7/28/2019 FCRA (part 1)

1/8

THE FA IR CREDI T REPORT ING ACT

As apublic service, the staff of the federal Trade Commission (FTC) has prepared thefollowing complete text of the Fair Credit Reporting Act (FCRA), )5U.S.c. 1681 et seq.Although staff generally followed the format ofthe U.S. Code as published by the GovernmentPrinting Office, the format of this text does differ in minor ways from the Code (and from West'sU.S. Code Annotated). For example, this version uses FCRA. section numbers ( 601-625) inthe headings. (The relevant U.S. Code citation is included with each section heading and eachreference to the FCRA in the text.) Although the staff has made every effort to transcribe thestatutory material accurately, this compendium is intended only as aconvenience for the publicand not a subtitute for the text inthe U. S. Code. This document was posted on July 30, 2004.

This version of the FCRA includes the amendments to the FCRA set forth in the ConsumerCredit Reporting Reform Act of 1996 (Public Law 104-208, the Omnibus Consolidated Appro-priations Act for Fiscal Year 1997, Title II, Subtitle D, Chapter 1), Section 311 of theIntelligence Authorization for Fiscal Year 1998 (Public Law 105-107), the Consumer ReportingEmployment Clarification Act of 1998 (Public Law) 05-347), Section 506 of the Gramm-Leach-Bliley Act (Public Law 106-102), Sections 358(g) and 505(c) of the Uniting and StrengtheningAmerica by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of2001 (USA PATRIOT Ace) (Public Law 107-56), and the Fair and Accurate Credit TransactionsAct of2003 (FACT Act) (Public Law 108-159).The provisions added to the FCR;\ by the FACT Act will become effective at different times.In some cases, the provision includes its own effective date. In other cases, the FACT Act providesthat the effective dates be prescribed by the FTC and Federal Reserve Board. See 16CFR Part 602.(69 Fed. Reg. 6526; February 11,2004) (69 Fed. Reg. 29061; May 20, 2004).

July 30, 2004 1

7/28/2019 FCRA (part 1)

2/8

TABLE OF CONTENTS

601 602 603 604 605A 605B 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629

Juiy 30, 2004

Short titleCongressional findings and statement of pUl'poseDefinitions; rules of constructionPermissible purposes of consumer reportsIdentity theft prevention; fraud alerts and active duty alertsBlock of information resulting from identity theftRequirements relating to information contained in consumer reportsDisclosure of investigative consumer reportsCompliance proceduresDisclosures to governmental agenciesDisclosures to consumersConditions and fOJ111 of disclosure to consumersProcedure in case of disputed accuracyCharges for certain disclosuresPublic record information for employment purposesRestrictions on Investigative consumer reportsRequirements on users of consumer reportsCivil liability for willful noncomplianceCivil liability for negligent noncomplianceJurisdiction of courts; limitation of actionsObtaining information under false pretensesUnauthorized disclosures by officers or employeesAdministrative enforcementInformation on overdue child support obligationsResponsibil ities of furnishers of information to consumer reporting agenciesAffiliate sharingRelation to state lawsDisclosures to FBI for counterintelligence purposesDisclosures to governmental agencies for counterterrorism purposesDisposal of recordsCorporate and technological circumvention prohibited

2

7/28/2019 FCRA (part 1)

3/8

his name, address, former addresses, places of employment, or former places ofemployment, to a governmental agency. 609. Disclosures to consumers [15 U.S.C. 16l:Og]

(a) Information onjile; sources; report recipients. Every consumer reporting agency shall,upon request, and subject to 61O(a)(I) [ 1681h], clearly and accurately disclose tothe consumer:(1) All information in the consumer's file at the time of the request except that--

(A) ifthe consumer to whom the file relates requests that the first 5 digits ofthe social security number (or similar identification number) of theconsumer not be included in the disclosure and the consumer reportingagency has received appropriate proof of the identity of the requester, theconsumer reporting agency shall so truncate such number in suchdisclosure; and

(B) nothing in this paragraph shall be construed to require a consumerreporting agency to disclose to aconsumer any information concerningcredit scores or any other risk scores or predictors relating to theconsumer.(2) The sources of the information; except that the sources of information acquiredsolely for use in preparing an investigative consumer report and actually use for

no other purpose need not he disclosed: Provided, That in the event an action isbrought under this title, such sources shall be available to the plaintiff underappropriate discovery procedures in the court in which the action is brought.

(3)(A)

(i)

(U)

(B)(i)

(ii)

(C)(i)

.Iuly 30, 2004

Identification of each person (including each end-user identified undersection 607(e)(1) [ 1681e]) that procured aconsumer reportfor employment purposes, during the 2-year period preceding the dateon which the request is made; orfor any other purpose, during the l-year period preceding the date onwhich the request ismade.

An identification of a person under subparagraph (A) shall includethe name of the person or, if applicable, the trade name (written in fuJI)under which such person conducts business; andupon request of the consumer, the address and telephone number of theperson.

Subparagraph (A) does not apply if--the end user is an agency or department of the United StatesGovemment that procures the report from the person for purposes of

35

7/28/2019 FCRA (part 1)

4/8

determining the eligibility of the consumer to whom the report relatesto receive access or continued access to classified information (asdefined in section 604(b)(4)(E)(i)); and(ii) the head of the agency or department makes a written finding asprescribed under section 604(b)(4)(A).

(4) The dates, original payees, and amounts of any checks upon which is based anyadverse characterization of the consumer, included in the f ile at the time of thedisclosure.

(5) A record of all inquiries received by the agency during the l-year periodpreceding the request that identified the consumer in connection with a credit orinsurance transaction that was not initiated by the consumer.(6) I f the consumer requests the credit file and not the credit score, a statement that theconsumer may request and obtain a credit score.

(b) Exempt information. The requirements of subsection (a) of this section respecting thedisclosure of sources of information and the recipients of consumer reports do notapply to information received or consumer reports furnished prior to the effectivedate of this title except to the extent that the matter involved is contained in the filesof the consumer reporting agency on that date.(c) Summary of Rights to Obtain and Dispute Information in Consumer Reports and toObtain Credit Scores

(1) Commission Summary of Rights Required(A) In general. The Commission shall prepare amodel summary of the rights

of consumers under this tille.(B) Content of summary. The summary of rights prepared under subparagraph(A) shall include a description of-

(i) the right of a consumer to obtain a copy of a consumer report undersubsection (a) from each consumer reporting agency;(ii) the frequency and circumstances under which a consumer is entitled toreceive a consumer report without charge under section 612;(Hi) the right of a consumer to dispute information in the file of the

consumer under section 611;(iv) the right of a consumer to obtain a credit score from a consumerreporting agency, and a description of how to obtain a credit score;(v) the method by which a consumer can contact, and obtain a consumerreport from, a consumer reporting agency without charge, as providedin the regulations of the Commission prescribed under section 211(c)

of the Fair and Accurate Credit Transactions Act of 2003; andJuly 30, 2004 3 6

7/28/2019 FCRA (part 1)

5/8

(vi) the method by which a consumer can contact, and obtain a consumerreport from, a consumer reporting agency described in section 603(w),as provided in the regulations of the Commission prescribed undersection 612(a)(1)(C).

(C) Availability of summary a/rights. The Commission shall--(i) actively publicize the availability of the summary of rights preparedunder this paragraph;(ii) conspicuously post on its Internet website the availability of such

summary of rights; and(iii) promptly make such summary of rights available to consumers, on request.

(2) Summary) a/rights required to be included with agency disclosures. A consumerreporting agency shall provide to a consumer, with each written disclosure by theagency to the consumer under this section--(A) the summary of rights prepared by the Commission under paragraph 0);(B) in the case of aconsumer reporting agency described in section 603(P), atoll-free telephone number established by the agency, at which personnelare accessible to consumers during normal business hours;(C) a list of all Federal agencies responsible for enforcing any provision of thistitle, and the address and any appropriate phone number of each such agency,in a form that will assist the consumer in selecting the appropriate agency;(D) a statement that the consumer may have additional rights under Statelaw,and that theconsumer maywish to contact aState or local consumerprotection agency or a State attorney general (or the equivalent thereof) to

learn of those rights; and(E) a statement that a consumer reporting agency is not required to remove

accurate derogatory information from the fileof aconsumer, unless theinformation isoutdated under section 60S or cannot be verified.(d) Summary of Rights ofIdentity Theft Victims

(1) In general. The Commission, in consultation with the federal banking agencies andtheNational Credit Union Administration, shall prepare amodel summary of therights of consumers under this title with respect to the procedures for remedying theeffects offraud or identity theft involving credit, an electronic fund transfer, or anaccount ortransaction at orwith afinancial institution or other creditor.

(2) Summary of rights and contact information. Beginning 60 days after the date onwhich the model summary of rights is prescribed in final form by the Commissionpursuant to paragraph (1), if any consumer contacts a consumer reporting agencyand expresses a belief; that the consumer is a victim of fraud or identity theft

I 37luly 30, 2004

7/28/2019 FCRA (part 1)

6/8

involving credit, an electronic fund transfer, or an account or transaction at orwith a financial institution or other creditor, the consumer reporting agency shall,in addition to any other action that the agency may take, provide the consumerwith a summary of rights that contains all of the information required by theCommission under paragraph (I), and information on how to contact theCommission to obtain more detailed information.

(e) Information Available to Victims(1) In general. For the purpose of documenting fraudulent transactions resulting fromidentity theft, not later than 30 days after the date of receipt of arequest from avictim in accordance with paragraph (3), and subject to verification of the identity ofthe victim and the claim of identity theft in accordance with paragraph (2), a busi-ness entity that has provided credit to, provided for consideration products, goods, orservices to, accepted payment from. or otherwise entered into acommercialtransaction for consideration with, aperson who has allegedly made unauthorized

use of the means of identification of the victim, shall provide acopy of applicationand business transaction records in the control of the business entity, whethermaintained by the business entity or by another person on behalf of the businessentity, evidencing any transaction alleged to bearesult of identity theft to--(A) the victim;(B) any Federal, State, or local government law enforcement agency or officerspecified by the victim in such a request; or(C) any law enforcement agency investigating the identity theft and authorizedby the victim to take receipt of records provided under this subsection.

(2) Verification of identity and claim Before a business entity provides any informa-tion under paragraph (1), unless the business entity, at its discretion, otherwisehas a high degree of confidence that it knows the identity of the victim making arequest under paragraph (1), the victim shall provide to the business entity=(A) as proof of positive identification of the victim, at the election of thebusiness entity-

(i) the presentation of a government-issued identification card;(ii) personally identifying information of the same type as was provided tothe business entity by the unauthorized person; or

(iii) personally identifying information that the business entity typicallyrequests from new applicants or for new transactions, at the time of thevictim's request for information, including any documentationdescribed inclauses (i) and (ii); and(8) as proof of a claim of identity theft, at the election of the business entity->

(i) a copy of apolice report evidencing the claim of the victim of identitytheft; and

July 30, 200'1 38

7/28/2019 FCRA (part 1)

7/8

(ii) a properly completed--(I) copy of astandardized affidavit of identity theft developed and

made available by the Commission; or(II) an affidavit of fact that is acceptable to the business entity for thatpurpose.

(3) Procedures. The request of avictimunder paragraph (1) shall~(A) be in 'writing;(B) bemailed to anaddress specified by the business entity, if any; and(C) if asked by the business entity, include relevant information about any

transaction alJeged to be a result of identity theft to facilitate compliancewiththis section including-(i) if known by the victim (or if readily obtainable by the victim), the dateof the application or transaction; and(ii) if known by the victim (or if readily obtainable by the victim), anyother identifying information such as an account or transactionnumber.

(4) No charge to victim Information required to be provided under paragraph (1)shall be so provided without charge.(5) Authority to decline toprovide information. A business entity may decline to

provide information under paragraph (1) if, in the exercise of good faith, thebusiness entity determines that--(A) this subsection does not require disclosure of the information;(B) after reviewing the information provided pursuant to paragraph (2), thebusiness entity does not have a high degree of confidence in knowing thetrue identity of the individual requesting the information;(C) the request for the information is based on a misrepresentation of fact bythe individual requesting the information relevant to the request for

information; or(D) the information requested is Internet navigational data or similarinformation about a person's visit to awebsite or online service.

(6) Limtation on liability. Except as provided in section 621, sections 616 and 617 donot apply to any violation of this subsection.

July 30, 2004 39

7/28/2019 FCRA (part 1)

8/8

(7) Limtation on civil liability. No business entity may be held civilly liable underany provision of Federal, State, or other law for disclosure, made in good faithpursuant to this subsection.

(8) No new recordkeeping obligation. Nothing in this subsection creates an obligationon the part of a business entity to obtain, retain, or maintain information orrecords that are not otherwise required to be obtained, retained, or maintained inthe ordinary course of its business or under other applicable law.

(9) Rule of Construction(A) In general. No provision of subtitle A of title V of Public Law 106-102,prohibiting thedisclosure of financial information by a business entity tothird parties shall be used to deny disclosure of information to the victimunder this subsection.(B) Limtation. Except as provided in subparagraph (A), nothing in thissubsection permits a business entity to disclose information, includinginformation to law enforcement under subparagraphs (B) and (C) ofparagraph (1), that the business entity is otherwise prohibited fromdisclosing under any other applicable provision of Federal or State law.

(l0) Affirmative defense. In any civil action brought to enforce this subsection, it is anaffirmative defense (which the defendant must establish by apreponderance ofthe evidence) for a business entity to file an affidavit or answer stating that-(A) the business entity has made areasonably diligent search of its availablebusiness records; and(B) the records requested under this subsection do not exist or arc not

reasonably available.(11) Definition of victim For purposes of this subsection, the term "victim" means aconsumer whose means of identification or financial information has been used ortransferred (or has been alleged to have been used or transferred) without theauthority of that consumer, with the intent to commit, or to aid or abet, an identity

theft or asimlar crime.(12) Effectivedate. This subsection shall become effective 180 days after the date ofenactment of this subsection.(13) Effectiveness study. Not later than 18months after the date of enactment of this

subsection, the Comptroller General of the United States shall submt areport toCongress assessing the effectiveness of this provision.

(f)Disclosure of Credit Scores(1) In general. Upon the request of a consumer for a credit score, a consumerreporting agency shall! supply to the consumer a statement indicating that the

i, 40July 30. 2004