Fair Credit Reporting Act

Joseph L. Barloon

Skadden, Arps, Slate, Meagher & Flom LLP

MBA Legal Issues and Regulatory Compliance Conference September 25, 2011

The Fair Credit Reporting Act, 15 U.S.C. 1681, et seq.

The Fair Credit Reporting Act (FCRA) is designed to ensure the fair and accurate use and dissemination of consumer-related information. Key Amendments to FCRA:
Fair and Accurate Credit Transactions Act of 2003. Credit Card Accountability Responsibility and Disclosure Act of 2009. Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the Consumer Financial Protection Act of 2010).

As a result of the Dodd-Frank Act, the FCRA regulatory framework changed significantly in July 2011:
The FRB and the FTC published final rules to implement the credit score disclosure provisions. FCRA rulemaking/interpretive authority shifted from the FTC to the Consumer Financial Protection Bureau (CFPB).
2

Overview of the FCRA

FCRA regulates conduct by: Consumer Reporting Agencies (CRAs) Users of Consumer Reports Furnishers of consumer-related information FCRA addresses issues related to, among other things, access and use of data, identity theft, consumer disclosures, disputed accuracy procedures, affiliate sharing and adverse action. Both the FTC and the Consumer Bureau have authority to enforce the Act.

Applicability of FCRA
FCRA focuses principally on two mutually dependent concepts: CRAs and Consumer Reports. A CRA is any person, which for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages . . . in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties. (15 U.S.C. 1681a(f)). Consumer Reports encompass written, oral or other communications by a CRA bearing on a consumers creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living that are used, intended to be used, or collected, to determine a consumers eligibility for certain consumer transactions. (15 U.S.C. 1681a(d)).
4

Uses of Consumer Reports

A CRA may furnish a Consumer Report (and a User may use it) only for enumerated Permissible Purposes: Credit or insurance transactions; Business transactions initiated by the consumer; Review of an account. A CRA may also furnish a Consumer Report in connection with credit or insurance transactions not initiated by the consumer if: the consumer authorizes the CRA to do so; or the transaction consists of a firm offer of credit or insurance and the prospective User has otherwise complied with the FCRA opt-out requirements.

FCRA restricts the information a CRA may supply to a User in connection with a firm offer.
5

Key Limitations on Information Contained In Consumer Reports

CRAs cannot report information Congress deems obsolete, for example:
Civil suits, civil judgments and records of arrest that antedate the report by more than seven years or until the governing statute of limitations has expired, whichever is longer; Accounts placed for collection or charged to profit and loss which antedate the report by more than seven years.

Prohibition against CRAs providing outdated information does not apply to credit reports furnished in connection with high-dollar ($150,000+) credit and life insurance transactions or the employment of an individual with an annual salary $75,000.

FCRA also imposes limitations on the use, sharing and

format of medical information contained in a Consumer Report.

6

Key Obligations Imposed by FCRA

Certification CRA must require prospective Users of Consumer Reports to identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose. Prospective Users are required to provide additional certifying information under certain circumstances, such as the procurement of an investigative consumer report or the procurement of a consumer report for employment purposes. Accuracy CRAs must follow reasonable procedures to assure maximum possible accuracy. (15 U.S.C. 1681e(b)). A Furnisher must not report data that it knows or has reasonable cause to believe is inaccurate. Access CRAs must provide all information in their files for a person upon request. Dispute and Correction CRAs must investigate and, where appropriate, correct disputed information. Furnishers must correct and update information where appropriate.

Key Obligations Imposed by FCRA

Notices
FCRA imposes various disclosure obligations on CRAs, Users and Furnishers:
CRAs are required to provide Users and Furnishers with a notice of such persons responsibilities under FCRA; Certain mortgage lenders are required to provide a Notice to Home Loan Applicant and related disclosures when a credit score is used; Furnishers must notify CRAs of voluntary account closures and account delinquencies; Users must provide notices to consumers whenever a Consumer Report is used in whole or in part to take adverse action.
8

FCRAs Relationship to State Laws

State Laws States may also promulgate laws that regulate the use of consumer information, but only to the extent such laws are consistent with FCRA. FCRA preempts state regulation of certain subject matters addressed in the Act as well as certain common law actions in various circumstances.

Key Liability Provisions

FCRA imposes civil liability for negligent and willful violations of the Act.
A person who negligently fails to comply with a requirement imposed under the FCRA is liable for actual damages; and court costs and reasonable attorneys' fees. For willful violations, a consumer may receive either actual damages or statutory damages (ranging from $100 to $1,000); punitive damages; and court costs and reasonable attorneys fees.
10

FACT Act (Select Provisions)

The Fair and Accurate Credit Transactions Act of 2003 (FACT Act) added important

provisions to FCRA:
Identity theft; Consumer notices; Data access and accuracy.

11

FACT Act: Identity Theft & Privacy

Fraud Alerts
Upon request, a CRA must include a fraud alert in the file and must provide the consumer with notice that he or she may obtain a free copy of the consumer file and related disclosures. Fraud alerts notify creditors that they may not extend credit without verifying that the consumer has actually requested credit. The FCRA Red Flag Rule requires "financial institutions" and "creditors" to develop Identity Theft Prevention Programs. FTC recently settled charges against three credit report resellers who allegedly allowed their clients to access reports without requiring basic security measures, such as firewalls and updated antivirus software.
12

FACT Act: Identity Theft & Privacy

Truncation of Credit Card and Debit Card Numbers
No person that accepts credit or debit cards shall print more than the last 5 digits of the card number or the expiration

date. (15 U.S.C. 1681c(g)).

Free Consumer Reports

All CRAs must provide consumers with a copy of their consumer file and related disclosures once during any 12-month period upon the request of the consumer and without charge.

Affiliate Sharing
FCRA prohibits the use of credit information obtained from an affiliate for marketing purposes unless:
It is clearly and conspicuously disclosed to the consumer that the information may be communicated for solicitations; and The consumer is given an opportunity to prohibit such solicitations.
13

FACT Act: Accuracy of Data

Data Accuracy and Integrity Rule and Guidelines
Various federal agencies recently issued joint guidelines to ensure the accuracy and integrity of the information Furnishers supply to CRAs. Furnishers are required to establish reasonable policies and procedures for implementing the guidelines. Furnishers are required to investigate certain disputes regarding the accuracy of information in Consumer Reports.

Notice of Negative Information

Financial institution must provide written notice to the consumer within 30 days after providing negative information to CRA.
14

FACT Act: Risk-Based Pricing

Risk-based pricing provisions recently added to address the practice of setting or adjusting the terms of credit offered or extended to a consumer based on that particular consumers nonpayment risk. Lenders are required to provide a Risk-Based Pricing Notice if:
A consumer is extended credit on material terms that are materially less favorable than the terms offered to a substantial proportion of consumers and A Consumer Report is used in connection with the credit decision.

15

FACT Act: Risk-Based Pricing

The FRB and FTC jointly issued the Risk-Based Pricing Rule. The Rule provides, among other things:
Model forms that provide a safe harbor for compliance. Insight regarding the circumstances when the riskbased pricing notice is not required: Lender opts to provide consumers with a credit score disclosure exception notice; Adverse Action Notice provided to the consumer; Consumer applies for, and is granted, specific material terms. A risk-based pricing notice is required in connection with an account review if the APR is increased based, at least in part, on the Consumer Report.

16

Credit CARD Act of 2009

The Credit Card Accountability Responsibility and Disclosure (CARD) Act of 2009 amended FCRA to prevent

deceptive marketing of free credit reports.

FTC issued a Final Rule implementing the statutory revision, which requires ads for

free credit reports to contain clear disclosures.

17

Dodd-Frank Act
The Dodd-Frank Act provides the Consumer Financial Protection Bureau with

broad rulemaking and enforcement authority and the mandate to prevent abusive financial practices.
Dodd-Frank also imposes a number of enhanced data collection and reporting requirements, several of which impact FCRA.

18

Dodd-Frank Act
Section 1100F of the Dodd-Frank Act requires Users to add credit score disclosures to their Adverse Action and Risk-Based Pricing notices if a credit score is used in setting credit terms or taking adverse action: Numerical credit score; Range of possible credit scores under the model used; Four key factors that adversely affected the consumers credit score (or up to five factors if the number of inquiries made with respect to that Consumer Report is one of the factors); Date on which the credit score was created; and Name of the person or entity that provided the credit score or credit file upon which the credit score was created.
19

Dodd-Frank Act: Key Implementing Rules

In July 2011, the FRB and the FTC issued final rules to implement the credit score disclosure provisions. Highlights from the FTC and FRBs Risk-Based Pricing Rule:
Defines credit score for purposes of the FCRA. Emphasizes that disclosure of the number of inquiries for a Consumer Report is required, regardless of whether it is one of the top four key factors that adversely affected the credit score. Maintains creditors ability to send credit score disclosure exception notices in lieu of risk-based pricing notices. Clarifies that a lender need only disclose a single credit score even if multiple credit scores are used in connection with the credit decision. Clarifies that both the key factors that adversely affected the consumers credit score and the specific reasons for taking adverse action on an application or extension of credit are necessary to satisfy the separate requirements of ECOA and FCRA. Confirms that a creditor is not required to disclose a credit score if an application has no credit score. Discusses interplay between proprietary scores, credit scores and noncredit information.
20

Highlights from the FRBs Adverse Action Rule:

Recent Developments
The FTCs official Commentary on the FRCA was formally rescinded in July. The passage of time and various amendments made the Commentary partially obsolete. A July 2011 FTC Staff Report, however, provides revised commentary on the FCRA and highlights the key areas in which the former Commentary differs from the FTCs current view of the Act. The extent to which the Consumer Bureau will adopt the FTC FCRA interpretations or take a different interpretive approach remains to be seen.

21

Recent Developments
The Consumer Bureau recently issued two formal studies required by Dodd-Frank, both of which discuss credit scoring.

A July 19, 2011 report analyzes the differences between credit scores available to consumers and creditors. A July 20, 2011 report focuses, in part, on the potential use of remittance histories in the calculation of credit scores and the FCRArelated challenges to such use.

22

FCRA

For additional information, contact:

Joseph L. Barloon Skadden, Arps, Slate, Meagher & Flom LLP (202) 371-7322

jbarloon@skadden.com

23