The First Federal Information Privacy Law

The question at the center of the Fair Credit Reporting Act was a question about power over a file. By 1970, a commercial company could assemble a dossier on an adult in the United States, sell descriptions of that person to lenders, insurers, and employers, and make consequential judgments possible without the person ever seeing the file, learning who had supplied its contents, or correcting an error that had entered it. Congress legislated against that arrangement. The statute answered with a proposition that had no earlier equivalent in federal law, namely that a private organization holding personal information for commercial decisions owed duties of accuracy, confidentiality, and fairness to the individual described in the record, even though that individual had never chosen the organization, paid the organization, or agreed to the creation of the file.

The formal identity of the statute can be stated in a single pass. The Fair Credit Reporting Act was added as Title VI of the Consumer Credit Protection Act by Public Law 91-508. President Richard Nixon signed Public Law 91-508 on October 26, 1970. The public law provided that Title VI took effect upon the expiration of one hundred and eighty days following the date of enactment, and federal regulators thereafter recorded the resulting effective date as April 25, 1971. The act was codified at sections 1681 and following of Title 15 of the United States Code. The parent act, the Consumer Credit Protection Act, had itself been enacted in 1968 as Public Law 90-321, so the Fair Credit Reporting Act entered federal law as an amendment that extended an existing consumer credit framework into a new subject, the files that made consumer credit decisions possible in the first place.

That placement inside a credit statute has obscured the character of the achievement in some accounts, because the act is often shelved beside interest rate disclosure rules, as though the subject were merely the price of loans. The text and the congressional findings pointed in a broader direction. Section 1681 opened with findings that the banking system depended upon fair and accurate credit reporting, that inaccurate reports impaired the efficiency of that system, and that unfair methods undermined public confidence essential to the functioning of banking. Congress then stated a purpose that reached beyond banking mechanics, requiring that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce in a manner fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of consumer information. Confidentiality appeared there as a statutory obligation in 1970, attached to private commercial files, and that fact reorders the usual chronology of American privacy law.

American privacy law, on the chronology established by the statutes themselves, begins with commercial credit files and not with government records. The Privacy Act of 1974, enacted on December 31, 1974 as Public Law 93-579 and codified at section 552a of Title 5 of the United States Code, established a code of fair information practice for personally identifiable information maintained in systems of records by federal agencies. That general federal privacy statute, addressed to the federal government as record keeper, arrived four years after the Fair Credit Reporting Act had already imposed federal rules on private companies as record keepers. The sequence reverses an assumption that privacy protection in the United States began as a restraint on the state and only later extended to business. In federal statutory form, the restraint on business came first, and the individual described in a bureau file held a federal right to see and dispute that file before the individual described in an agency system of records held the parallel federal rights of access and amendment.

Was the Fair Credit Reporting Act the first federal privacy law?

Yes. Enacted in 1970 and effective in 1971, the Fair Credit Reporting Act imposed federal duties of accuracy, disclosure, and limited use on private holders of personal information four years before the Privacy Act of 1974 addressed federal agency records, making commercial credit files the starting point of federal information privacy law.

The qualification embedded in that answer deserves attention, because the claim concerns information privacy as a regulated practice rather than privacy in every sense known to American law. Earlier federal law had protected the privacy of the home against unreasonable searches and had treated certain records as confidential in particular programs. None of those protections had constructed a general regime for an organization that collected personal information, maintained it in a retrievable file, and furnished it to third parties for decisions about the subject. The Fair Credit Reporting Act constructed exactly that regime for consumer reporting. It defined the regulated entity, the consumer reporting agency; defined the regulated product, the consumer report; limited the purposes for which a report could be furnished; required disclosure of the file to the consumer; created a procedure for disputing accuracy and for reinvestigation; restricted the reporting of obsolete information; and attached civil liability for willful and for negligent noncompliance. The combination, rather than any single provision, supports the description of the act as the first federal information privacy law, because the combination addressed the full life of a personal record, from collection through disclosure, challenge, and expiration.

The conditions that produced that combination had assembled during the 1960s, as credit reporting changed in scale, in method, and in social reach. Consumer credit had expanded through the postwar decades, and department stores, oil companies, banks, and finance companies relied on local and regional bureaus to judge applicants whom loan officers had never met. A judgment that had once rested on personal acquaintance in a single town came to rest on a file compiled by strangers. Bureaus exchanged information, merged, and organized on a national footing, and a file could travel farther and persist longer than the memory of any merchant who had contributed to it. Computerized storage during the 1960s allowed a bureau to hold records on a population measured in the tens of millions, to retrieve a record in seconds, and to combine entries from many sources into a single report without any contributor reviewing the whole. Senator William Proxmire of Wisconsin, in a statement recorded in the Congressional Record in 1968 and cited in later congressional testimony, identified confidentiality, accuracy, and currency of information as the criteria by which the standards of commercial credit bureaus should be judged, and the framing captured the defect precisely, because computerization had increased the value of bureau files to commerce while leaving the subject of a file with no corresponding increase in knowledge or control.

Secrecy was the operating condition that turned scale into grievance. A bureau file was, in the ordinary course of business before 1971, a document the subject could not inspect. A consumer denied credit, insurance, or employment might receive no explanation, an explanation that named no bureau, or the name of a bureau that then declined to reveal the contents of the file or the sources of particular entries. Errors therefore behaved differently in a bureau file than errors in an ordinary business record. A mistaken entry concerning a missed payment, a debt belonging to another person with a similar name, a satisfied judgment reported as outstanding, or an account closed by the consumer and reported as closed by the creditor could reproduce itself across applications in different cities and different industries, and each reproduction arrived without the context that might have exposed the mistake. The consumer encountered the consequence, a refusal, separated from the cause, a line in a file held by a company with which the consumer had no dealings. Congressional hearings during 1969, including hearings before the Subcommittee on Financial Institutions of the Senate Committee on Banking and Currency on Senate bill 823, a Proxmire measure on fair credit reporting, placed that separation on the record through testimony from consumers, regulators, and industry representatives, and the hearings treated the inability to see and challenge a file as a structural feature of the market that legislation had to correct.

The contents of bureau files widened the concern beyond arithmetic mistakes in payment histories. Before standardized credit scoring became general, reports had drawn on statements of character, and hearings on the legislation recorded congressional unease that reports contained probing details about personality, habits, and health, assembled for judgments about credit and employment. The category Congress created, the investigative consumer report, acknowledged the practice directly, because such a report rested on personal interviews with neighbors, associates, and others concerning character, general reputation, personal characteristics, and mode of living. A file of that kind was a dossier in the plain sense, a compilation about a person prepared for the use of others, and the breadth of its contents explains why the debate in Congress joined the language of consumer protection to the language of privacy. An inaccurate balance was a commercial injury. An unverified account of habits or reputation, collected by interview and sold without the knowledge of the subject, was an injury of a different order, and the statute regulated both under a single framework that treated the file as personal information rather than as the unrestricted property of the company that had compiled it.

Press attention during the late 1960s carried those congressional concerns to a public that had begun to recognize the bureau file as a part of ordinary economic life. Newspaper and magazine exposés of bureau practices described files opened without the knowledge of the subject, information sold to purchasers with thin pretexts, and subjects who learned of a damaging report only after a job or a mortgage had been lost. Consumer advocate Ralph Nader, speaking at a symposium at Dickinson College on the invasion of privacy in a computerized society in February 1971, charged that a person posing as a prospective employer and willing to pay a small fee could obtain data from the computerized files of large credit rating organizations, and the charge, reported in the press of that month, named the precise vulnerability the statute had been written to close, namely access to a personal file by a purchaser whose purpose the subject could neither know nor contest. The exposés mattered because the practices described were largely lawful before 1971. No general federal rule had required a bureau to disclose a file to its subject, to verify a disputed entry, or to limit a report to a purchaser with a permissible purpose. The scandal, as presented to Congress and to readers, lay less in isolated violations of an existing code than in the absence of a code.

The commercial relationship at the heart of the industry explains both the absence of a code and the shape of the code Congress wrote. In an ordinary market, the person injured by a defective product is the person who bought the product, and the threat of lost custom disciplines the seller. Consumer reporting inverted that relationship. The consumer was the subject of the file, not the customer of the bureau. The customers of a bureau were the furnishers of information who supplied account and interview material, and the users of reports who paid for reports in connection with credit, insurance, and employment decisions. A bureau that pleased its customers by furnishing reports quickly and in volume faced no market penalty from the subject of a report, because the subject paid nothing, chose nothing, and could transfer no business elsewhere. Accuracy was a cost borne by the bureau and a benefit enjoyed principally by a stranger to the transaction, and confidentiality was a restraint on a product whose value rose with the ease of its sale. Congress legislated into that inversion. The duties of the statute fall on consumer reporting agencies, on furnishers of information, and on users of reports precisely because no single party to the commercial exchange represented the interests of the person described, and the rights the statute created, disclosure to the consumer, dispute and reinvestigation, notice after adverse action, and limits on permissible purpose, supplied by law the leverage that the market structure had denied to the subject of the file.

That structure also explains a distinctive feature of the act, its refusal to rest on a model of consent alone. A consumer could not meaningfully consent to the creation of a bureau file, because credit, insurance, and employment in an economy organized around bureau reporting were not optional goods that a person could decline in order to keep a file from coming into existence, and because a file could be assembled from the records of creditors and the statements of acquaintances without any transaction between the subject and the bureau at all. Consent provisions therefore appear in the statute in defined places, most notably in connection with reports procured for employment purposes, while the core protections operate as duties that hold regardless of any agreement between bureau and subject. Reasonable procedures to assure maximum possible accuracy, disclosure of information in the file, identification of recipients of reports, and reinvestigation of disputed items were obligations imposed on the industry as conditions of selling personal information, not favors granted to customers. Personal information held by a business was treated as a subject of public regulation in its own right, governed by fair information principles that anticipated the principles later codified for federal agencies in 1974, and the individual was positioned as a rights holder against an organization rather than as a party to a contract with that organization.

The legislative path of the act reflected its double character as a banking measure and as a privacy measure. Proxmire, who chaired the Senate Committee on Banking and Currency during the relevant period and who had sponsored earlier consumer credit legislation, pressed fair credit reporting through the banking committees, where jurisdiction over credit reporting agencies and the users of reports lay. The House Committee on Banking and Currency produced House Report 91-975, and the Senate Committee on Banking and Currency produced Senate Report 91-1139 accompanying Senate bill 3678. The legislative history maintained for the codification recorded House consideration and passage on May 25, 1970, Senate consideration and passage in amended form on September 18, 1970, Senate agreement to the conference report on October 9, 1970, and House agreement to the conference report on October 13, 1970. Conference Report 91-1587 reconciled the two versions. The vehicle that carried the final text to enactment, Public Law 91-508, bore a formal title concerned principally with bank records and currency transaction reporting, a reminder that Title VI traveled as part of a larger package amending the Federal Deposit Insurance Act and related provisions, and that the first federal information privacy law reached the statute books attached to legislation whose caption gave a reader little warning of the privacy regime contained in its later titles.

Placement within the Consumer Credit Protection Act gave the new title a family of related statutes and a coherent theory of consumer credit as a field of federal concern. The parent act had opened in 1968 with the Truth in Lending Act of 1968, which required disclosure of the cost of credit so that a consumer could compare terms and understand the bargain being offered. Title VI addressed the stage before any bargain, the evaluation of the applicant on which an offer, a refusal, a price, or an interview depended. Read together, the two titles regulated the information environment of consumer credit from both directions, compelling a creditor to reveal the terms of credit to the applicant while compelling a bureau to reveal the contents of a file to the subject, and subjecting the circulation of that file to defined purposes and defined periods of retention. The architecture confirmed a judgment Congress had made by 1970, that consumer credit was a system of information flows as much as a system of loans, and that fairness in the system required rules for the information itself.

The enforcement choices of the original act also followed from the diagnosis of an unaccountable dossier industry. Congress assigned administrative enforcement to the Federal Trade Commission, using the Federal Trade Commission Act as the procedural vehicle, and distributed enforcement authority among other federal agencies for institutions within their respective jurisdictions, while also creating private civil liability for willful noncompliance under section 1681n and for negligent noncompliance under section 1681o. The private right mattered in a field where the injury was individual and frequently discovered by the injured person alone at the moment of a refusal, and the statute placed a remedy in the hands of that consumer. The act also addressed the states in section 1681t, preserving a role for state law in relation to the federal floor in the form enacted in 1970. The enforcement design, public and private in combination, treated accuracy and confidentiality as obligations owed to identifiable individuals and not merely as standards of industry practice.

The findings Congress placed at the head of the act join the two rationales that run through the origins of the statute. One rationale was systemic and economic. The banking system depended on fair and accurate reporting, the findings declared, and inaccurate reports impaired efficiency while unfair methods undermined confidence. The other rationale was personal, expressed in the stated purpose of fairness and equity to the consumer with regard to confidentiality, accuracy, relevancy, and proper utilization. Relevancy and proper utilization are privacy concepts. A report could be accurate in every entry and nevertheless violate the statute through disclosure for an impermissible purpose or through reporting of obsolete information beyond the periods fixed in section 1681c, and the findings therefore cannot be reduced to a program for cleaner data in the service of lending. Congress in 1970 legislated for the person inside the file as well as for the system that consumed the file.

By the effective date of April 25, 1971, the transformation required by Title VI had become concrete for every organization within the statutory definitions. A bureau had to maintain reasonable procedures, furnish reports only for permissible purposes, disclose files to consumers who requested disclosure and furnished proper identification, reinvestigate disputed information, and exclude most obsolete adverse information after the statutory periods had run. A user of a report that took adverse action based in whole or in part on a report had to notify the consumer and supply the name and address of the bureau that furnished the report, so that the chain from file to decision could be traced by the person harmed. None of those duties had existed as general federal law on October 25, 1970, and all of them existed as general federal law one hundred and eighty days after enactment. The distance between those two states of affairs measures the originality of the Fair Credit Reporting Act. Federal law had discovered, in the credit bureau file, a standing, saleable, consequential description of a person maintained by an organization the person did not control, and Congress answered that discovery with the first federal statute to govern such a description as a matter of the rights of its subject.

Who May Receive a Report and Why

The Fair Credit Reporting Act, enacted on October 26, 1970, as Title VI of the Consumer Credit Protection Act, regulated consumer reports through access rather than through censorship of content. Congress left agencies free to collect extensive information about payment history, employment, and public records, and then surrounded release of that information with a gate. Section 604 of the Act, codified at 15 U.S.C. section 1681b, supplied the gate. Its opening language permitted a consumer reporting agency to furnish a consumer report under the circumstances enumerated in the section and under no other circumstances. The list therefore operated as an exhaustive grant rather than as a set of illustrations. A recipient outside the list had no lawful claim to the report, however useful the information might have been for marketing, curiosity, litigation strategy, private investigation, or personal surveillance. In most commercial settings the statute substituted categorical permission for case by case consent, reserving written instructions for releases resting on the consumer acting directly.

Who can legally pull a credit report?

A consumer report may be furnished only to a person with a permissible purpose under section 1681b, such as a creditor evaluating a credit application, an employer with written authorization, an insurer underwriting coverage, a government agency determining eligibility for a license, or the consumer directing disclosure in writing.

Section 1681b(a)(3) organized the principal commercial purposes around a person whom the agency had reason to believe intended a specified use. Subparagraph (A) covered a credit transaction involving the consumer, including the extension of credit and the review or collection of an account. A lender evaluating an application fell squarely within that language, and an existing creditor reviewing an account or pursuing collection also fell within it, because the statute named review and collection alongside origination. Subparagraph (B) covered use for employment purposes, a category defined elsewhere in the Act to include evaluation for employment, promotion, reassignment, or retention. Subparagraph (C) covered use in connection with the underwriting of insurance involving the consumer, tied to the decision whether and on what terms coverage would issue. Subparagraph (D) covered a determination of eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant financial responsibility or status. Subparagraph (E), added by amendment after 1970, covered a potential investor, servicer, or current insurer assessing the credit or prepayment risks associated with an existing credit obligation.

Subparagraph (F) supplied the residual commercial category, and its qualifiers did the decisive work. A person otherwise had a legitimate business need for the information in connection with a business transaction that was initiated by the consumer, or to review an account to determine whether the consumer continued to meet the terms of the account. Initiation by the consumer separated an ordinary application for housing, services, or credit from a search undertaken at the sole initiative of a business seeking leverage or intelligence. A landlord receiving an application or a utility opening an account at a customer request could point to a transaction the consumer had set in motion. A business with no such transaction could not convert a general desire to know more about a person into a legitimate business need. Guidance from the Federal Trade Commission and court decisions construing the provision tied the phrase to the specific transaction, not to a roving license to investigate any person with whom a business might someday deal.

Two further routes in section 1681b(a) rested on formal authority rather than on commercial need. Paragraph (1) permitted furnishing in response to an order of a court having jurisdiction to issue such an order, or a subpoena issued in connection with proceedings before a federal grand jury, the grand jury language having entered the section through a 1989 amendment. Paragraph (2) permitted furnishing in accordance with the written instructions of the consumer to whom the report related, giving the subject of the file a direct means of authorizing a release outside the commercial categories and creating a record against which a later dispute about authorization could be measured. Section 1681b(a)(4), added during the 1990s, permitted furnishing in response to a request by the head of a state or local child support enforcement agency, or an authorized official, upon certifications concerning the need for the information to establish or enforce a child support obligation and concerning notice to the consumer.

The prohibition reached the act of obtaining as well as the act of furnishing. A report obtained for a purpose outside section 1681b was an impermissible pull even if the file contained accurate information and even if the recipient kept the contents confidential. Misrepresentation aggravated the offense. Section 619 of the Act, codified at 15 U.S.C. section 1681q, provided that a person who knowingly and willfully obtained information on a consumer from a consumer reporting agency under false pretenses would be fined under Title 18, imprisoned for not more than two years, or both. The Consumer Credit Reporting Reform Act of 1996, enacted on September 30, 1996, as part of Public Law 104-208, raised that penalty from the original ceiling of a fine of not more than 5,000 dollars or imprisonment for not more than one year. Civil liability provisions elsewhere in the Act separately addressed willful and negligent noncompliance, so a false certification of purpose could expose the recipient to a private claim as well.

Agency gatekeeping under section 1681e(a) gave the permissible purpose list its operational force. Section 607(a) of the Act, codified at 15 U.S.C. section 1681e(a), required every consumer reporting agency to maintain reasonable procedures designed to avoid violations of section 1681c, which governed the content of reports, and to limit the furnishing of reports to the purposes listed in section 1681b. The procedures had to require prospective users to identify themselves, to certify the purposes for which the information was sought, and to certify that the information would be used for no other purpose. The agency also had a duty to make a reasonable effort to verify the identity of a new prospective user and the uses certified by that user before furnishing a report. Finally, the subsection forbade an agency to furnish a report to any person if the agency had reasonable grounds for believing that the report would not be used for a purpose listed in section 1681b. Certification therefore functioned as a threshold rather than as a complete discharge of responsibility. An agency that accepted a facially regular certification from an entity whose business, history, or request pattern gave reason for doubt failed the standard, because release depended on the absence of reasonable grounds for disbelief as well as on the collection of signed forms.

The accuracy duty in section 1681e(b) occupied a different position, and precision about its structure matters more than any slogan drawn from its wording. Section 607(b) provided that whenever a consumer reporting agency prepared a consumer report, the agency had to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report related. The operative command attached to procedures. Congress did not write that every report had to be accurate, and Congress did not impose liability merely upon proof that a report contained an error. A consumer challenging a report under section 1681e(b) had to establish both an inaccuracy and a failure by the agency to follow reasonable procedures, with the second element doing independent work. An agency could receive false information from a furnisher, transcribe that information faithfully, match it to the correct consumer through sound matching logic, and release a report that was wrong in substance while the procedures behind the report remained reasonable. In that configuration the error was real and the harm could be serious, yet section 1681e(b), read on its own terms, had not been violated. Conversely, an agency with sloppy matching rules, no controls over mixed files, and no screening of unreliable sources could violate the subsection through the design of its system.

That distinction between process and outcome explained the shape of litigation under the provision. Courts asked what a reasonable agency would have done in designing intake, matching, and reporting systems, weighed the burden of additional precautions against the foreseeable risk and gravity of error, and treated a single mistake as evidence to be assessed rather than as a verdict in itself. The United States Court of Appeals for the Seventh Circuit made the point expressly in Sarver v. Experian Information Solutions, decided in 2004 and reported at 390 F.3d 969, holding that the Act did not make reporting agencies strictly liable for all inaccuracies and that liability depended on a failure to follow reasonable procedures. The reasoning followed the statutory grammar. The phrase maximum possible accuracy described the objective toward which reasonable procedures had to aim; the phrase reasonable procedures supplied the legal test for whether the agency had met its obligation. Reading the objective as a guarantee would have erased the qualifier reasonable and converted every furnisher error and every ambiguous public record into an automatic agency violation. Congress instead built a negligence style standard into a regulatory statute, demanding systems proportioned to risk while accepting that a system run with reasonable care could on occasion produce a false report.

The process standard also allocated responsibility across the reporting chain. Furnishers of information carried separate duties under section 1681s-2, added by the 1996 reform act, including duties concerning information known or reasonably believed to be inaccurate and duties to investigate after notice of a dispute from an agency. Agencies carried the reinvestigation duty of section 1681i after a consumer disputed completeness or accuracy. Section 1681e(b) governed the front of the process, the procedures in place when a report was prepared, rather than serving as a substitute for later correction mechanisms. A consumer with a false tradeline therefore faced a structured inquiry: whether the furnisher had supplied bad data, whether agency procedures for receiving and matching data were reasonable, whether a dispute had triggered a reasonable reinvestigation, and whether a user had acted on the report with the required notices. The architecture rewarded agencies that documented procedures, audited sources, and suppressed files that failed matching thresholds, because documented reasonableness was the defense the statute made available.

Prescreening tested the framework from the opposite direction, because prescreening allowed bureau data to generate offers for consumers who had initiated nothing. Section 1681b(c) governed furnishing reports in connection with credit or insurance transactions that were not initiated by the consumer. Under section 1681b(c)(1), an agency could furnish a report in connection with such a transaction only if the consumer authorized the agency to provide the report, or if the transaction consisted of a firm offer of credit or insurance, the agency had complied with the opt out provisions of section 1681b(e), and no election by the consumer to be excluded remained in effect, with an added protection against furnishing based on a date of birth showing that the consumer had not attained the age of 21 absent consent. A firm offer, defined in section 1681a(l), meant an offer that would be honored, subject to specified exceptions, if the consumer continued to meet the criteria used to select the consumer for the offer. A creditor or insurer could give an agency selection criteria, receive a list of consumers meeting those criteria, and mail solicitations to the listed consumers, each of whom received an offer rather than a mere advertisement conditioned on fresh discretionary review.

Congress surrounded prescreening with limits on content and with an exit for consumers. Section 1681b(c)(2) restricted what a person could receive under the firm offer route to the name and address of a consumer, an identifier that was not unique to the consumer and that served only to verify identity, and other information that did not identify the relationship or experience of the consumer with respect to a particular creditor or other entity. Section 1681b(e) supplied the election to be excluded, exercisable by notifying the agency through the notification system the agency maintained for that purpose or by submitting a signed notice of election form issued by the agency. Nationwide agencies operated a joint notification system with a toll free telephone number, and section 615(d), codified at section 1681m(d), required each prescreened solicitation to state clearly that report information was used, that the consumer met the criteria for the offer, that the offer might not be extended if the criteria ceased to be met, and that the consumer could prohibit future use of report information in transactions the consumer had not initiated. The Fair and Accurate Credit Transactions Act of 2003, enacted on December 4, 2003, strengthened that notice regime and lengthened the standard election to five years, with a permanent election available through the signed form procedure.

Employment reports received the most elaborate procedural treatment in section 1681b, reflecting a congressional judgment that a report used to deny a livelihood required safeguards beyond a certification of purpose. Section 1681b(b)(1) required a person intending to use a report for employment purposes to certify to the agency that the person had complied with the disclosure and authorization requirements of section 1681b(b)(2), that the person would comply with the adverse action requirements of section 1681b(b)(3), and that information from the report would not be used in violation of any applicable federal or state equal employment opportunity law or regulation. Section 1681b(b)(2) then barred procurement unless two conditions had first been met. A clear and conspicuous disclosure had to be made in writing to the consumer, before the report was procured, in a document that consisted solely of the disclosure, stating that a consumer report might be obtained for employment purposes. The consumer also had to authorize in writing the procurement of the report, and that authorization could appear on the same document as the disclosure. The standalone character of the document became a central compliance point after the 1996 amendments took effect on September 30, 1997, because extraneous material risked defeating the condition that the document consist solely of the disclosure and the permitted authorization.

Section 1681b(b)(3) imposed a two stage sequence when a person intended to act against an applicant or employee based in whole or in part on a consumer report. Before taking adverse action, the person had to provide the consumer with a copy of the report and a description in writing of the rights of the consumer under the Act, the summary prepared under section 1681g(c). That package gave the consumer an opportunity to see the document driving the decision and to identify a mixed file or a stranger record before the decision hardened. Only after that step, and after an interval the statute left unquantified, could the adverse action be taken and the notice required by section 1681m(a) then given, identifying the agency that furnished the report, stating that the agency had not made the decision, and explaining the rights to obtain a free copy of the report within 60 days and to dispute accuracy with the agency. A narrow exception in section 1681b(b)(3)(B) modified the sequence for employment applications made by mail, telephone, computer, or similar means for positions subject to regulation by the Secretary of Transportation or a state transportation agency, substituting notice within three business days of the adverse action. Section 1681b(b)(4) separately excepted adverse action by a federal agency or department based on a report relevant to a national security investigation, upon a written finding by the head of that agency or department.

Investigative consumer reports formed the final category, and the category turned on method rather than on subject matter alone. Section 1681a(e) defined an investigative consumer report as a consumer report, or a portion of a report, in which information on character, general reputation, personal characteristics, or mode of living was obtained through personal interviews with neighbors, friends, or associates of the consumer, or with others with whom the consumer was acquainted or who might have knowledge concerning such items of information. A report built from conversations about honesty, habits, associations, or reputation crossed into the investigative category, because Congress treated interview based reputation evidence as carrying distinctive risks of rumor, malice, and mistaken identity. Section 606 of the Act, codified at 15 U.S.C. section 1681d, attached disclosure duties calibrated to those risks.

Section 1681d(a)(1) barred a person from procuring or causing an investigative consumer report to be prepared unless the fact of the investigation was clearly and accurately disclosed to the consumer. The disclosure had to state that an investigative consumer report including information as to character, general reputation, personal characteristics, and mode of living, whichever were applicable, might be made. The disclosure had to be made in a writing mailed, or otherwise delivered, to the consumer not later than three days after the date on which the report was first requested, and the writing had to include a statement informing the consumer of the right to request the additional disclosures provided for in section 1681d(b), together with the written summary of consumer rights prepared under section 1681g(c). Section 1681d(a)(2) required the person procuring the report to certify to the agency that the disclosures had been made and that the person would comply with section 1681d(b). Section 1681d(b) gave that request substance: upon written request made within a reasonable period after receipt of the initial disclosure, the person had to make a complete and accurate disclosure of the nature and scope of the investigation requested, in a writing mailed or otherwise delivered not later than five days after the date on which the request was received or the report was first requested, whichever was later.

Section 1681d(d) added prohibitions addressed to the agency preparing such a report. An agency could not prepare or furnish an investigative consumer report unless the agency had received the certification required by section 1681d(a)(2). An agency could not make an inquiry for an employment related investigative report if the inquiry by an employer would violate applicable federal or state equal employment opportunity law or regulation. Except as section 1681k otherwise provided, an agency could not furnish an investigative report containing public record information relating to an arrest, indictment, conviction, civil judicial action, tax lien, or outstanding judgment unless the agency had verified the accuracy of the information during the 30 day period ending on the date the report was furnished. Most distinctive of all, section 1681d(d)(4) barred an agency from preparing or furnishing an investigative report containing information adverse to the interest of the consumer and obtained through a personal interview, unless the agency had followed reasonable procedures to obtain confirmation from an additional source with independent and direct knowledge, or the person interviewed was the best possible source of the information.

The Reporting Clock and the Dispute Machinery

A credit file would be a life sentence if nothing in it ever expired, and a work of fiction if nothing in it could ever be challenged. The Fair Credit Reporting Act of 1970 answered both dangers with machinery rather than with exhortation. Section 605 of the Act, codified at 15 U.S.C. section 1681c, placed an obsolescence schedule over the contents of a consumer report, fixing the number of years after which specified items of adverse information had to fall away. Sections 611 and 609, codified at sections 1681i and 1681g, built the second half of the design: a consumer who found an error could force a reinvestigation on a statutory deadline, and a consumer who wanted to find an error could demand to see the file itself.

The obsolescence schedule in section 1681c(a) worked by prohibition. Except as authorized by the exemptions in subsection (b), no consumer reporting agency could make a consumer report containing any of the listed items once the stated period had run. The longest period belonged to bankruptcy. Cases under title 11 of the United States Code, or under the older Bankruptcy Act, could not be reported once they antedated the report by more than ten years, measured from the date of entry of the order for relief or the date of adjudication, as the case might be. The Act as enacted in 1970 had allowed bankruptcies to be reported for fourteen years from adjudication, and the Bankruptcy Reform Act of 1978 substituted the ten year period and the order for relief starting point. A bankruptcy case therefore followed a consumer for a decade from a court event that was fixed and documented, incapable of being moved by anything a creditor or a collector did afterward.

Below bankruptcy, the schedule settled on seven years as its standard unit. Civil suits, civil judgments, and records of arrest could not be reported once they antedated the report by more than seven years from the date of entry, or once the governing statute of limitations had expired, whichever period was the longer. That alternative measure mattered for judgments in particular, because a judgment could remain enforceable under state law for longer than seven years, and Congress chose to let the reporting period track the longer of the two measures rather than cutting off reports about a debt that a court could enforce. Paid tax liens carried a seven year period of their own, measured from the date of payment rather than from the date the lien was filed or recorded, a choice that rewarded satisfaction of the obligation. The paragraph spoke only to paid liens, leaving liens that remained unpaid outside the period that paragraph (3) prescribed. Accounts placed for collection or charged to profit and loss formed the fourth category, barred once they antedated the report by more than seven years.

The seven year figure answered only half of the question presented by a delinquent account, because a period without a starting point invites manipulation. An account could pass from a creditor to an internal collection department, then to an outside collector, then to a debt buyer, and each transfer offered an opportunity to describe the account as new. The Consumer Credit Reporting Reform Act of 1996 closed that opening by adding subsection (c) to section 1681c, fixing the commencement of the reporting period for delinquent accounts. Under section 1681c(c)(1), the seven year period for an account placed for collection, charged to profit and loss, or subjected to a similar action began upon the expiration of the 180 day period that began on the date of commencement of the delinquency that immediately preceded the collection activity, the charge to profit and loss, or the similar action. The practical effect was a window of roughly seven and a half years from the first missed payment in the chain of delinquency that led to the collection or charge off, and the clock ran from that delinquency regardless of when a collector acquired the account or when the creditor wrote the balance off its books. The 1996 provision applied to items of information added to a consumer file on or after the date that fell 455 days after September 30, 1996. The date of first delinquency thereby became the single most consequential date in a consumer file, because the legality of reporting the worst items in the file depended on it.

How long does a late payment stay on a credit report?

A late payment may be reported for seven years. As an adverse item of information under section 1681c(a)(5), a late payment falls outside a consumer report once it antedates the report by more than seven years, measured from the delinquency itself rather than from any later sale, assignment, or collection activity involving the account.

A single late payment and a collapsed account therefore aged under related but distinct rules. A payment recorded as thirty, sixty, or ninety days late was an adverse item within the catchall language of paragraph (5), and the seven year period ran from the delinquency that the entry recorded. Where the delinquency deepened and the account was placed for collection or charged off, subsection (c) supplied the controlling start date, anchoring the period to the commencement of the delinquency that immediately preceded the collection activity or charge off, plus the 180 days that the subsection prescribed. Payment of part of the balance or a transfer of the account to a new collector did not restart either clock, because neither provision made the period depend on later activity by the consumer or by a furnisher. The distinction between the reporting clock and a state statute of limitations also bore emphasis. The limitations period governed how long a creditor had to sue, and state law set that period and its rules for revival. The reporting period governed only how long the information could appear in a consumer report, and its expiration extinguished neither the debt nor any obligation that state law preserved.

The catchall paragraph completed the schedule. Section 1681c(a)(5) barred any other adverse item of information that antedated the report by more than seven years, a formulation broad enough to capture adverse information that Congress had not enumerated, from foreclosures and repossessions to late payments. The paragraph carried a conspicuous exception, inserted by amendment in 1998, for records of convictions of crimes. The Act as enacted in 1970 had placed records of arrest, indictment, or conviction of crime under a seven year limit measured from the date of disposition, release, or parole. In 1998, Public Law 105-347 struck that paragraph from the schedule and rewrote the catchall so that it excluded records of convictions from its coverage. The consequence was that, after the 1998 amendment took effect, section 1681c(a) set no obsolescence period for a criminal conviction at all: a conviction could be reported without regard to its age under the federal schedule, subject to any stricter period that state law imposed. Records of arrest fared differently. The same 1998 amendment placed records of arrest within paragraph (2), alongside civil suits and civil judgments, where the seven year period, or the governing statute of limitations if longer, continued to apply. An arrest that produced no conviction thus aged out of a report in seven years, while a conviction carried no federal expiration date, a distinction that reflected a congressional judgment about the reliability and significance of a formal adjudication as against a mere accusation.

Every period in the schedule yielded, however, when the transaction at stake was large enough. Section 1681c(b) declared the obsolescence provisions of paragraphs (1) through (5) inapplicable to a consumer report used in connection with specified high value transactions: a credit transaction involving, or reasonably expected to involve, a principal amount of $150,000 or more; the underwriting of life insurance involving, or reasonably expected to involve, a face amount of $150,000 or more; and the employment of an individual at an annual salary that equaled, or could reasonably be expected to equal, $75,000 or more. For a report furnished within one of those categories, information that the schedule would otherwise have excluded, a bankruptcy older than ten years or a judgment older than seven, could lawfully appear. The dollar thresholds were not part of the Act as enacted in 1970. The original exemptions had been set at $50,000 for credit and life insurance transactions and $20,000 for annual salary, figures that inflation steadily converted from markers of exceptional transactions into descriptions of ordinary ones. The 1996 amendments raised the thresholds to $150,000 and $75,000, restoring the original premise that the exemptions described genuinely large exposures. Outside those categories, the periods admitted no balancing: a report for an ordinary consumer credit transaction could not include an obsolete item because a creditor considered the item informative, and the agency bore the duty of exclusion without any request from the consumer.

The dispute machinery of section 1681i addressed the different problem of information that was within its reporting period but wrong. The machinery began with notice. If a consumer disputed the completeness or accuracy of any item in the file and notified the agency directly, or indirectly through a reseller, the agency came under a duty to reinvestigate. Section 1681i(a)(4) required the agency to review and consider all relevant information that the consumer submitted during the reinvestigation period, so the process was structured as an examination of evidence rather than as a bare comparison of the disputed entry against the record of the furnisher that had supplied it. The agency could terminate a reinvestigation upon a reasonable determination that the dispute was frivolous or irrelevant, including a determination grounded in a failure by the consumer to provide sufficient information to investigate the disputed item, but that exit was itself regulated: the agency had to notify the consumer of the determination not later than five business days after making it, with the reasons for the determination and any information required to investigate the dispute.

How long does a credit bureau have to investigate a dispute?

The agency has thirty days from receipt of the dispute to complete a reasonable reinvestigation free of charge. That period may be extended by not more than fifteen additional days when the consumer supplies relevant information during the initial thirty days, producing a maximum reinvestigation period of forty-five days under section 1681i(a)(1).

The thirty day period ran from the date on which the agency received notice of the dispute, and the extension had a deliberate logic. A consumer who supplemented a dispute with additional relevant information during the initial period gave the agency more material to examine, and the statute allowed up to fifteen additional days for that examination, while withholding the extension from any reinvestigation in which the disputed information had already been found inaccurate or incomplete, or had been determined to be unverifiable, during the initial thirty days. Inside the reinvestigation period, a second and much shorter clock governed the agency dealings with the source of the information. Before the expiration of the five business day period beginning on the date the agency received notice of the dispute, the agency had to provide notification of the dispute to the person who had furnished the item in dispute, and the notice had to include all relevant information regarding the dispute that the agency had received from the consumer. Relevant information that arrived from the consumer after that notice, and before the end of the reinvestigation period, had to be provided promptly to the furnisher as well.

The end of a reinvestigation was as regulated as its beginning. Under section 1681i(a)(5), if an item was found to be inaccurate or incomplete, or could not be verified, the agency had to delete the item promptly from the consumer file, or modify the item as appropriate based on the results of the reinvestigation, and had to notify the furnisher promptly that the information had been modified or deleted. Unverifiability stood on the same footing as demonstrated inaccuracy, because a furnisher that failed to respond, or that could not document an entry, left the agency with information that the statute required the agency to remove. Information deleted after a reinvestigation could not be reinserted unless the furnisher certified that the information was complete and accurate, and upon any reinsertion the agency had to notify the consumer in writing not later than five business days after the reinsertion, accompanied by a statement that the information had been reinserted and a notice of the consumer right to add a statement of dispute to the file. The agency also had to maintain reasonable procedures designed to prevent the reappearance of deleted information. Separately, section 1681i(a)(6) required written notice of the results of the reinvestigation not later than five business days after its completion, and the notice package included a statement that the reinvestigation was completed, a consumer report based on the file as revised, a notice that the consumer could request a description of the procedure used to determine accuracy and completeness together with the identity of furnishers contacted, and a notice of the right to add a statement to the file. A consumer who requested that description was entitled to receive it not later than fifteen days after the agency received the request, under section 1681i(a)(7).

A reinvestigation that left the disputed information in place did not leave the consumer without a voice in the file. Section 1681i(b) provided that if the reinvestigation did not resolve the dispute, the consumer could file a brief statement setting forth the nature of the dispute. The agency could limit such a statement to not more than one hundred words if the agency provided the consumer with assistance in writing a clear summary of the dispute. Section 1681i(c) gave the statement its audience: whenever a statement of dispute had been filed, unless there were reasonable grounds to believe the statement was frivolous or irrelevant, the agency had to note clearly, in any subsequent consumer report containing the information in question, that the consumer disputed the information, and had to provide either the statement or a clear and accurate codification or summary of it. Section 1681i(d) extended the reach of both deletions and statements backward to earlier readers of the file. Following a deletion, or a notation of disputed information, the agency had, at the request of the consumer, to furnish notification that the item had been deleted, or to furnish the statement, codification, or summary, to any person the consumer specifically designated who had received a consumer report containing the deleted or disputed information within two years prior for employment purposes, or within six months prior for any other purpose.

The dispute did not run against the bureau alone, because the bureau had seldom created the information under challenge. The Consumer Credit Reporting Reform Act of 1996 therefore added section 623 of the Act, codified at 15 U.S.C. section 1681s-2, imposing duties on furnishers of information. Subsection (a) stated the general accuracy duties, prohibiting a person from furnishing information with knowledge of errors and requiring correction and updating of information previously furnished. Subsection (b) addressed the dispute setting directly. After receiving notice of a dispute from a consumer reporting agency under section 1681i(a)(2), a furnisher had to conduct an investigation with respect to the disputed information, review all relevant information provided by the agency, and report the results of the investigation to the agency. If the investigation found the information incomplete or inaccurate, the furnisher had to report those results to all other consumer reporting agencies to which the furnisher had furnished the information and that compiled and maintained files on consumers on a nationwide basis, so a correction won at one bureau propagated to the others. Where an item was found inaccurate or incomplete, or could not be verified, the furnisher had to modify the item, delete it, or permanently block its reporting, as appropriate. Section 1681s-2(b)(2) tied the furnisher deadline to the bureau deadline: the furnisher had to complete its investigations, reviews, and reports before the expiration of the period within which the agency was required to complete the reinvestigation under section 1681i(a)(1). The furnisher investigation was therefore a component inside the thirty day reinvestigation, which explained why the agency notice duty ran in five business days rather than at leisure.

The furnisher provisions carried an enforcement boundary that shaped how the duties operated in practice. Sections 1681n and 1681o, the provisions creating private actions for willful and negligent noncompliance, did not apply to violations of section 1681s-2(a), and section 1681s-2(d) provided that the accuracy duties of subsection (a) were to be enforced exclusively as provided under section 1681s, by the federal agencies and officials and the state officials identified in that section. A consumer thus held no private right of action for a violation of the furnisher accuracy duties as such, however careless the original furnishing had been; enforcement of those duties belonged to government agencies. The subsection (b) duties stood on different ground, because those duties arose only after the agency notice had issued, and the limitation in section 1681s-2(c) was directed at subsection (a). The practical consequence was a two tier structure: the initial accuracy of furnished information was a matter for regulators, while the handling of a dispute that had passed through a bureau engaged the furnisher obligations that the 1996 Act had built, and a consumer who wanted the furnisher duties to attach had to route the dispute through a consumer reporting agency rather than complaining to the furnisher alone.

Disclosure completed the circuit, because a consumer could neither use the clock nor aim a dispute without knowing the contents of the file. Section 1681g required every consumer reporting agency, upon request and proper identification, to disclose clearly and accurately to the consumer all information in the consumer file at the time of the request, subject to stated exceptions that included information concerning credit scores or other risk scores and predictors. The disclosure extended beyond the entries themselves. The agency had to reveal the sources of the information, with a narrow exception for sources acquired solely for use in preparing an investigative consumer report and actually used for no other purpose, sources that became available through discovery if an action was brought under the Act. The agency also had to identify each person that had procured a consumer report on the consumer, covering reports procured for employment purposes during the two year period preceding the request and reports procured for any other purpose during the one year period preceding the request, together with the dates, original payees, and amounts of any checks on which an adverse characterization was based. The file disclosure thus converted the consumer from the subject of the file into an auditor of it: the obsolescence periods could be checked against the dates disclosed, and the sources matched against the entries.

Accuracy duties carry weight only when a remedy attaches to each one, and the statute pairs its obligations in a pattern that a compact reference can display. The table that follows sets the principal duties beside the party each duty binds, the standard a court applies, the remedy open to a consumer, and the limit that standing doctrine placed on private enforcement.

The duty and remedy table

Obligation	Party bound	Standard applied	Consumer remedy	Effect of the standing rule
Permissible purposes, section 1681b	Consumer reporting agency	A report furnished only for a purpose the statute lists	Action for negligent or willful noncompliance	A plaintiff without concrete harm from an improper disclosure lacked standing
Reasonable procedures for accuracy, section 1681e(b)	Consumer reporting agency	Reasonable procedures to assure maximum possible accuracy	Actual damages for negligence and statutory or punitive damages for willfulness	Inaccurate information never sent to a third party supported no damages claim
The reporting clock, section 1681c	Consumer reporting agency	Adverse items excluded after the period the statute fixes	Correction of the report and damages for a proved violation	Obsolete information kept in an unsent file caused no concrete injury
Reinvestigation of disputes, section 1681i	Consumer reporting agency	A reasonable investigation completed within the statutory period	Deletion or correction of disputed material and damages	A dispute duty breach without dissemination or another concrete loss failed standing
Furnisher investigation duties, section 1681s-2(b)	Furnisher of information	An investigation after notice of a dispute from a reporting agency	A private action after agency notice triggered the duty	Standing required a concrete injury traceable to the failed investigation
File disclosure, section 1681g	Consumer reporting agency	Disclosure of all information in the file with sources and recipients	An action to compel compliance and damages for a proved violation	An incomplete disclosure without concrete harm gave no federal claim
Employment disclosure and authorization, section 1681b(b)	Employer or other user of a report	A standalone disclosure and written authorization before procurement of the report	An action for negligent or willful noncompliance	A defective disclosure form without concrete harm failed standing
Adverse action notice, section 1681m	User of a consumer report	Notice with bureau identification and a statement of consumer rights	An action for negligent or willful noncompliance	A missing notice without a resulting concrete injury supported no claim

How Later Congresses Rebuilt the Statute

The statute that entered force in 1971 placed most of its weight on the consumer reporting agencies themselves. Congress in 1970 regulated the companies that assembled files, sold reports, investigated disputes, and disclosed records, while the businesses that supplied the underlying information and the businesses that acted on reports carried a lighter set of obligations. During the following five decades, Congress returned to the statute repeatedly, and each return redistributed responsibility across a wider circle of participants. Banks, card issuers, retailers, employers, landlords, and insurers supplied the data, requested the reports, or made the decisions, and the amendments of 1996, 2003, 2010, and 2018 converted a bureau centered law into a system wide code governing consumer information from furnishing through decision, dispute, retention, and disposal.

The first comprehensive rebuilding arrived with the Consumer Credit Reporting Reform Act of 1996, enacted as part of the Omnibus Consolidated Appropriations Act, 1997, Public Law 104-208, signed on September 30, 1996. The 1996 amendments generally took effect on September 30, 1997, and the interval gave agencies, furnishers, and users a full year to rebuild forms, procedures, and computer systems. In substance, the 1996 act rewrote the operating assumptions of the 1970 statute. Accuracy ceased to be a problem assigned to bureaus alone, prescreened solicitations received a detailed federal framework, the obsolescence periods for adverse information received a defined method of calculation, and state law in several enumerated subjects was displaced by federal standards for a stated period. Each choice survived into the later amendments.

Furnisher obligations formed the most consequential innovation of 1996. Before the amendments, a bank or retailer that reported a missed payment, a charged off balance, or a repossession to a bureau faced few direct statutory duties about the accuracy of the material transmitted, even though an error at the furnishing stage entered every downstream report and decision. Section 623 of the amended statute, codified at 15 U.S.C. section 1681s-2, imposed responsibilities on persons that furnished information to consumer reporting agencies. A furnisher was prohibited from reporting information with knowledge of an error, was required to correct and update information found to be incomplete or inaccurate, and was required to notify agencies when a consumer disputed information or when an account had been voluntarily closed by the consumer. After a bureau forwarded a consumer dispute, the furnisher acquired a duty to investigate the disputed item, review the information provided by the bureau, and report the results back within the statutory period. The accuracy duties rested largely on regulatory enforcement rather than a broad private action for the furnishing itself.

Prescreening received equally detailed treatment in 1996 because the practice had grown into a central method of marketing credit and insurance. In a prescreening arrangement, a lender or insurer supplied criteria to a consumer reporting agency, the agency compiled a list of consumers whose files met those criteria, and the lender used the list for solicitations, all without an application from any consumer on the list. The amended statute permitted the practice only inside defined conditions. The solicitation had to rest on a firm offer of credit or insurance, a bureau could furnish a report in a transaction not initiated by the consumer only under the prescreening provisions, and consumers received a right to opt out of prescreened lists through a notification system administered by the nationwide agencies. The statute also limited the information that could travel in a prescreened list and required notices explaining that credit information had been used and that the consumer could elect exclusion. The framework accepted targeted marketing as lawful commerce while treating the underlying file as material demanding the safeguards attached to a firm offer.

The 1996 amendments also fixed a question that had generated persistent disputes about the age of adverse information. The original statute barred reporting of most adverse items after seven years, but inconsistent bureau practice had exposed uncertainty about the date from which the seven year period ran for a delinquent account. The amended section 605 supplied a defined start date. For an account placed for collection, charged off, or subjected to similar action, the period began upon expiration of a 180 day period that itself began on the date of commencement of the delinquency that immediately preceded the collection activity or charge off. The rule tied the reporting clock to the missed payment that started the chain rather than to the later and variable dates on which a creditor referred, sold, or wrote off the account. A debt could therefore pass through collectors without restarting the reporting period at each transfer.

Preemption in 1996 completed the bargain. Congress displaced state law across a defined set of subjects, including prescreening, the timing and content of certain disclosures, the duties of furnishers, the responsibilities surrounding adverse action notices, the time periods for obsolete information, and the exchange of information among affiliated companies. The preemption was broad but time limited, written to expire at the beginning of 2004 unless Congress acted, and the sunset forced a later legislature to judge whether national uniformity had worked. States retained authority outside the enumerated subjects, and state laws in effect on the date of the 1996 enactment received protection in specified respects, so the federal occupation of the field arrived as a scheduled experiment rather than a permanent settlement.

Between the two great Fair Credit Reporting Act amendments, Congress constructed a neighboring framework for financial data in the Gramm-Leach-Bliley Act of 1999, Public Law 106-102. That statute governed how financial institutions collected, shared, and safeguarded nonpublic personal information, required privacy notices and opt out rights for sharing with nonaffiliated third parties, and directed regulators to establish safeguards for customer records. The Gramm-Leach-Bliley Act and the Fair Credit Reporting Act answered different questions about overlapping data. The 1999 privacy regime asked whether a financial institution could share customer information and under what notice, while the credit reporting statute asked whether information assembled for eligibility decisions had been collected, furnished, reported, and disputed under the rules attached to consumer reports. A single bank could occupy both regimes in a single transaction, as a furnisher under one statute and as a financial institution with privacy and safeguards duties under the other.

The Fair and Accurate Credit Transactions Act of 2003, known as FACTA, Public Law 108-159, signed by President George W. Bush on December 4, 2003, arrived against two deadlines and one national anxiety. The preemption provisions enacted in 1996 were scheduled to expire in early 2004, identity theft had moved from a specialist concern of fraud investigators into ordinary consumer experience, and the free report and accuracy provisions of the earlier statute depended on consumers knowing that a file existed and acting without a standard national channel for obtaining the file. FACTA answered all three pressures in a single enactment. The identity theft provisions gave victims tools for blocking fraudulent information and alerting prospective creditors, the access provisions created a universal right to a free annual disclosure, the accuracy provisions deepened furnisher and bureau duties, and the preemption provisions converted the temporary national standards of 1996 into a permanent structure. Congress in 2003 also extended federal attention to merchants printing receipts, businesses disposing of records, and financial institutions watching for warning signs of identity theft.

The free annual report right formed the most widely used product of the 2003 act. Earlier law had given a free disclosure in defined situations, such as after adverse action, and had otherwise permitted a regulated charge. FACTA granted every consumer a right to obtain a free consumer report once every twelve months from each nationwide consumer reporting agency, and directed that the right be delivered through a centralized source established for that purpose under Federal Trade Commission regulation. The centralized source, operated by the nationwide agencies in cooperation with the Commission and organized around a single request channel, removed the need for a consumer to identify separate procedures at Equifax, Experian, and TransUnion before seeing a file. A consumer with a free annual disclosure could identify an unfamiliar account or a wrong balance before an application forced the issue, and could then use the dispute procedures that the 1996 amendments had strengthened.

What is a fraud alert on a credit report?

A fraud alert is a notice placed in a consumer file at a consumer reporting agency at the consumer’s request, warning prospective users of a report that the consumer may be a victim of identity theft and that identity should be verified before credit is extended.

FACTA built the fraud alert into a structured system with defined durations and defined bureau duties. An initial alert, available to a consumer who asserted in good faith a suspicion of fraud or identity theft, remained in the file for at least ninety days under the 2003 design, and a request to one nationwide agency obligated that agency to refer the alert to the other nationwide agencies. An extended alert, available upon an identity theft report, remained for seven years and required exclusion of the consumer from prescreened lists for a defined period, while an active duty alert protected members of the military during deployment for at least twelve months. A user of a report that carried an alert was required to treat the alert as a direction to take additional steps for verification rather than as decoration on the file, and agencies were required to disclose the alert with the report. Alongside alerts, FACTA gave victims a right to block reporting of information that resulted from identity theft and a right to obtain records of fraudulent transactions from the businesses where such transactions had occurred.

Truncation carried the identity theft campaign into the checkout line. FACTA prohibited a person accepting credit or debit cards from printing more than the last five digits of the card number, and prohibited printing the expiration date, on an electronically printed receipt provided to the cardholder at the point of sale. Handwritten and imprinted receipts fell outside the truncation command. The provision converted a security practice into a national habit, because a discarded receipt ceased to carry the complete credentials needed for many forms of account misuse. Congress returned in 2008 to clarify that a merchant printing an expiration date during a defined transition period, while otherwise compliant, had not acted willfully.

Duties addressed to persistent accuracy problems formed a quieter but structurally significant part of FACTA. Congress in 2003 found that single dispute investigations, conducted item by item, often left systemic errors untouched when a furnisher transmitted the same flawed data month after month or when a bureau reinserted deleted information without notice. FACTA required agencies to block and refrain from reinserting information tied to identity theft under defined conditions, strengthened notices to furnishers when information was deleted or a dispute was found frivolous or irrelevant, and required notice when a bureau determined that a dispute lacked sufficient information to proceed. For furnishers, FACTA directed the federal regulators to establish guidelines about the accuracy and integrity of furnished information and regulations requiring furnishers to maintain reasonable policies and procedures for implementing those guidelines. The act also laid groundwork for a consumer to dispute information directly with a furnisher in defined circumstances, moving part of the accuracy contest toward the institution holding the underlying account records.

Red flags and disposal rules extended FACTA into institutional design rather than individual transactions. Section 114 of the 2003 act directed regulators to prescribe identity theft red flags guidelines and rules requiring financial institutions and creditors maintaining covered accounts to develop and implement a written identity theft prevention program, designed to detect, prevent, and mitigate identity theft through patterns, practices, and activities recognized as warning signs. Section 315 added duties when a user of a report received a notice of address discrepancy from a nationwide agency, requiring reasonable efforts to form a reasonable belief about identity and, for regulated institutions issuing cards, to reconcile addresses under defined conditions. Separately, FACTA required proper disposal of consumer information derived from consumer reports, and the Federal Trade Commission disposal rule issued under that authority required reasonable measures against unauthorized access in connection with disposal, including destruction of paper and electronic media.

Preemption supplied the constitutional price of the 2003 settlement. FACTA converted the time limited preemption of 1996 into a broad and permanent national standard across the subjects Congress had listed in 1996, and added preemption in the new fields created by the 2003 act, including fraud alerts, the blocking of identity theft information, the free annual report system, truncation, and the duties of furnishers in several respects. State authority survived in defined enclaves, including certain state identity theft laws of longer standing and subjects Congress expressly left open, such as state rules about credit based insurance scoring notices. The permanent standard ended the cycle attached to the 2004 sunset and gave national furnishers and bureaus a single compliance framework across state lines, at a cost to state experimentation on the core subjects claimed for federal law.

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 reorganized administration without rewriting the substantive heart of the credit reporting statute. Enacted in response to the financial crisis of 2007 through 2009, Dodd-Frank created the Consumer Financial Protection Bureau and, on the designated transfer date of July 21, 2011, transferred general rulemaking authority under the Fair Credit Reporting Act from the Federal Trade Commission and the federal banking agencies to the Bureau. The Bureau restated the inherited regulations, including Regulation V at 12 C.F.R. Part 1022. The transfer carried stated exceptions: rulemaking for the identity theft red flags provisions and for the disposal of consumer report information remained with the Federal Trade Commission, the banking agencies, and the securities regulators for entities within the jurisdiction of each regulator. Enforcement became shared rather than singular, because the Bureau enforced the statute against large depository institutions and supervised nonbank participants, the Federal Trade Commission retained enforcement across much of the nonbank economy, prudential regulators retained authority for institutions within the respective charters, and state attorneys general held a general power to enforce the statute in federal court, subject to notice and intervention rights for federal agencies. Private actions by consumers for willful and negligent noncompliance continued alongside public enforcement.

The Economic Growth, Regulatory Relief, and Consumer Protection Act, Public Law 115-174, signed on May 24, 2018, supplied the amendment that closed the period covered by a statute profile dated November 1, 2018. Section 301 of the 2018 act amended the credit reporting statute to require free nationwide security freezes, and the freeze provisions took effect on September 21, 2018, one hundred twenty days after enactment. Before the 2018 amendment, freeze rights had rested on a patchwork of state statutes with varying fees and procedures. The federal amendment prohibited a nationwide consumer reporting agency from charging for placing, removing, or temporarily lifting a security freeze, and imposed deadlines calibrated to the method of request: placement within one business day for a request made online or by telephone, within three business days for a request sent by mail, and lifting within one hour for an online or telephone request. A freeze restricted access to a consumer file for most new credit purposes, making a freeze a stronger instrument than a fraud alert, because an alert instructed a prospective creditor to verify identity while a freeze blocked the report upon which a new account decision ordinarily depended.

Section 301 also created protected consumer records for minors and other represented persons. A parent or legal guardian of a child under sixteen years of age could request a nationwide agency to create a protected consumer record where no file existed and to place a freeze on that record, so that a Social Security number belonging to a child could not be used to build a fraudulent credit history undetected through childhood. Guardians, conservators, and persons holding a valid power of attorney received a parallel power for consumers under the care of such representatives. The same section lengthened the initial fraud alert enacted in 2003 from ninety days to one year, reducing the renewal burden on consumers who had reported a compromise of personal information. The Federal Trade Commission announced availability of free freezes and one year alerts on September 21, 2018, the effective date fixed by the statute.

Coverage across the amended statute followed function rather than corporate label. The nationwide consumer reporting agencies, Equifax, Experian, and TransUnion as the principal examples by 2018, carried the fullest set of duties because the agencies assembled and maintained files on consumers across the country and sold reports for credit, insurance, employment, and tenancy decisions. Nationwide specialty consumer reporting agencies occupied a defined statutory category for companies that compiled medical records or payments, residential or tenant history, check writing history, employment history, or insurance claims on a nationwide basis, and such agencies owed file disclosure duties that included the free annual disclosure right created in 2003. Specialty agencies outside the nationwide definition, including tenant screening companies, employment screening companies, and check verification companies, were consumer reporting agencies under the general definition when the companies assembled or evaluated information for third parties for a fee or on a cooperative nonprofit basis, and the general duties about permissible purposes, accuracy, disputes, and disclosure therefore applied. A landlord, employer, or creditor using such a report became a user with adverse action and certification duties, while the institution supplying payment or tenancy data became a furnisher with the accuracy duties added in 1996 and strengthened in 2003.

Resellers marked a further point on the coverage map. A reseller procured a consumer report from a bureau for the purpose of reselling the report, or information in the report, to a third party, often by combining bureau data with mortgage, employment, or tenancy material for a lender or landlord. The amended statute required a reseller to disclose to the bureau the identity of the end user and the permissible purpose for the report, to maintain reasonable procedures against procurement for an impermissible purpose, and to honor dispute obligations in coordination with the bureau holding the underlying file. Beyond resellers lay the boundary of the statute. A business that merely reported information about transactions or experiences with a consumer to an affiliate under the conditions prescribed by the statute did not, by that sharing alone, become a consumer reporting agency. A company compiling information solely about commercial enterprises rather than consumers stood outside the consumer report framework. The obsolescence bars also carried exemptions for large credit transactions, large life insurance underwriting, and higher salary employment, at thresholds stated in the statutory text. The line drawn across five decades of amendment therefore ran between information assembled for eligibility decisions about individual consumers, which the statute governed in detail, and the wider world of commercial data and internal records, which the statute reached only when a defined provision supplied the connection.

The Standing Revolution in the Courts

The Fair Credit Reporting Act of 1970 placed much of its practical force in private litigation. Agency enforcement shaped bureau operations after enactment, yet the statute also gave an individual consumer a direct claim against a reporting agency, a furnisher, or a user that failed to comply with a statutory duty. Private suits supplied a detection mechanism that public enforcement lacked, and fee shifting supplied the means for consumers with modest losses to obtain counsel. Litigation therefore developed along two tracks. One track concerned the merits, including negligence, willfulness, reasonable procedures, and causation. The other track concerned whether a federal court could hear the case at all, including whether a statutory violation, without a further showing of concrete harm, satisfied Article III of the Constitution. Between 2007 and 2021 the Supreme Court decided three cases that defined those tracks, and the third case, decided on June 25, 2021, redrew the boundary between a statutory violation and a federal lawsuit.

The first tier of the private remedy addressed negligent noncompliance. Under 15 U.S.C. section 1681o, a person who was negligent in failing to comply with any requirement of the Act with respect to a consumer was liable for actual damages sustained as a result of the failure, together with costs and reasonable attorney fees in a successful action. The structure contained no statutory damages and no punitive damages. A plaintiff proceeding on negligence alone therefore had to prove a real loss and connect that loss to the violation. Denied credit, a lost apartment, a withdrawn job offer, higher interest charges, dispute expenses, and compensable emotional distress all appeared in the case law as forms of actual damage, but each form required evidence rather than inference from an error alone. A report could be wrong and a claim could nevertheless fail, because section 1681o compensated damage caused by the failure rather than inaccuracy in the abstract.

The second tier addressed willful noncompliance, and the difference in remedy changed the economics of litigation. Under 15 U.S.C. section 1681n, a person who willfully failed to comply with any requirement of the Act with respect to a consumer was liable for actual damages or statutory damages of not less than 100 dollars and not more than 1,000 dollars, as the consumer elected, together with punitive damages as the court allowed and, in a successful action, costs and reasonable attorney fees. Statutory damages removed the need to quantify a loss in every case, and punitive damages added a deterrent element that negligence liability lacked. Aggregated across a certified class, the statutory range produced exposure bearing little relation to the loss of any single member, a feature that explained both the attraction of willful claims to class counsel and the intensity of corporate resistance to certification.

The Supreme Court defined willfulness in Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007). The consolidated litigation concerned adverse action notices after insurance underwriting based in part on credit information, and the insurers argued that willful failure reached only a knowing violation. The Court rejected that reading on June 4, 2007, and held that willfulness under section 1681n encompassed reckless disregard of a statutory duty as well as knowing violation. Recklessness, in the formulation adopted in 2007, was an objective inquiry. A defendant acted recklessly when an adopted reading of the statute was objectively unreasonable and ran a risk of violating the law substantially greater than the risk associated with a merely careless reading. The Court applied that standard to Safeco, whose interpretation lacked appellate precedent or authoritative agency guidance against the interpretation at the time of the conduct in question.

The Safeco decision of 2007 therefore cut in two directions. Plaintiffs gained a standard broader than knowledge, and a company that adopted an interpretation no reasonable reader could defend faced statutory and punitive exposure without proof that executives intended to break the law. Defendants gained an objective reasonableness shelter that rewarded documented legal analysis and attention to appellate decisions and agency guidance. Litigation after 2007 frequently turned on the state of authority at the time of the challenged conduct. Willfulness became a question about institutional knowledge and choice rather than a question about a single employee and a single file.

Beneath the willfulness dispute lay a persistent problem in accuracy litigation, arising from the wording of the underlying duty. Section 1681e(b) provided that whenever a consumer reporting agency prepared a consumer report, the agency was to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual to whom the report related. The operative obligation attached to procedures. The provision imposed no strict liability for every inaccurate report, and maximum possible accuracy operated inside a reasonableness standard rather than as a guarantee of a flawless file. A plaintiff alleging a violation of section 1681e(b) therefore had to establish more than an error. Lower court litigation organized the inquiry around an inaccurate report, procedures falling below a reasonable standard, causation, and damages, with a related and independent inquiry under section 1681i into whether a reinvestigation after a consumer dispute met a reasonableness standard. An agency could defend by showing that a procedure represented a reasonable balance of accuracy, cost, speed, and source reliability, even though the procedure produced a wrong result in an individual case.

Causation narrowed accuracy claims further, and many claims failed at that element rather than at the existence of an error. A consumer denied credit after delivery of a report containing an inaccuracy had to connect the denial to the inaccuracy, and evidence that a creditor relied on income, collateral, a different delinquency, or an independent factor could break that connection. Reinvestigation claims presented a parallel structure. The question under section 1681i concerned the reasonableness of the inquiry after notice, and a plaintiff had to show that a reasonable reinvestigation would have produced a different result, a showing dependent on the dispute notice, the documentation supplied, the furnisher response, and the material available within the statutory period.

Errors persisted inside systems that a court could describe as compliant, for structural reasons. Consumer reporting operated at a scale at which small error rates generated large absolute numbers of affected files. Furnishers submitted data in volume and in standardized formats, public records arrived from thousands of courts and recorders with inconsistent identifiers, and matching logic had to decide how much identifying information sufficed before two records belonged to the same person. A matching rule demanding extensive corroboration reduced false matches and increased missed matches, and a looser rule captured more complete files at the price of more mixed files, so every threshold embodied a tradeoff. Section 1681e(b) tolerated that reality by regulating procedure, and the tolerance left a residue of uncompensated errors. A consumer could bear an error, dispute the error, and obtain a correction, and recover nothing, because the procedure was reasonable or because no decision maker acted on the error before correction.

The standing dispute reached the Supreme Court in a case about a people search engine rather than a traditional credit bureau. In Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), Thomas Robins alleged that a Spokeo profile contained false statements about marital status, age, parenthood, affluence, employment, and education, and that Spokeo had willfully failed to follow required procedures. The United States Court of Appeals for the Ninth Circuit treated the alleged violation of a statutory right personal to Robins as sufficient for injury in fact. The Supreme Court vacated that judgment on May 16, 2016, by a vote of six to two, in an opinion by Justice Alito. The Court held that the Ninth Circuit analysis had addressed particularization without separately addressing concreteness, and that injury in fact required an injury both concrete and particularized. Particularization meant that the injury affected the plaintiff in a personal and individual way. Concreteness meant that the injury was real rather than abstract, and concreteness did not collapse into particularization merely because a statute granted a right to the plaintiff and authorized suit for a violation of that right.

The 2016 Spokeo reasoning contained allowances that plaintiffs emphasized between 2016 and 2021, alongside the limitation that defendants emphasized. An intangible injury could be concrete. A risk of real harm could satisfy concreteness in an appropriate case. At the same time, the Court stated that a bare procedural violation, divorced from any concrete harm, did not automatically satisfy the injury in fact requirement, and the opinion offered an incorrect zip code in a report, without more, as an example of an inaccuracy unlikely to cause harm or present a material risk of harm. Critically, the Court in 2016 issued no final ruling on whether Robins had standing. The judgment vacated the Ninth Circuit decision and remanded the case for an analysis separating the two elements.

TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), supplied the application that Spokeo had withheld, on facts presenting the dissemination question in a stark form. Beginning in 2002, TransUnion offered an add on product that compared the first and last name of a consumer against a list maintained by the Office of Foreign Assets Control within the United States Department of the Treasury, a list of persons designated as terrorists, drug traffickers, and other serious criminals with whom transactions were generally prohibited. When a first and last name matched, TransUnion placed an alert on the report indicating a potential match, and the matching process described in the 2021 opinions used no additional identifying information to test the match. Sergio Ramirez encountered the consequence in February 2011, when a car dealership ran a credit check for a purchase by Ramirez and his wife, received a report carrying the alert, and declined to complete the sale to Ramirez after identifying Ramirez as a person on a terrorist list. Ramirez requested his file, received mailings that omitted any mention of the alert from the report copy and presented alert information in a separate mailing without a summary of rights, and sued on behalf of a class.

The district court certified a class of 8,185 consumers who had received a mailing identifying each consumer as a potential match, and a jury returned a verdict for the class on willful noncompliance claims exceeding 60 million dollars in statutory and punitive damages combined. The Ninth Circuit in 2020 affirmed the judgment in relevant part and reduced the punitive component, holding that each class member had standing based on the risk to privacy, reputational, and informational interests protected by the Act, even though reports for most members had gone to no third party. The record before the Supreme Court divided the class with precision. TransUnion had provided reports containing the alert to third party businesses for 1,853 class members. Reports for the remaining 6,332 class members had not been provided to a potential creditor during the class period, and the alert for each member of the second group rested in a file that no outside decision maker had received. Ramirez belonged to the first group, because the dealership had received his report and acted on the alert.

What did TransUnion v. Ramirez hold?

The Supreme Court held on June 25, 2021, that only class members whose misleading reports TransUnion sent to third parties suffered concrete harm under Article III. The remaining class members, whose files contained the alert without dissemination, lacked standing to recover damages in federal court.

Justice Kavanaugh wrote the majority opinion in the 2021 decision, and the Court divided five to four. The majority reasoned that Article III required a plaintiff seeking damages from a private defendant in federal court to show a concrete injury, traceable to the defendant and redressable by the court, and that a statutory cause of action supplied an input into concreteness rather than a substitute for concreteness. The majority tested asserted intangible harm by asking whether the harm bore a close relationship to a harm traditionally recognized as a basis for suit in American courts. Publication of a misleading report to a third party satisfied that test through a close relationship to the reputational harm associated with defamation, a tort built on false statements communicated to another person. The 1,853 class members whose reports went to third party businesses therefore had standing on the reasonable procedures claim, and Ramirez, whose report went to a dealership that refused to sell to Ramirez, stood at the center of that group.

The remainder of the class failed the same test in the majority analysis, because the defining event of the analogous harm had not occurred. A misleading alert in an undisseminated file resembled, in the analogy used by the majority, an insulting letter written and held without sending, language capturing the distinction between creation of false material and communication of false material to a person who could act on the material. The majority acknowledged that a risk of future harm could support standing in an appropriate posture, including a suit for injunctive relief when a threatened injury met the governing standard, but concluded that a risk that had not materialized did not supply concrete harm for a retrospective damages claim on the 2021 record. An alert in a database, without publication and without a materialized or sufficiently imminent consequence, counted in the majority reasoning as a statutory problem rather than a concrete injury to the individual consumer.

The 2021 decision extended the same logic to class procedure and to the two mailing claims in the case. A class action did not relax Article III, and every class member seeking individual damages in federal court had to demonstrate standing under the majority standard, rather than borrowing standing from the named plaintiff or from the most seriously affected members. Ramirez had testified about the dealership encounter and about receipt of the two mailings connected to a request for a file, and the majority treated Ramirez as a plaintiff with standing on the disclosure and summary of rights claims arising from those mailings. No other class member had shown a consequence from a mailing, and no other member had shown that a mailing had even been opened, on the trial record described in the 2021 opinions. The class wide damages judgment therefore could not stand on the foundation presented, and the Court reversed the Ninth Circuit judgment and remanded the case for further proceedings, including reconsideration of class certification in light of the standing conclusions.

Justice Thomas wrote the principal dissent, joined by Justice Breyer, Justice Sotomayor, and Justice Kagan. The dissent reasoned from a different account of the relationship between a legal right and an injury. In the historical practice described by Justice Thomas, violation of a private right created by law supplied an injury in law sufficient for suit, without a further judicial inquiry into whether the violation resembled a common law harm closely enough to merit federal attention. Each class member held a statutory right to reasonable procedures for maximum possible accuracy, each member had a file bearing a false alert produced under the challenged practice, and that combination, in the dissent analysis, established injury for every member regardless of dissemination. Justice Thomas objected that the majority had assigned courts a power to weigh harms and decide which legislatively recognized harms deserved a federal forum, and the dissent treated that assignment as a departure from the judicial role and from congressional authority to define and protect private rights.

Dated consequences followed after June 25, 2021, and litigation practice adjusted to the division the Court had drawn. Large federal classes built on undisseminated inaccuracies lost viability in the form presented in Ramirez, because a class combining disseminated and undisseminated files invited a standing attack severing most members before a merits inquiry into procedures began. Complaint drafting after the 2021 decision placed greater weight on identifying dissemination, identifying the recipient, alleging reliance or another consequence, and separating subclasses by the use made of a report, while defendants placed greater weight on file level records showing whether a report had left the bureau.

Pressure toward state courts formed a second consequence identified in the 2021 litigation itself. Justice Thomas warned in dissent that the decision could prove a pyrrhic victory for TransUnion, because a holding that federal courts lacked jurisdiction over a category of statutory claims did not prohibit Congress from creating the underlying rights and did not bind state courts to Article III limits when state courts addressed federal law. State standing doctrine varied by jurisdiction, and a defendant sued in a permissive state forum could face a removal problem once a federal court, applying Ramirez, questioned federal jurisdiction over the claims the defendant sought to move. Plaintiffs after June 25, 2021, therefore evaluated state filing and state credit reporting statutes alongside a federal claim, and defendants evaluated whether removal improved or destroyed the forum.

Andrew J. Pincus, Archis A. Parasharami, and Daniel Jones of Mayer Brown, writing in an analysis carried by the United States Chamber of Commerce in 2021, described the decision as a serious blow to abusive no injury class actions and treated the reasoning as a broad constraint on damages classes assembled from technical violations without actual harm to most members. The Chamber of Commerce had warned in an amicus filing that a contrary rule would supply a road map for converting an individualized dispute involving a sympathetic plaintiff into a multimillion dollar class action, and that businesses would face massive suits over technical violations causing no actual harm to most of a class.

Chi Chi Wu of the National Consumer Law Center presented the opposing consumer reading in testimony before the House Financial Services Committee on June 29, 2021, four days after the decision. Wu argued, in substance, that a rule requiring disclosure to a third party forced a consumer who discovered a blatant and offensive error to wait until a creditor, an employer, or a landlord received the error and judged the consumer on false information before the consumer could seek redress in federal court for damages.

The distinction between a statutory violation and a federal case became the durable doctrinal product of the sequence running from Safeco in 2007 through Spokeo in 2016 to TransUnion in 2021. Safeco governed culpability for enhanced damages and asked whether a defendant acted with knowledge or reckless disregard under an objective standard. Sections 1681e(b) and 1681i governed the reasonableness of procedures and reinvestigations. Spokeo and TransUnion governed the courthouse door and asked whether the particular plaintiff, and after June 25, 2021, each class member seeking damages, had suffered a concrete injury a federal court could hear. A defendant could violate the Act and escape a federal damages judgment because a plaintiff lacked standing, and a defendant could face a federal judgment without any dispute about standing when a misleading report reached a lender, an employer, or a landlord and produced a denial. A name only matching practice that labeled thousands of consumers as potential matches to terrorists and drug traffickers produced a ruling on jurisdiction without a Supreme Court ruling on whether the practice satisfied the reasonable procedures standard, and the consumers with the clearest jurisdictional path were the consumers to whom the false statement had already been published.

Enforcement, Error Rates, and What the Statute Did Not Do

A statute that regulates an industry built on files about other people lives or dies in its enforcement design, and the Fair Credit Reporting Act spread enforcement across more hands than most consumer statutes of its generation. No single agency owned the Act in 1970. The Federal Trade Commission received the central administrative role, the federal banking agencies policed the institutions each agency supervised, state officials received a defined enforcement lane, and consumers received private rights of action for negligent and willful violations under sections 1681n and 1681o. That dispersal matched the structure of the credit industry itself, in which bureaus, lenders, insurers, employers, and debt collectors each held a piece of the reporting system, and dispersal produced enforcement in episodes, with the accuracy of the files themselves unmeasured by any regulator for long stretches of time.

The Federal Trade Commission began enforcing the Act when the statute took effect in April 1971, and for forty years the Commission functioned as the closest institution the reporting system had to a general overseer. The Commission brought administrative and federal court actions against bureaus and users, policed the Act against the large class of companies that no banking agency supervised, and produced consent orders against the major nationwide bureaus over accuracy, dispute handling, and impermissible furnishing. The limits of that role were structural. The Commission lacked general rulemaking power under the Act for much of the period, supervised no bureau through regular examination, and depended on complaints and investigations to learn what routine examination might have shown. Enforcement therefore tended to follow scandal, litigation, or congressional pressure rather than a standing supervisory calendar.

Private litigation filled part of that gap, and its shape followed the text. A consumer suing under section 1681n for a willful violation could seek actual damages or statutory damages, punitive damages, and attorney fees, while section 1681o supplied actual damages and fees for negligent noncompliance. The same text, however, rationed the private remedy. Furnisher duties under section 1681s-2(a), covering the basic obligation to furnish accurate information and to correct information found incomplete or inaccurate, carried no private action at all under subsections (c) and (d) of that section, which reserved enforcement to federal agencies and state officials. A private claim against a furnisher existed only under section 1681s-2(b), and only after a bureau had notified the furnisher of a consumer dispute. Bureau conduct therefore faced consumer suits from the start, while the companies that supplied most of the underlying data faced private suits only through the dispute doorway.

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 redrew the map on the designated transfer date, July 21, 2011. On that date, general rulemaking authority under the Act moved from the Federal Trade Commission and the banking agencies to the Consumer Financial Protection Bureau, and the Bureau republished the implementing rules as Regulation V. The transfer was not total. The Commission retained enforcement authority over most nonbank actors within its jurisdiction, and rulemaking for the identity theft red flags requirement under section 615(e) and the disposal requirement under section 628 stayed with the Commission, the banking agencies, and the securities regulators. Enforcement after 2011 therefore became shared in a deliberate sense. The Bureau wrote the rules and enforced them against the largest banks and against nonbanks within its authority, the Commission enforced against the broad nonbank market, the banking agencies retained authority over supervised institutions, and state attorneys general held an enforcement role under section 1681s of the Act.

Supervision changed more than rulemaking did. Before Dodd-Frank, no federal agency examined the nationwide bureaus as a matter of routine; regulators arrived after a problem surfaced. The Bureau closed that gap through its larger participant authority, and the account of how the CFPB was created and empowered explains the grant that made the step possible. In July 2012 the Bureau finalized the first larger participant rule, covering the consumer reporting market, effective September 30, 2012. The rule, codified at 12 CFR Part 1090, defined a larger participant as a nonbank consumer reporting company with more than seven million dollars in annual receipts from consumer reporting, a threshold the Bureau estimated would cover about thirty companies accounting for about ninety four percent of industry receipts. Examination followed, directed at accuracy, dispute handling, disclosures, and the screening of furnishers. For the first time since 1970, the largest bureaus answered to examiners on a cycle rather than to investigators after the fact.

State enforcement operated inside that federal frame rather than beside it. Section 1681s authorized state attorneys general to bring actions in federal court to enforce the Act, subject to notice to the federal regulators and to limits where a federal action was pending. State officials used the lane in multistate investigations, and the largest of those efforts, the 2015 multistate settlement led by Ohio Attorney General Mike DeWine with thirty other attorneys general, committed the three nationwide bureaus to reforms in dispute handling and medical debt reporting, together with a payment of six million dollars to the states. Attorneys general could extract operational commitments through enforcement and negotiation, while the substantive law of credit reporting remained overwhelmingly federal for reasons the preemption provision supplied.

Section 1681t contains the strongest preemption provision in the consumer credit cluster, stronger than the displacement language in the Truth in Lending Act or the Equal Credit Opportunity Act. Subsection (a) states the mild general rule, under which state law on the collection, distribution, or use of consumer information, or on the prevention or mitigation of identity theft, survives except to the extent of any inconsistency with the federal text. Subsection (b) then displaces that generosity across most of the field by providing that no requirement or prohibition may be imposed under state law with respect to enumerated subject matter. The broader contest over federal versus state consumer protection law runs through many statutes, but in credit reporting Congress resolved the contest further toward uniformity than in any neighboring field, and the Fair and Accurate Credit Transactions Act of 2003 made the displacement permanent after the 1996 amendments had set the expanded preemption on a schedule to expire in 2004.

The enumerated subjects in section 1681t(b)(1) cover prescreening, the time within which a bureau must act on a dispute, adverse action duties, firm offers of credit or insurance, the information that may appear in a report under section 1681c, furnisher responsibilities under section 1681s-2, records for identity theft victims, affiliate sharing for marketing, and risk based pricing notices. Section 1681t(b)(2) separately preempts state law on information exchange among affiliates, and section 1681t(b)(3) preempts state law on the content of disclosures owed under section 1681g. Two qualifications soften the edges without changing the center. Several paragraphs grandfather state laws in effect on September 30, 1996, and named provisions received express preservation, among them the Massachusetts and California furnisher provisions in section 1681t(b)(1)(F) and the Vermont affiliate sharing provision in section 1681t(b)(2).

The exceptions in the identity theft and free report areas follow the same drafting method of general displacement and named preservation. Section 1681t(b)(5), added by the 2003 Act, preempts any state requirement or prohibition with respect to the conduct required by nine listed federal provisions, a set that includes card number truncation under section 1681c(g), fraud alerts under section 1681c-1, identity theft blocks under section 1681c-2, the free annual disclosure duty under section 1681j(a), and the disposal rule under section 1681w. On free reports, section 1681t(b)(4) preempts state law on the frequency of disclosure under section 1681j(a) while expressly preserving the statutes of seven named states, Colorado, Georgia, Maine, Maryland, Massachusetts, New Jersey, and Vermont, as those statutes stood on December 4, 2003. Section 1681t(b)(3) likewise preserves specified California and Colorado disclosure statutes and leaves state regulation of credit based insurance scores untouched. Congress preempted the subject, then saved a short list of state laws by citation, freezing the saved versions at a stated date.

The trade off inside that design drew named defenses and named objections. Stuart Pratt, president of the Consumer Data Industry Association, testified to the Senate Committee on Banking, Housing, and Urban Affairs in December 2012 that a national reporting system required uniform national standards, and the industry association treated preemption as the condition that allowed one file format, one dispute clock, and one set of furnisher duties to operate across state lines. Edmund Mierzwinski of U.S. PIRG, a coauthor of the 2004 PIRG survey discussed below, argued the opposite position, namely that states had led credit reporting reform before Congress acted, that Vermont in 1992 had enacted the first free annual report law, and that permanent preemption in 2003 cut off the laboratory that produced the federal reforms. Both accounts identify a real effect. Uniformity lowered compliance friction for a genuinely national system, and the same uniformity functioned as a ceiling as well as a floor, because a state that wished to require more than the federal text on a preempted subject lacked the power to do so after 2003.

How common are errors on credit reports?

Estimates depend on the definition and the method. The Federal Trade Commission study released in 2013 found that one in five consumers had an error corrected on at least one report. The Policy and Economic Research Council study of 2011 found that fewer than one percent of reports produced a correction large enough to change a pricing tier.

The strongest federal evidence came from the Federal Trade Commission report to Congress under section 319 of the Fair and Accurate Credit Transactions Act, dated December 2012 and released publicly in February 2013. The Commission recruited 1,001 participants, and study associates helped each participant review a total of 2,968 reports from the three nationwide bureaus and dispute information through the statutory process. Twenty six percent of participants identified at least one potential error, one in five participants had an error that a bureau corrected after dispute on at least one of the three reports, and slightly more than one in ten saw a credit score change after correction. The finding with the clearest economic meaning concerned five percent of participants, about one in twenty, whose maximum score change exceeded twenty five points, a group the Commission described as likely to have paid more for credit or insurance because of the error.

The industry commissioned evidence reached a much lower figure through a different instrument. Michael Turner, Robin Varghese, and Patrick Walker of the Policy and Economic Research Council published U.S. Consumer Credit Reports: Measuring Accuracy and Dispute Impacts in May 2011. Stuart Pratt of the Consumer Data Industry Association testified in December 2012 that the association members had provided a grant to fund the PERC research, and the study examined reports at the level of the individual report rather than the individual consumer. On that basis, PERC found that 0.93 percent of all reports examined produced a dispute outcome that raised a credit score by twenty five points or more, and that one half of one percent of reports produced a score change that moved the consumer into a pricing tier associated with a lower priced product. The distance between one in twenty consumers and one half of one percent of reports is therefore partly a distance between denominators, since a consumer holds three reports and a per report rate divides the same underlying errors across a base three times larger.

The highest figure in the record came from the consumer advocacy side and from an earlier, looser method. U.S. PIRG, the federation of state Public Interest Research Groups, published Mistakes Do Happen: The Continuing Problem of Inaccurate Credit Reports in 2004, written by Alison Cassady, Edmund Mierzwinski, and Deirdre Cummings. Adults in thirty states ordered reports and completed a detailed survey about accuracy, a design that recorded what consumers judged to be errors without routing each claim through the dispute process or testing the effect on a score. Twenty five percent of the reports surveyed contained serious errors that could result in the denial of credit, in the authors classification, such as false delinquencies or accounts that did not belong to the consumer, and fifty four percent contained personal demographic information that was misspelled, outdated, or belonged to a stranger. Because the survey counted consumer allegations rather than verified corrections, the PIRG figure and the Commission figure do not measure the same event, even where the two are quoted side by side as rival answers to a single question.

The methodological dispute is the finding, and an honest account has to hold the three studies apart by design before comparing any numbers. The Commission study verified errors through the dispute process itself and measured score effects with rescoring by Fair Isaac, which made its confirmed errors a conservative count, since an error a consumer failed to spot or a bureau refused to change never entered the numerator. The PERC study also used disputes, but defined materiality through score movement thresholds and reported results per report, which compressed the headline rate. The broader record on what consumer credit law changed shows the same pattern in other fields, where the measured size of a problem follows the instrument chosen to measure it. On the narrowest verified measure, material errors were rare per report. On the consumer level measure, one in five consumers carried at least one corrected error. Both statements are supported, and neither licenses a single error rate for the system.

A counter reading of the enforcement record begins with the commercial position of the bureaus. A bureau sells reports to furnishers and users, and the consumer described in a report is the subject of the transaction rather than a party to it, a structural point that Edmund Mierzwinski and U.S. PIRG pressed in the 2004 survey and in testimony across the following decade. On that reading, accuracy spending by a bureau competes with the demands of the customers who pay, namely lenders that prize speed, volume, and predictive value, and a bureau that invested heavily in verification would raise costs for buyers who rarely observe the harm an error causes to a stranger. The industry answer, stated by Stuart Pratt for the Consumer Data Industry Association in the December 2012 Senate testimony, held that accuracy was the product, since a report that mispriced risk injured the lender as well as the consumer, and that the dispute system corrected the great majority of genuine errors brought to a bureau attention. The two readings disagree about incentives, and the enforcement history supports elements of each, since bureaus corrected most disputed items in the Commission study while many disputing consumers identified errors the process left unresolved.

Measured effects, stated without the rival framings, reduce to three. The Act normalized file access, converting a closed trade ledger into a document the subject could obtain, read, and challenge, and the free annual disclosure added by the 2003 Act made that access routine rather than exceptional. The dispute right became the main consumer lever in the system, because reinvestigation under section 1681i forced a bureau to recheck information and delete material that could not be verified, and because the furnisher duties of section 1681s-2(b) switched on only after a dispute traveled through a bureau. Preemption delivered national uniformity in the subjects it covered, sparing furnishers and bureaus fifty variations of the core duties, at the price identified by Mierzwinski of ending state experimentation in those subjects after 2003. Each effect is a change in procedure and access rather than a guaranteed change in outcome, and that distinction organizes the honest account of the limits that follows.

The statute did not guarantee an accurate file. The operative bureau duty under section 1681e(b) is to follow reasonable procedures to assure maximum possible accuracy, a standard of process rather than a warranty of result. A consumer could therefore hold a file that complied with the Act at every procedural step and contained a damaging error, with a remedy that depended on spotting the error and disputing the item. The statute also created no general privacy right over financial data. The permissible purpose list in section 1681b defines the gates through which a report may pass, and includes broad categories such as a legitimate business need in connection with a transaction the consumer initiated, account review, and employment screening with consent. Within those gates a consumer holds no general right to stop the circulation of accurate information, no right to delete accurate adverse information before the obsolescence periods of section 1681c expire, and no opt out from prescreened offers beyond the specific opt out the statute provides.

Two further limits concern the reach of the consumer remedy and the durability of a correction. Congress withheld any private action for the core furnisher accuracy duties in section 1681s-2(a), leaving those duties to agencies whose enforcement resources never matched the volume of furnished data, so a furnisher that reported carelessly in the first instance faced a consumer suit only if the consumer disputed through a bureau and the furnisher then mishandled the investigation. A successful dispute, in turn, did not prevent recurrence. A furnisher could report the same erroneous tradeline again in a later cycle, and the reinsertion safeguards of section 1681i(a)(5) imposed notice duties without eliminating the underlying flow. The Commission follow up study of January 2015 gives that limit a measured form. Among 121 consumers from the 2012 study who had at least one unresolved dispute and who joined the follow up, nearly seventy percent continued to believe that disputed information was inaccurate, and half of that group planned to abandon the dispute. The dispute lever worked, and the follow up records a substantial minority for whom working the lever did not settle the file.

The closing assessment is therefore one of procedural transformation inside defined boundaries. Between 1971 and the Bureau supervision that began in 2012, the Act converted credit reporting from a confidential trade practice into a regulated system with disclosure rights, a dispute process, furnisher duties, agency rulemaking, examinations of the largest bureaus, and private damages actions. The same statute left accuracy as a procedural standard, left privacy as a set of gates rather than a general right, left the first instance furnisher duties beyond private suit, and froze most state law in the field at the positions of 1996 and 2003. Readers tracing the consequences will find the institutional half of the story in the profile of the Bureau creation, the federalism half in the comparison of federal and state consumer protection, and the empirical half in the assessment of consumer credit law effects, each of which takes up a thread that the Act left unfinished.

The statute rewards slow reading because its duties sit in separate subsections that assign separate tasks to separate actors, and a dispute about one duty rarely resolves a dispute about another. A reader building a durable record of the scheme does well to track each amendment beside the subsection it altered, each leading case beside the duty it construed, and each enforcement action beside the practice it corrected. That record also makes comparison possible across neighboring consumer credit statutes, where Congress chose different balances among accuracy, access, and private enforcement. For readers who want one place to organize that material, keep your statute notes, citations, and case chronologies together free on VaultBook offers a dedicated home for the working papers behind serious statutory study. Kept in that form, the chronology of enactments, the growth of furnisher duties, the prescreening and freeze provisions, and the standing decisions form one continuous account rather than a set of fragments scattered across separate files and folders.

Frequently Asked Questions

Q: What does Fair Credit Reporting require?

The Fair Credit Reporting Act requires consumer reporting agencies to follow reasonable procedures to assure maximum possible accuracy, to furnish reports only for permissible purposes, to disclose file contents to the consumer the file describes, and to reinvestigate disputed information within the statutory period. Furnishers must supply accurate information and investigate disputes forwarded by a bureau. Users of reports must certify a permissible purpose, give standalone disclosure and obtain written authorization for employment screening, and send adverse action notices after a report contributes to a denial. The statute enforces those duties through agency supervision and through private actions for negligent and willful noncompliance.

Q: Who may see your report under Fair Credit Reporting?

A consumer report may go only to a person with a permissible purpose under section 1681b. The listed purposes include use in connection with a credit transaction, employment purposes, insurance underwriting, eligibility for a government license or benefit, a legitimate business need tied to a transaction the consumer initiated, a court order, and the written instruction of the consumer the report describes. A reporting agency must obtain certifications of purpose from report users and must refuse furnishing where no listed purpose exists. Furnishing a report outside the listed purposes exposes the agency and the user to liability for negligent or willful noncompliance.

Q: How long do negative items stay under Fair Credit Reporting?

Section 1681c bars a consumer report from containing specified adverse items after fixed periods. Most delinquencies, collections, charged off accounts, suits, judgments, and arrest records fall away seven years after the relevant event. Bankruptcy cases may remain for ten years. The seven year period for a delinquent account runs from the first missed payment that led to the delinquency, and later activity on the account does not restart that clock. Certain high income employment and large credit or insurance transactions fall outside the obsolescence limits under statutory exceptions. Tax liens paid and released follow the seven year rule measured from the date of payment.

Q: How do you dispute an error under Fair Credit Reporting?

The dispute process begins when a consumer notifies a reporting agency that information in the file is inaccurate or incomplete. Under section 1681i the agency must conduct a reasonable reinvestigation, generally within thirty days, must forward the dispute and all relevant information to the furnisher, and must notify the consumer of the result. Information that cannot be verified must be deleted or modified. The consumer may add a brief statement to the file, and the agency must send corrected reports to designated recipients. A furnisher that receives notice from the agency carries a parallel duty to investigate under section 1681s-2(b).

Q: Is Fair Credit Reporting the first federal privacy law?

Yes, in the sense that the Fair Credit Reporting Act was the first federal statute to impose a code of fair information practice on private holders of personal records. Enacted in 1970 and effective in 1971, the Act gave individuals rights of access to a commercial file, rights to learn the sources and recipients of reports, and rights to dispute and correct inaccurate material. The Privacy Act, which imposed a parallel code on federal agencies as record keepers, arrived in 1974, four years after Congress had already regulated private credit bureaus. The sequence places commercial credit files at the opening of federal privacy legislation.

Q: What did TransUnion v. Ramirez decide about Fair Credit Reporting?

In TransUnion v. Ramirez, decided in 2021, the Supreme Court held that only class members whose misleading terrorist database alerts had been disseminated to third parties suffered a concrete injury sufficient for Article III standing. Sergio Ramirez, whose alert reached a car dealer, could recover, along with the 1,853 class members whose reports were sent to potential creditors. The remaining 6,332 class members, whose files carried the same notation but were never furnished to anyone, lacked standing to pursue damages in federal court. The decision separated the existence of a statutory violation from the existence of an injury that a federal court may remedy.

Q: Do you have a right to an accurate report under Fair Credit Reporting?

The statute gives a consumer a right to a report prepared with reasonable procedures to assure maximum possible accuracy, a standard codified at section 1681e(b). The right is procedural rather than a guarantee that no error will ever appear. A consumer who proves that a bureau failed to follow reasonable procedures and that the failure produced an inaccurate report may recover actual damages for negligent noncompliance under section 1681o, and statutory or punitive damages for willful noncompliance under section 1681n. Courts judge the reasonableness of the procedure against the risk of inaccuracy and the burden of a more protective method.

Q: Where did free annual reports come from in Fair Credit Reporting?

Free annual file disclosures entered the statute through the Fair and Accurate Credit Transactions Act of 2003, which amended section 1681j. That amendment entitled a consumer to one free disclosure of file contents from each nationwide reporting agency during every twelve month period, obtained through a centralized source established for that purpose. The centralized source operates as AnnualCreditReport.com, with parallel telephone and mail channels. Earlier law had provided free disclosures only in narrower circumstances, such as after an adverse action, after placement of a fraud alert, or for a consumer who was unemployed, receiving public assistance, or disputing inaccurate information.

Q: What counts as a permissible purpose for pulling a consumer report?

Section 1681b lists the purposes for which a reporting agency may furnish a consumer report. A report may be furnished in response to a court order, in accordance with the written instructions of the consumer, for a credit transaction involving the consumer, for employment purposes, for insurance underwriting, for a determination of eligibility for a government license or benefit, for a valuation or servicing of an existing account, and for a legitimate business need connected with a business transaction the consumer initiated. A purpose outside the list, such as general curiosity about a neighbor or a marketing inquiry without a firm offer, falls outside the statute.

Q: What damages can a consumer recover for a willful violation of the Fair Credit Reporting Act?

Section 1681n provides the remedies for willful noncompliance. A successful plaintiff may recover actual damages or statutory damages between 100 dollars and 1,000 dollars per violation, whichever the court or jury awards within that framework, together with punitive damages in an amount the court allows and reasonable attorney fees and costs. The Supreme Court in Safeco Insurance Co. of America v. Burr read willfulness to include reckless disregard of a statutory duty, judged under an objective standard. Willfulness does not require proof that the defendant knew the conduct violated the Act, only that the defendant ran an unjustifiably high risk of violating a known or obvious legal duty.

Q: What did Spokeo v. Robins decide about standing to sue over a credit report?

In Spokeo, Inc. v. Robins, decided in 2016, the Supreme Court held that a plaintiff suing in federal court must show an injury that is both concrete and particularized, and that a bare procedural violation of the Fair Credit Reporting Act, divorced from concrete harm, does not by itself satisfy Article III. The Court accepted that intangible harms can qualify as concrete, and that Congress may identify and elevate harms that courts then recognize. Because the Ninth Circuit had analyzed particularization without separately analyzing concreteness, the Court vacated the judgment and remanded for the concrete harm inquiry to be completed.

Q: How does a security freeze differ from a fraud alert under the Fair Credit Reporting Act?

A security freeze restricts access to a consumer report itself. While a freeze is in place, a reporting agency generally may not release the report without the consumer authorization, and the consumer lifts or removes the freeze with a password or personal identification number. Federal law made freezes free nationwide in 2018. A fraud alert works differently. An alert is a notice placed in the file that tells a prospective user to take reasonable steps to verify identity before granting credit. An initial alert lasts one year, and an extended alert for a victim of identity theft with a qualifying report lasts seven years.

Q: What must an employer do before using a credit report to reject an applicant?

Section 1681b(b) conditions employment use of a consumer report on a sequence of steps. Before procuring the report, the employer must give the applicant a clear and conspicuous written disclosure, in a document that consists solely of the disclosure, and must obtain written authorization. Before taking adverse action based in whole or in part on the report, the employer must give the applicant a copy of the report and a summary of rights under the Act, and must allow a reasonable interval for response. After adverse action, the employer must give notice identifying the reporting agency, stating that the agency did not make the decision, and describing the rights to a free report and to dispute accuracy.

Q: What duties does a furnisher have after a consumer disputes information it reported?

A furnisher duty that a consumer may enforce arises under section 1681s-2(b) after a reporting agency notifies the furnisher of a dispute. The furnisher must conduct an investigation, review all relevant information the agency provided, complete the investigation within the period allowed for the agency reinvestigation, and report the results to the agency. Where the investigation finds information incomplete or inaccurate, the furnisher must report that conclusion to other agencies that received the information and must modify, delete, or permanently block reporting of the item. A furnisher may decline to investigate a dispute that the agency reasonably classifies as frivolous or irrelevant under the statutory standard.

Q: Does the Fair Credit Reporting Act preempt stronger state credit reporting laws?

Section 1681t preempts state requirements or prohibitions across much of the field the federal statute occupies, including prescreening, the timing and content of file disclosures in specified respects, duties of furnishers and users, and the obsolescence rules, subject to statutory exceptions for certain named state laws. The general saving clause preserves state law except to the extent of inconsistency, but the enumerated preemption provisions displace even stronger state rules within their listed subjects. The Fair and Accurate Credit Transactions Act of 2003 made the expanded preemption permanent. Outside the enumerated subjects, state law on subjects such as the conduct of investigations by state regulated entities may operate alongside the federal scheme.

Q: What is an investigative consumer report under the Fair Credit Reporting Act?

An investigative consumer report, defined at section 1681a(e), is a consumer report or a portion of a report in which information about character, general reputation, personal characteristics, or mode of living was obtained through personal interviews with neighbors, friends, associates, or acquaintances of the consumer, or with others who may have knowledge of those items. Section 1681d adds disclosure duties for such reports. A user that procures an investigative report must clearly disclose that fact in writing within three days after requesting the report, must advise the consumer of the right to request a complete disclosure of the nature and scope of the investigation, and must honor that request in writing within five days.

Q: What can a consumer see in a bureau file disclosure under the Fair Credit Reporting Act?

Section 1681g requires a reporting agency, upon request and proper identification, to disclose all information in the file at the time of the request, the sources of the information, and the identity of each person that procured a report for employment purposes during the preceding two years or for another permissible purpose during the preceding one year. The disclosure also covers companies that received reports, dates of inquiries in the statutory categories, and a record of certain inquiries connected with prescreened transactions. Truncated account numbers and similar security limits apply to the disclosure, and the agency must provide trained personnel to explain information in the file and a written summary of consumer rights with each disclosure.

Q: What are prescreened offers under the Fair Credit Reporting Act?

Prescreening is a practice in which a creditor or insurer obtains a list of consumers who meet selected criteria from a reporting agency and then extends a firm offer of credit or insurance to each consumer on the list. Section 1681b(c) permits furnishing of reports in connection with a credit or insurance transaction that the consumer did not initiate only where the transaction consists of a firm offer. The consumer receives the offer without having applied, and section 1681m requires clear and conspicuous notice with each solicitation that prescreening supplied the information, that the consumer may opt out, and that a toll free mechanism exists for opting out of prescreened lists maintained by the nationwide agencies.

Q: Which agencies enforce the Fair Credit Reporting Act?

Enforcement is divided among several authorities. The Consumer Financial Protection Bureau holds rulemaking authority and supervisory and enforcement power over larger reporting agencies and many furnishers and users. The Federal Trade Commission retains enforcement authority over much of the market outside the Bureau jurisdiction. Federal banking agencies enforce the Act against the financial institutions each agency supervises. Section 1681s also gives state officials, ordinarily a state attorney general, authority to bring an action on behalf of residents to enforce compliance, recover damages, and obtain costs, after giving notice to the federal enforcer. Private actions by consumers operate alongside every one of those public enforcement channels.

Q: Can a consumer sue a furnisher directly for reporting inaccurate information?

The answer turns on which furnisher duty the claim invokes. Section 1681s-2(a) imposes duties to furnish accurate information and to correct and update information, but Congress assigned enforcement of that subsection to government agencies and withheld a private right of action for its violation. A consumer therefore cannot sue a furnisher directly over the initial act of reporting inaccurate information. After the consumer disputes the item with a reporting agency and the agency notifies the furnisher, section 1681s-2(b) imposes an investigation duty that a consumer may enforce through a private action. That two step structure routes the private claim through the bureau dispute process before any suit against the furnisher becomes available.