having specific knowledge, other than solely allegations by the consumer, that would cause a reasonable person to have substantial doubts about the accuracy of the information."
[FN47]. FCRA, 15 U.S.C. § 1681i(a)(1)(A).
[FN48]. Id. § 1681s-2(a)(8).
[FN49]. FCRA, 15 U.S.C. § 1681s-2(a)(8)(G). See generally Eugene J. Kelley, Jr., John L. Ropieqaet, and Andrea J. Durkin. The Credit Repair Organization Act (CROA): The "Next Big Thing?." 57 Consumer Fin. L. Q. Rep. 2 (2003).
[FN50]. Old FCRA. 15 U.S.C. § 1681i(a)(5)(A).
[FN51]. New FCRA, 15 U.S.C. § 1681i(a)(5)(A) (emphasis added).
[FN52]. Id. § 1681s-2(b)(1)(E).
[FN53]. FCRA, 15 U.S.C. § 1681t(a).
[FN54]. See FCRA, 15 U.S.C. § 1681b(g).
[FN55]. FACT Act Title V., the "Financial Literacy and Education Improvement Act."
[FN56]. Voltaire noted that "If God did not exist, it would be necessary to invent him." Épitre à L'auteur du Livre des Trois Impostears. To the reporting agencies, if consumers did not exist, it would be necessary to invent them. As things stand, they do a creditable job of inventing much of the data in many credit reports.
|
|
|