FCRA

Financial Privacy

Mandates accurate and relevant data collection, provides consumers with the ability to access and correct their information, and limits the use of consumer reports to defined permissible purposes.
Regulates use of consumer reports obtained from CRAs in reference checking and background checks of employees
Generally, preempts state law (see FACTA)
- - Does not preempt states from creating stronger legislation in the area of employment credit history checks such as the California ICRAA

Dispute resolution, private litigation (private right to action), government actions (FTC, CFPB, State AGs)

Civil/criminal penalties. Statutory damages of at least $1000 per violation, and at least $3,756 for willful violations.
Amended by FACTA with provisions related to identity theft and other subjects

Third party data for decision making must be accurate, current, and complete
Consumers must receive notice when third party data is used to make adverse decisions
May only be used for permissible purposes
Consumers must have access to their consumer reports and an opportunity to dispute or correct errors

Provide consumers with access to info in report and the opportunity to dispute/correct errors
Ensure maximum possible accuracy of report
Not report negative info that is outdated (account data more than seven years old, bankruptcies older than 10 years)
Provide reports only to entities that have permissible purpose
Maintain records regarding entities that received reports
Provide consumer assistance as required by FTC

▪ Users must have a “permissible purpose” :

Court order
Instructed by consumer in writing
Extension of credit as a result of application by consumer
Employment purposes where consumer has given written consent
Underwriting of insurance initiated by consumer
To review consumer’s account to determine if account needs are met
Determine consumer’s eligibility for license or other benefit granted by government
For use by potential investor/servicer/current insurer in a valuation assessment
For use by state and local officials in connection with child support payments
Creditors and insurers may obtain certain consumer report info for the purpose of making prescreened unsolicited offers of credit or insurance

Users must provide certifications of permissible purpose

Users must notify consumers when adverse actions are taken and must include:

Name, address, telephone number of the CRA
Statement that the CRA did not make the adverse action and cannot explain why it was made
Statement setting forth the consumer’s right to obtain a free disclosure of the consumer’s file from the CRA if the consumer makes a request within 60 days
Statement setting forth consumer’s right to dispute directly with the CRA the accuracy and completeness of any info provided by CRA
Adverse Action based on non-CRA: must inform consumer their right to be informed of the nature of the info that was relied upon if request is made within 60 days of notification.
Adverse Action based on affiliates: must inform consumer that they may obtain disclosure of the nature of the info relied upon by making a written request within 60 days of notification. The user must disclose no later than 30 days after receiving the request.

Companies that extend credit to consumers must implement “Red Flag” program to deter identity theft

Employee investigation not treated as a consumer report as long as:

The employer or its agent complies with the procedures set forth in FCRA o
No credit info is used
A summary describing the nature and scope of the inquiry is provided to the employee if an adverse action is taken

Consumer must be informed than investigative consumer report may be obtained
Disclosure must be in writing and delivered to consumer some time before but not later than three days after the date which the report was first requested o
Disclosure must include a statement informing the consumer of his or her right to request additional disclosures and a summary of consumer rights under FCRA
User must certify to the CRA that the required disclosures have been made
Upon written request of a consumer, the user must make a complete disclosure of the nature and scope of the investigation
Nature and scope disclosures must be made in a written statement that mailed or delivered to consumer no later than five days after the date on which the request was received from the consumer or the report was first requested (whichever later)

Consumer must provide consent for any medical info to be used under FCRA

Permissible purposes for employment checks include:

Pre-employee screening for the purpose of evaluating the candidate for employment
Determining if an existing employee qualifies for promotion, reassignment, or retention

• FCRA applies to nontraditional providers of background check information (like social media aggregators)

Page updated

Report abuse