United StatesFair Credit Reporting Act, consumer reporting agency, user and furnisher duties
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Disclosure, Consent, Data subject rights
- Audit expectation
- none
What it requires
- Applies to a consumer reporting agency, to a person that uses a consumer report, and to a person that furnishes information to a consumer reporting agency; a consumer report is a communication of information bearing on a consumer's credit worthiness, character or mode of living that is used as a factor in eligibility for credit, insurance, employment or another purpose section 1681b authorizes.
- If you assemble or evaluate consumer information to furnish consumer reports to third parties, furnish a consumer report only under the circumstances section 1681b(a) lists, and follow reasonable procedures to assure maximum possible accuracy of the information in it.NIST Privacy FrameworkCT.PO-P2
- If you are a consumer reporting agency, disclose to a consumer on request the information in the consumer's file, and when the consumer disputes an item, conduct a reasonable reinvestigation free of charge before the end of the 30-day period that begins when you receive the notice, which extends by not more than 15 additional days if you receive relevant information from the consumer during that period.NIST Privacy FrameworkCT.PO-P3
- If you use or obtain a consumer report, do so only for a purpose section 1681b authorizes and certify that purpose; before procuring a report for employment purposes, make a clear and conspicuous written disclosure in a document that consists solely of the disclosure and get the consumer's written authorization, unless the transportation-applicant procedure in section 1681b(b)(2)(B) applies.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
- If you use a consumer report for employment purposes and intend to take adverse action based on it, first give the consumer a copy of the report and a written description of the consumer's rights under the Act, unless the transportation-applicant procedure in section 1681b(b)(3)(B) applies.NIST Privacy FrameworkCM.AW-P1
- If you take adverse action based in whole or in part on a consumer report, give the consumer notice of the action, disclosure of any numerical credit score you used in taking it, the name, address and telephone number of the agency that furnished the report, a statement that the agency did not make the decision, and notice of the consumer's right to a free copy of the report and to dispute its accuracy.NIST Privacy FrameworkCM.AW-P1
- If you furnish information to a consumer reporting agency, do not furnish information you know or have reasonable cause to believe is inaccurate, and when the agency notifies you of a dispute, investigate, report the results, and modify, delete or permanently block an item found inaccurate, incomplete or unverifiable.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text. Also read by: Consumer Data Industry Association v. Frey, 26 F.4th 1 (1st Cir. 2022) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 1681q: knowingly and willfully obtaining information on a consumer from a consumer reporting agency under false pretenses is punishable by a fine under title 18, imprisonment for not more than 2 years, or both.
Penalty structure
Civil penalty recovered by the Federal Trade Commission in a district court for a knowing violation that constitutes a pattern or practice of violations (15 U.S.C. 1681s(a)(2)(A)). The statute's base figure is $2,500 per violation; the figure here is the inflation-adjusted maximum in 16 CFR 1.98(m) for penalties assessed after .
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 4,983
Statutory damages
15 U.S.C. 1681n(a)(1)(A): for a willful failure to comply, the consumer recovers actual damages or damages of not less than $100 and not more than $1,000, so $1,000 is the ceiling of the statutory alternative, together with punitive damages as the court may allow and the costs of the action and reasonable attorney's fees. A natural person who obtains a consumer report under false pretenses or knowingly without a permissible purpose is liable for actual damages or $1,000, whichever is greater.
- As of
- Currency
- USD
- Per person minimum
- 100
Who enforces it
Enforcement body
Federal Trade Commission, under section 1681s(a)(1), except to the extent that enforcement is specifically committed to some other Government agency.
Settledness
The Ninth Circuit declined to read section 1681t(b)(1)(F) as preempting every state law that relates to a furnisher’s duties, because the phrase “with respect to” limits its reach to state laws that concern the subject matter regulated under section 1681s-2.
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USCOURTS-ca1-20-02064/pdf/USCOURTS-ca1-20-02064-0.pdf
- Case citation
- Consumer Data Industry Association v. Frey, 26 F.4th 1 (1st Cir. 2022)
- Open questions
- Does section 1681t(b)(1)(F) preempt a state law on collecting medical debt when the effect of that law on the accuracy of credit reporting has not been established on a record?
What record it asks for
Who may demand the log
Data subject
What the log must hold
Access record, Decision basis
Log retention
Applies to the criteria a person keeps on file for a prescreened offer under section 1681m(d)(3); the other record duties in the row set no retention period.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
A consumer reporting agency must disclose to the consumer, on request, who procured a report about the consumer in the preceding 1 year (2 years for employment purposes) and a record of the inquiries received in the preceding year, which needs the agency to keep that access record. A person that makes a prescreened offer of credit or insurance must keep on file the criteria used to select the consumer and the criteria that decide whether to extend credit or insurance, for 3 years from the offer. The 1-year and 2-year periods in section 1681g are disclosure look-back windows, not a retention period; the 3-year period attaches to the prescreen criteria file only. No audit by any party is stated, and the consumer's right to receive the disclosure is carried by the access key. The Act's reach turns on interstate commerce and states no territorial hook.
- Kind
- Explicit
- As of
- Provision
- 15 U.S.C. 1681g(a)(3) and (a)(5) (the agency must be able to tell a consumer who procured a report and what inquiries it received); 15 U.S.C. 1681m(d)(3) (criteria for a prescreened offer kept on file)
- Trigger
- personal_data_processing
What this law does
The Fair Credit Reporting Act was enacted on , and section 504(d) of the Consumer Credit Protection Act provides that it takes effect upon the expiration of 180 days following its enactment.
It governs a consumer report, which is any communication by a consumer reporting agency of information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used as a factor in establishing the consumer's eligibility for credit or insurance to be used primarily for personal, family, or household purposes, for employment purposes, or for another purpose section 1681b authorizes.
A consumer reporting agency is any person that, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and that uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.
A consumer reporting agency may furnish a consumer report only under the circumstances section 1681b(a) lists, among them a court order, the consumer's written instructions, and a recipient it has reason to believe intends to use the report in connection with a credit transaction, for employment purposes, or in connection with the underwriting of insurance.
A person shall not use or obtain a consumer report for any purpose unless the report is obtained for a purpose for which it is authorized to be furnished and the purpose is certified by a prospective user of the report.
Except for a transportation applicant who applies by mail, telephone, computer, or other similar means and instead receives notice orally, in writing, or electronically, a person may not procure a consumer report for employment purposes unless a clear and conspicuous disclosure has been made in writing to the consumer, in a document that consists solely of the disclosure, and the consumer has authorized the procurement in writing.
Before taking adverse action based in whole or in part on a consumer report used for employment purposes, the person must give the consumer a copy of the report and a written description of the consumer's rights, except for a transportation applicant who applies by mail, telephone, computer, or other similar means and receives a notice within 3 business days of the action.
Whenever a consumer reporting agency prepares a consumer report it must follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates. A consumer reporting agency must, upon request and subject to section 1681h(a)(1), clearly and accurately disclose to the consumer all information in the consumer's file at the time of the request, other than credit scores and other risk scores.
If a consumer disputes the completeness or accuracy of an item in the consumer's file, the agency must, free of charge, conduct a reasonable reinvestigation before the end of the 30-day period beginning on the date it receives the notice of the dispute, a period that may be extended by not more than 15 additional days if the agency receives relevant information from the consumer during that period.
A person who takes adverse action against a consumer based in whole or in part on information in a consumer report must give the consumer notice of the action, disclosure of a numerical credit score the person used in taking the action, the name, address, and telephone number of the agency that furnished the report, a statement that the agency did not make the decision, and notice of the consumer's right to a free copy of the report and to dispute its accuracy.
A person shall not furnish information relating to a consumer to a consumer reporting agency if the person knows or has reasonable cause to believe that the information is inaccurate. After receiving notice of a dispute from a consumer reporting agency, a person who furnished the information must investigate, report the results to the agency, and modify, delete, or permanently block an item found inaccurate, incomplete, or unverifiable.
A person who willfully fails to comply with a requirement of the Act is liable to the consumer for actual damages or damages of not less than $100 and not more than $1,000, punitive damages the court allows, and the costs of the action and reasonable attorney's fees. A person who is negligent in failing to comply is liable to the consumer for actual damages and the costs of the action and reasonable attorney's fees.
Except as provided in section 1681s(c)(1)(B), sections 1681n and 1681o do not apply to a violation of section 1681s-2(a), which is enforced exclusively by the Federal agencies and officials and the State officials identified in section 1681s. The Federal Trade Commission is authorized to enforce compliance with the Act under the Federal Trade Commission Act, except to the extent that enforcement is specifically committed to some other Government agency.
If the chief law enforcement officer of a State, or an official or agency designated by a State, has reason to believe that a person has violated the Act, the State may bring an action to enjoin the violation and, subject to section 1681s(c)(5), an action on behalf of the residents of the State to recover damages, and it is awarded the costs of a successful action and reasonable attorney fees.
A person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses shall be fined under title 18, imprisoned for not more than 2 years, or both. An officer or employee of a consumer reporting agency who knowingly and willfully provides information concerning an individual from the agency's files to a person not authorized to receive that information shall be fined under title 18, imprisoned for not more than 2 years, or both.
A State may not impose a requirement or prohibition with respect to any subject matter regulated under section 1681c, relating to information contained in consumer reports, or under section 1681s-2, relating to the responsibilities of persons who furnish information to consumer reporting agencies, except that the bar does not apply to any State law in effect on for the first, or to section 54A(a) of chapter 93 of the Massachusetts Annotated Laws and section 1785.25(a) of the California Civil Code, each as in effect on , for the second.
The provisions this entry describes came into force on different days.
How courts have read itPremium data
Our analysis of this law draws on 103 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .
us-15-u-s-c-1681-et-seq