Fair Credit and Reporting Act: Summaries of consumer rights and notices of duties,

[Federal Register: July 16, 2004 (Volume 69, Number 136)]

[Proposed Rules]

[Page 42616-42626]

From the Federal Register Online via GPO Access [wais.access.gpo.gov]

[DOCID:fr16jy04-13]

FEDERAL TRADE COMMISSION

16 CFR Part 698

RIN 3084-AA94

Summaries of Rights and Notices of Duties Under the Fair Credit Reporting Act

AGENCY: Federal Trade Commission.

ACTION: Publication of proposed guidance for forms, and request for public comment.

SUMMARY: The Federal Trade Commission (Commission) is publishing for public comment two summaries of rights under the Fair Credit Reporting Act (FCRA) and two notices of duties under the FCRA as required by FCRA Sections 609 and 607 respectively. Consumer reporting agencies (CRAs) will distribute these documents. The first summary is a summary of rights of identity theft victims required by Section 609(d) of the FCRA, which was added to the FCRA by the recently enacted Fair and Accurate Credit Transactions Act of 2003 (FACT Act). The Commission issued the other summary and the two notices in 1997 and is proposing revisions because of the extensive changes made to the FCRA in the FACT Act. These are a general summary of consumer rights under the FCRA, a notice of responsibilities under the FCRA of persons that furnish information to consumer reporting agencies, and a notice of responsibilities under the FCRA of persons that obtain consumer reports from consumer reporting agencies.

DATES: Written comments will be accepted until August 16, 2004.

ADDRESSES: Interested parties are invited to submit written comments. Comments should refer to ``FACTA Notices, Matter No. R411013'' to facilitate the organization of comments. A comment filed in paper form should include this reference both in the text and on the envelope, and should be mailed or delivered to the following address: Federal Trade Commission/Office of the Secretary, Room H-159 (Annex S), 600 Pennsylvania Avenue, NW., Washington, DC 20580. The Commission is requesting that any comment filed in paper form be sent by courier or overnight service, if possible, because postal mail in the Washington area and at the Commission is subject to delay due to heightened security precautions. Commenters seeking confidential treatment for any portion of their comments must file their comments in paper form. An electronic comment can be filed using e-mail at FCRAnotices@ftc.gov.

Comments on any proposed filing, recordkeeping, or disclosure requirements that are subject to paperwork burden review under the Paperwork Reduction Act should be submitted to: Office of Information and Regulatory Affairs, Office of Management and Budget, Attention: Desk Officer for Federal Trade Commission. Comments should be submitted via facsimile to (202) 395-6974 because postal mail at the Office of Management and Budget is subject to lengthy delays due to heightened security precautions. Such comments should also be sent to the following address: Federal Trade Commission/Office of the Secretary, Room H-159 (Annex S), 600 Pennsylvania Avenue, NW., Washington, DC 20580.

The Federal Trade Commission Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. All timely and responsive public comments, whether filed in paper or electronic form, will be considered by the Commission, and will be available to the public on the FTC Web site, to the extent practicable, at http://www.ftc.gov. As a matter of

discretion, the FTC makes every effort to remove home contact information for individuals from the public comments it receives before placing those comments on the FTC Web site. More information, including routine uses permitted by the Privacy Act, may be found in the FTC's privacy policy, at http://www.ftc.gov/ftc/privacy.htm.

FOR FURTHER INFORMATION CONTACT: For the summary of identity theft rights, contact Monique Einhorn, Attorney, Division of Planning and Information, Federal Trade Commission, 600 Pennsylvania Ave., NW., Washington, DC 20580, 202-326-3228; for the general summary of consumer rights and the furnisher and user notices, contact William Haynes, Attorney, Division of Financial Practices, Federal Trade Commission, 600 Pennsylvania Ave. NW., Washington, DC 20580, (202) 326-3224.

SUPPLEMENTARY INFORMATION:

Table of Contents

1. Introduction II. Overview of Proposed Summaries and Notices III. Invitation To Comment IV. Communications by Outside Parties to Commissioners and Their Advisors V. Review Under the Paperwork Reduction Act VI. Regulatory Flexibility Act Analysis VII. Comment Questions

1. Introduction

   The Federal Trade Commission is issuing for public comment two proposed summaries of consumer rights under the FCRA and two notices of duties under the FCRA, 15 U.S.C. 1681 et seq. CRAs will distribute these documents. The first summary is a summary of the rights of identity theft victims under the FCRA that the Commission is required to issue by Section 609(d) of the FCRA. The second summary is a summary of general consumer rights under the FCRA that the Commission is required to issue by Section 609(c) of the FCRA. The two notices are (1) a notice of the FCRA duties of furnishers of information to CRAs and (2) a notice of the FCRA duties of users of information from CRAs. Section 607(d) requires the Commission to issue these notices.

   The requirement that the Commission issue the identity theft rights summary was added to the FCRA by the FACT Act, Public Law 108-159, 117 Stat.1952. The remaining three documents are revised versions of documents first prescribed by the Commission in 1997. The Commission is issuing revised versions to reflect changes made to the FCRA by the FACT Act.

2. Overview of Proposed Summaries and Notices

   The FACT Act, which was signed into law on December 4, 2003, amends the FCRA in a number of significant ways. The Act contains provisions intended to reduce the occurrence of identity theft and confers certain rights on the victims of identity theft to assist them in resolving the problems caused by identity theft. The Act also contains provisions designed to increase the accuracy of consumer reports and to

   [[Page 42617]]

   protect the rights of consumers whose personal information is collected by consumer reporting agencies and by businesses. Finally, the Act establishes uniform national standards in certain key areas. The summaries and notices being published for comment by this notice reflect the changes to the FCRA made by the FACT Act.

   1. Summary of Rights of Identity Theft Victims (Appendix E)

      The FACT Act added Section 609(d) to the FCRA. This provision requires the Commission to issue a summary of the rights of fraud or identity theft victims under the FCRA that will be distributed by CRAs to victims of fraud or identity theft. This summary will complement the various new provisions relating to identity theft added to the FCRA by the FACT Act.

      The proposed summary, which will be Appendix E to 16 CFR part 698, discusses the major identity theft rights that consumers have under the FCRA. These are: the right to file fraud alerts (Section 605A); the right to block the reporting of information resulting from identity theft in the files of consumer reporting agencies (Section 605B); the right to prevent persons who furnish information to the CRAs from reporting information that is the result of identity theft (Section 623(a)(6)(B)); the right to obtain free file disclosures (Sections 612(c)(3) and 612(d)); and the right to obtain documents or information relating to accounts opened in the consumer's name or transactions made in the consumer's name (Sections 609(e) and 615(g)(2)). In addition, the summary informs consumers that a creditor may not sell, transfer, or place for collection a debt if the creditor has been notified that the debt is the result of identity theft (Section 615(f)(1)). The Commission has consulted with the Federal banking regulators and the National Credit Union Administration in crafting the proposed summary as required by Section 609(d).

      The only identity theft-specific rights that are not discussed in the proposed summary are duties that are directed at the business community. These are: the duty of debt collectors to notify the original creditor or owner of the debt if the debt collector is notified that information in the file of a consumer may be the result of identity theft (Section 615(g)(1)); the duty of CRAs to notify the furnisher that information in the file of the consumer may be the result of identity theft and that a block has been requested (Section 605B(b)); and the duty of furnishers of information to CRAs to have in place procedures to prevent the re-furnishing of information which has been blocked under section 605B (Section 623(a)(6)(A)). Because these duties do not require any action by consumers in addition to the steps outlined in the proposed notice, the Commission believes that it is appropriate not to include these items. These duties are set forth in the ``furnisher'' and ``user'' notices discussed below. A discussion of these rights will also be on the Commission's Web site, to which the consumer summary will refer consumers.

      Finally, Section 609(d) of the FACT Act requires that any summary distributed by a CRA contain ``all of the information required by the Commission.'' The Commission reads the statute as providing CRAs with flexibility in creating summaries of identity theft rights and is proposing that any summary issued by a CRA display the Commission- mandated information ``clearly and prominently'' in a form substantially similar to the Commission's model summary.

   2. General Summary of Consumer Rights (Appendix F)

      As added to the FCRA in 1996, Section 609(c) required the Commission to issue a model summary of consumer rights under the FCRA. The summary had to include the following: (1) A description of the FCRA and all rights of consumers under the law; (2) an explanation of how a consumer could exercise his or her rights; (3) a list of all Federal agencies responsible for enforcing the FCRA and their addresses and telephone numbers; (4) a statement that the consumer might have additional rights under State law; and (5) a statement that CRAs are not required to remove current, accurate derogatory information from consumers' files. The 1996 amendments to the FCRA required CRAs to distribute consumer rights summaries that were ``substantially similar'' to the summary created by the Commission. The Commission issued its general summary of consumer rights in July 1997. 62 FR 35586 (1997)

      The recently enacted FACT Act amended Section 609(c) in a number of ways. This provision now requires that the Commission prepare a model summary of consumer rights, and mandates that the summary include an explanation of the following: (1) The consumer's right to obtain a free file disclosure each twelve months under Section 612(a) of the FCRA; (2) the frequency and circumstances under which a consumer may receive additional free disclosures under the FCRA; (3) the right of consumers to dispute incorrect or outdated information in their files; and (4) the right of consumers to obtain credit scores for a fee.

      As amended by the FACT Act, Section 609(c) continues to require that CRAs notify consumers that they may have additional rights under state law and that the FCRA does not require accurate, current derogatory information to be removed from consumers' files. CRAs also must provide consumers with the list of Federal agencies responsible for enforcing the FCRA. These items are, however, no longer required to be included in the summary of rights prescribed by the Commission. Nonetheless, the Commission believes that including this information in its proposed summary would be helpful to consumers by providing in one place a description of consumer rights and the list of agencies charged with enforcing these rights. CRAs may, however, disclose the list of addresses and the two statements separately from the Commission's summary.

      The Commission's proposed summary, which will be Appendix F to 16 CFR part 698, refers consumers to the FCRA portion of the Commission's Web site (http://www.ftc.gov/credit) where a more extensive discussion of the

      various provisions of the FCRA and consumers' rights will be set forth. The summary also provides an address where consumers may request a written copy of this additional information if they do not have access to a computer.

      Another issue raised by the FACT Act amendments is whether CRAs must distribute the summary in the exact form prescribed by the Commission. The 1996 amendments required only that CRAs distribute a summary ``substantially similar'' to the Commission's model. Although Section 609(c), as amended by the FACT Act, no longer contains the ``substantially similar'' language, the provision now characterizes the Commission-prescribed disclosure as a ``model'' summary of rights. As a result, the Commission continues to read the statute to provide CRAs with flexibility to structure the disclosure as necessary and appropriate. Because the Commission's prescribed disclosure is simply a ``model,'' CRAs need not adhere to it in every detail, and a summary that is ``substantially similar'' to the Commission's model summary complies with the statutory requirement.

      In addition, the Commission believes that all information must be clearly and prominently displayed. Finally, the Commission realizes that some information in the summary may change over time--for example, the permissible

      [[Page 42618]]

      charges for file disclosures and the addresses and telephone numbers of the Federal agencies. The Commission will periodically update this information on its Web site, and considers all notices with updated information to be in compliance with section 609(c).

   3. Notice of Duties of Furnishers and Notice of Duties of Users (Appendix G and Appendix H)

      The FACT Act did not amend Section 607(d), which requires the Commission to issue a notice setting forth the duties of furnishers of information to CRAs, and a notice outlining the duties of users of consumer reports.

      The FACT Act did, however, amend Section 623 of the FCRA to add a number of new furnisher duties, including requiring compliance with ``accuracy'' guidelines to be issued by the Commission and the banking and credit union regulators, procedures that must be followed to assist in preventing and correcting identity theft, and procedures relating to the furnishing of negative information and medical information. The Commission has revised the furnisher notice, which will be Appendix G to 16 CFR part 698, to reflect these changes.

      The FACT Act also amended many provisions of the FCRA that affect users. The most significant changes relate to the use of consumer reports for employment purposes, the use of medical information, the duties of resellers of consumer reports, and the procedures to be followed to protect against identity theft. The Commission has revised the user notice, which will be Appendix H to 16 CFR part 698, to reflect these changes. The ``users'' of consumer reports fall into a number of categories, and the duties imposed by the FCRA vary by user category. The Commission is proposing a single notice to be sent to all users, which specifies the general responsibilities that apply to all users of consumer reports from a CRA (Part I), and lists the responsibilities that are specific to the following categories of users: creditors and mortgage grantors (Part II); users of reports for employment purposes (Part III); users of investigative consumer reports (Part IV); users of medical information (Part VI); users of ``prescreened'' lists (Part VII); and users who are resellers (Part VIII).

      Section 607(d) of the FCRA requires CRAs to provide to furnishers and users a notice of ``such person's responsibilities.'' The Commission interprets this provision as giving CRAs the option of providing notices that only list the duties that specifically apply to a particular furnisher or user. CRAs may, however, elect to provide the Commission's furnisher or user notices in their entirety to all furnishers and users.

      Section 607(d) also requires that CRAs provide furnishers and users notices that are ``substantially similar'' to the notices prescribed by the Commission. The Commission believes that the changes made to furnisher and user duties by the FACT Act are significant, and render the existing furnisher and user notices obsolete. Accordingly, the Commission concludes that CRAs will need to provide revised notices to all furnishers and users in order to comply with the statutory requirement that they provide to furnishers and users a notice that is substantially similar to the notice prescribed by the Commission.

   4. Distribution of Summaries and Notices

      With respect to the general summary of rights, Section 609(c) makes clear that it must be provided every time a CRA makes a written file disclosure. The Commission will post minor changes in addresses, telephone numbers, and the cost of consumer reports on its Web site. CRAs may modify the summaries they distribute to reflect these changes.

      Section 609(d) requires that the summary of identity theft rights be provided when consumers contact CRAs to report fraud or identity theft. The statute requires CRAs to begin distributing the summary of identity theft rights 60 days after the Commission issues the summary in final form.

      The furnisher and user notices are required by Section 607(d) to be distributed on a one-time basis by CRAs. The Commission believes that the changes made by the FACT Act to the FCRA are so substantial that CRAs must distribute the revised user and furnisher notices to all current users and furnishers, as well as to all entities that become users or furnishers in the future.

3. Invitation to Comment

   The Commission invites interested members of the public to submit written data, views, facts, and arguments addressing the issues raised by this Notice. Specific issues that the Commission suggests be addressed are set forth in Part VII below. Written comments must be received on or before August 16, 2004. Comments should refer to ``FACTA Notices, Matter No. R411013'' to facilitate the organization of comments. A comment filed in paper form should include this reference both in the text and on the envelope, and should be mailed or delivered to the following address: Federal Trade Commission/Office of the Secretary, Room H-159 (Annex S), 600 Pennsylvania Avenue, NW., Washington, DC 20580. The Commission is requesting that any comment filed in paper form be sent by courier or overnight service, if possible, because postal mail in the Washington area and at the Commission is subject to delay due to heightened security precautions. Commenters seeking confidential treatment for any portion of their comments must file their comments in paper form. An electronic comment may be filed by e-mail by sending the comment to FCRAnotices@ftc.gov.

   Comments on any proposed filing, recordkeeping, or disclosure requirements that are subject to paperwork burden review under the Paperwork Reduction Act should be submitted to: Office of Information and Regulatory Affairs, Office of Management and Budget, Attention: Desk Officer for Federal Trade Commission. Comments should be submitted via facsimile to (202) 395-6974 because U.S. postal mail at the Office of Management and Budget is subject to lengthy delays due to heightened security precautions. Such comments should also be sent to the following address: Federal Trade Commission/Office of the Secretary, Room H-159 (Annex S), 600 Pennsylvania Avenue, NW., Washington, DC 20580.

   The Federal Trade Commission Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. All timely and responsive public comments, whether filed in paper or electronic form, will be considered by the Commission, and will be available to the public on the FTC Web site, to the extent practicable, at http://www.ftc.gov. As a matter of

   discretion, the FTC makes every effort to remove home contact information for individuals from the public comments it receives before placing those comments on the FTC Web site. More information, including routine uses permitted by the Privacy Act, may be found in the FTC's privacy policy, at http://www.ftc.gov/ftc/privacy.htm.

4. Communications by Outside Parties to Commissioners and Their Advisors

   Written communications and summaries or transcripts of oral communications respecting the merits of this proceeding from any outside party to any Commissioner or Commissioner's advisor will be placed on the public record. 16 CFR 1.26(b)(5).

   [[Page 42619]]

5. Review Under the Paperwork Reduction Act

   In accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3506; 5 CFR 1320 Appendix A.1) (PRA), the Commission reviewed the general summary of rights and the furnisher and user notices for compliance with the PRA when it issued the summary and notices in 1997. At that time, the Commission concluded that the summary and notices consist of information that is supplied by the Federal government. Accordingly, the Commission determined that these do not constitute a ``collection of information'' as this term is defined in the regulations implementing the PRA, nor do the financial resources expended in relation to the distribution of these documents constitute a paperwork burden. See 5 CFR 1320.3(c)(2). The Commission has reviewed the new identity theft summary of rights, as well as the changes to the existing summary and notices that are mandated by the FACT Act amendments to the FCRA. The Commission has concluded, consistent with its analysis in 1997, that the proposed summaries and notices do not fall within the definition of ``collection of information'' covered by the PRA because they are ``[t]he public disclosure of information originally supplied by the Federal government to the recipient for the purpose of disclosure to the public * * *.'' 5 CFR 1320.3(c)(2).

6. Regulatory Flexibility Act Analysis

   The Regulatory Flexibility Act (RFA), 5 U.S.C. 601-612, requires that the Commission provide an Initial Regulatory Flexibility Analysis (IRFA) with any action that may constitute a rule unless the Commission certifies that the action will not have a significant economic impact on a substantial number of small entities. See 5 U.S.C. 603-605. The Commission concludes that the proposed summaries and notices will not have a significant economic impact on a substantial number of small entities, as discussed below. Accordingly, this document serves as notice to the Small Business Administration of the agency's certification of no effect.

   To ensure the accuracy of this certification, however, the Commission requests comment on whether the proposed notices will have a significant impact on a substantial number of small entities, including specific information on the number of entities that will be covered by the proposed rules, the number of these entities that are ``small'' (i.e., have average annual receipts of less than $6 million), and the average annual burden for each entity. The Commission has prepared the following analysis:

   1. Description of the Reasons That Action by the Agency Is Being Taken

      The agency has undertaken this proceeding to implement several provisions of the FCRA, as amended by the FACT Act. Specifically, Section 609(c) of the FCRA requires the Commission to prepare a summary of the general rights that consumers have under the FCRA (general summary of consumer rights); Section 609(d) requires the Commission to prepare a model summary of the rights of consumers under the FCRA that relate to identity theft; and Section 607(d) requires the Commission to issue notices of the duties under the FCRA of persons that furnish information to CRAs and of persons that use information obtained from CRAs. All of these documents will be distributed by CRAs.

   2. The Proposal's Objectives and Legal Basis

      The objective of the Commission's action is the issuance of proposed summaries and notices to educate consumers, furnishers of information to CRAs, and users of information from CRAs as to their rights or duties under the FCRA. As noted earlier, the legal bases for the proposed notices are Sections 607(d) (notices of duties of users and furnishers), 609(c) (general summary of consumer rights), and 609(d) (summary of identity theft rights) of the FCRA.

   3. Small Entities to Which the Proposed Rule Will Apply

      The proposed summaries and notices are to be distributed by CRAs. The definition of a ``small'' CRA is currently one with less than $6 million in average annual receipts (see http://www.sba.gov/size).

      The consumer reporting industry is composed primarily of ``nationwide'' CRAs and ``nationwide specialty'' CRAs, as defined in FCRA Sections 603(p) and 603(w), respectively. The Commission estimates, based on its own experience and knowledge of industry practices and members, that there are three nationwide CRAs and fewer than 50 nationwide specialty CRAs currently doing business in the U.S. The Commission believes that none of the nationwide CRAs are ``small'' entities. Further, the Commission believes it is likely, but has been unable to confirm, that none of the nationwide specialty CRAs are small entities.

      There are, however, small CRAs associated with the nationwide CRAs, and there are small independent CRAs. Based on the membership of the major CRA trade associations, the Commission believes that the total universe of entities potentially covered by the requirement to distribute summaries and notices is between 1000 and 1400. As is discussed below, the Commission believes that the nationwide and nationwide specialty CRAs will be responsible for much of the distribution of the summaries and notices. The Commission invites comments on the number of ``small'' entities that will be affected by its proposal.

   4. Projected Reporting, Recordkeeping, and Other Compliance Requirements

      The proposed rule would impose no reporting or recordkeeping requirements. CRAs will be required, however, to distribute the prescribed summaries and notices. The summary of identity theft rights (Section 609(d)) will be distributed to all consumers who contact the CRAs to report that they may be the victim of fraud or identity theft. The general summary of consumer rights (Section 609(c)) will be distributed with each written disclosure made by CRAs. Both of these summaries will be distributed to large numbers of consumers each year. By contrast, the notices of user and furnisher duties (Section 607(d)) need be distributed only on a one-time basis to all of the entities that furnish information to a CRA or use information obtained from a CRA.

      As discussed above, CRAs have distributed the general summary of rights and the furnisher and user notices since 1997. The revised general summary and the revised furnisher and user notices will simply maintain, and not increase in any significant way, the burdens already imposed on CRAs by these notice requirements. The additional requirement to distribute a summary of identity theft rights, however, will impose some new burdens and costs on CRAs, although the Commission believes they will be minimal.

      CRAs must provide the required summary of identity theft rights to consumers when they contact CRAs to report fraud or identity theft. There should be few instances, however, in which this summary will be the only information the CRA is distributing to consumers. Rather, in most cases, when consumers report fraud or identity theft, CRAs will be responding either by sending a copy of their file or engaging in other ongoing communications with consumers in an attempt to resolve their identity theft problems. CRAs may be reasonably expected to economize on

      [[Page 42620]]

      the costs of transmitting the required summary of identity theft rights to consumers by including the summary as part of such communications with consumers.

      Thus, the Commission believes that the distribution costs for the identity theft rights summaries are likely to be a small increment to the overall cost of handling fraud and identity theft complaints from consumers. Moreover, because the Commission is providing the language for the summary, businesses need not incur legal or other professional costs to develop any written material. The cost of training employees, if any, should be minimal. When the document is distributed electronically, the Commission believes that the distribution costs will be negligible. The cost of distributing the summary will be greatest where the summary is mailed. Even here, however, the cost will be a small increment to the costs associated with handling the contact with the consumer, as explained earlier. The Commission estimates that the incremental cost of including the document in other material that is mailed to a consumer will be $.25 for each mailing, because including the summary with other material should require little clerical effort and no additional postage. In the rare instance where the summary is the only item mailed to the consumer, the Commission estimates the incremental cost at $.50 per mailing because of the cost of handling and postage. This estimate assumes that little staff time will be required to provide summaries in addition to the staff time that will be devoted to dealing with each consumer's problem. The Commission believes that the cost of preparing and printing notices will be minimal because the notice is very short and the content is being provided by the Commission.

      With respect to small entities, the total annual cost of complying with the requirement to distribute the summary of identity theft rights will ultimately depend upon the number of summaries that are distributed each year by ``small'' CRAs. The Commission is currently unaware of any comprehensive data showing how frequently consumers contact the small CRAs regarding fraud, identity theft, or other matters. Even without such data, however, the Commission believes that, overall, the burden of providing these summaries will fall upon the nationwide and nationwide specialty CRAs. In that regard, most of the government's consumer education efforts to date, as well as the Commission's proposed summary of identity theft rights, explains that the FCRA requires the nationwide CRAs, not the ``small'' CRAs, to place fraud alerts on consumers' files when consumers are victims of identity theft. As a result, the Commission believes that most consumers who suspect fraud or identity theft are likely to contact the nationwide CRAs, rather than the ``small'' CRAs. In those cases, the nationwide CRAs, which are not ``small'' for purposes of this analysis, would be providing consumers with their required summary of identity theft rights.\1\

      \1\ Many local or regional CRAs are associated with the nationwide CRAs identified in the proposed summary of identity theft rights. It is possible some nationwide CRAs by contract may pass on to the small associated CRAs some or all of the cost of distributing summaries to consumers whose records are controlled by the small CRA. The Commission invites comments and information on this topic.

      Accordingly, the Commission believes that the total incremental cost of the distribution of the consumer summary for small CRAs will be relatively minimal. These costs may be incurred by small CRAs associated with nationwide CRAs where, for some reason, the consumer contacts the small CRA and not the nationwide CRA, by resellers of reports from the nationwide CRAs, and by small regional or local entities providing criminal records, driving records, and tenant screening services. The Commission invites comments on its analysis and on the costs imposed on small entities by the requirement to distribute summaries of identity theft rights.

   5. Duplicative, Overlapping, or Conflicting Federal Rules

      The Commission has not identified any other federal statutes, rules, or policies that would duplicate, overlap, or conflict with the proposed notices. The Commission invites comment and information on this issue.

   6. Significant Alternatives to the Proposed Rule

      In some situations, the Commission has considered adopting a delayed effective date for small entities subject to new regulation in order to provide them with additional time to come into compliance. In this case, however, small entities will be given the texts of the proposed summaries and notices to be distributed. In the case of the summary of identity theft rights, the distribution of which is a new burden being imposed on small entities, the Commission believes that the impact of the distribution will be minimal. The Commission, however, seeks comment and information with regard to (1) the existence of small business entities for which distribution of the required summaries and notices would have a significant economic impact; and (2) suggested alternative methods of compliance that, consistent with the statutory requirements, would reduce the economic impact of the requirements of this proceeding on these entities. If the comments filed in response to this notice identify small entities that are significantly affected, as well as alternative methods of compliance that would reduce the economic impact on such entities, the Commission will consider the feasibility of such alternatives.

7. Questions for Comment on the Proposed Summaries and Notices

   The Commission seeks comment on the proposed summaries and notices. The Commission is particularly interested in comments in the following areas:

   1. Summary of Identity Theft Rights of Consumers (Appendix E)

      1. Completeness and Reference to Commission Web sites. The Commission has sought to include enough information in the summary to effectively assist consumers who are the victims of identity theft and to refer consumers to the Commission's Web site for more information. Is it appropriate and useful to refer consumers to the Commission's Web sites for more information?

      2. Statutorily-Required Items. Section 609(d) states only that the Commission must issue a model summary of rights, but does not identify specific items to be included. Has the Commission included all of the rights that should be included in the summary?

      3. Understandability of Summary. Since the identity theft summary is intended for consumers, the Commission has tried to use, as much as possible, non-technical terms that will be understood by consumers. Has the Commission succeeded? Are there areas where the understandability of the summary may be improved?

   2. General Summary of Consumer Rights (Appendix F)

      1. Effectiveness of Current Notice. The current summary of consumer rights has been in place for nearly seven years. The Commission welcomes any comments as to whether the summary has been effective in informing consumers about their rights under the FCRA, and whether the effectiveness of the summary may be improved.

      2. Completeness and Reference to Commission Web site. The

         [[Page 42621]]

         Commission's goal is to have a summary that is both informative and user friendly for consumers. The proposed summary refers consumers to the Commission's Web site for additional information. An address is also provided for consumers to request additional information if they do not have access to a computer. Does the proposed summary meet the Commission's goal? Please identify any specific sections of the proposed summary that are too brief or incomplete to be understood by consumers. Is it useful to provide references to the Commission's Web site for more detailed information, and to provide an address to write to in order to request more information? Does this approach disadvantage any significant group of consumers? What alternative approaches are available?

      3. Statutorily-Required Items. Section 609(c) was significantly modified by Congress in the FACT Act. Some items of information that were required in the pre-FACT Act disclosure are no longer required to be included in the Commission's model summary, but CRAs nonetheless must continue to disclose this information. In addition, Congress required new items of information to be included in the Commission's model summary. The Commission has elected to include the new information required by the FACT Act in the proposed summary and to retain all of the information in the existing summary--even though some of the information may now be disclosed separately. Is this approach appropriate?

      4. Understandability of Notice. Because the summary is a document intended for consumers, the proposal is written in non-technical language. Are there sections that can be improved by simplifying the presentation to make it easier for consumers to understand? Are there sections where the language does not accurately convey the substance of the provision? How could such sections be improved? Should more information be included in the notice?

      5. Form and Distribution. Section 609(c)(2) requires CRAs to provide with each written file disclosure the Commission's summary of rights. The goal is to create a notice that sets forth all statutorily required items in a form that is readable, understandable, and attractive. Generally, is there a format that would better convey the same information to consumers? If so, what is it and what costs would it entail? Is there a format that would convey the same information to consumers in a less expensive manner? If so, what is it and what cost savings would it achieve?

   3. Furnisher Notice (Appendix G)

      1. Content of Notice. The proposed furnisher notice summarizes the responsibilities imposed upon furnishers of information to CRAs by Section 623 of the FCRA. Is the presentation accurate and understandable? In what ways can it be improved? Is it sufficient for the notice to refer furnishers to the complete text of the FCRA at the Internet Web site maintained by the Commission? Would the notice be improved if the Commission added the complete text of Section 623?

      2. Terminology. The Commission's proposed notice is written in non- technical language, but with the expectation that most regular providers of information to CRAs will be relatively sophisticated and will be able to understand both the language of the statute and the description of duties. Is the description accurate and understandable for this audience? What improvements can be made?

   4. User Notice (Appendix H)

      1. Number of Notices. The Commission is proposing the content of a notice to be sent by CRAs to all users of information. CRAs will have the option of sending the notice in the form published by the Commission or sending a notice that lists only the duties of the user that will receive the notice. Should this procedure be followed? Can CRAs easily determine through the certifications they receive from users which portions of the proposed notice are applicable to which users?

      2. Content of Notice. The proposed notice discusses the principal portions of the FCRA that impose obligations upon all those who receive consumer reports. Should additional information be included in the notice? Will the length of the notice impose substantial burdens upon CRAs in distributing the notice? Are there ways to modify the notice to reduce this burden?

      3. Terminology. The Commission expects that user notices will be sent to a wide range of users and that these persons will have varying degrees of legal sophistication. Are the duties set forth in the proposed notice clear and understandable? Can the description of the duties be improved?

         List of Subjects in 16 CFR Part 698

         Fair Credit Reporting Act, Consumer reports, Consumer reporting agencies, Credit, Trade practices.

         Accordingly, pursuant to 15 U.S.C. 1681e, 1681g, and 1681j, and Public Law 108-159, sec. 211(d), the Federal Trade Commission hereby proposes to amend Part 698 of subchapter F of chapter I of title 16, Code of Federal Regulations (which was added at 69 FR 35500 (June 24, 2004), and which becomes effective on December 1, 2004), as follows:

      1. Revise the authority to read as follows:

         Authority: 15 U.S.C. 1681e, 1681g, 1681s, and 1681j; 117 Stat. 1952; Pub. L. 108-159, sections 151, 153, 211(c) and (d), 213, and 311.

      2. Revise the heading of Part 698 to read as follows:

         PART 698--SUMMARIES OF CONSUMER RIGHTS, NOTICE OF USER RESPONSIBILITIES, AND NOTICE OF FURNISHER RESPONSIBILITIES UNDER THE FAIR CREDIT REPORTING ACT

      3. Revise section 698.1 to read as follows:

         Sec. 698.1 Authority and purpose.

         (a) Authority. This part is issued by the Commission pursuant to the provisions of the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.), as amended by the Consumer Credit Reporting Reform Act of 1996 (Title II, Subtitle D, Chapter 1, of the Omnibus Consolidated Appropriations Act for Fiscal Year 1997), Pub. L. 104-208, 110 Stat. 3009-426 (Sept. 30, 1996), and the Fair and Accurate Credit Transactions Act of 2003, Pub. L. 108-159, 117 Stat. 1952 (Dec. 4, 2003).

         (b) Purpose. The purpose of this part is to comply with sections 607(d), 609(c), 609(d), and 612(a) of the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act of 2003, and Section 211 of the Fair and Accurate Credit Transactions Act of 2003.

      4. Revise section 698.2 to read as follows:

         Sec. 698.2 Legal effect.

         The issuance of the summaries and notices set forth below carries out the directive in the statute that the FTC prescribe these summaries and notices. Consumer reporting agencies that distribute summaries and notices as set forth below will be in compliance.

      5. Add Appendices E through H to read as follows:

         Appendix E to Part 698--Summary of Consumer Identity Theft Rights

         The prescribed form for this summary is a disclosure that clearly and prominently contains the information set forth in the Commission's model summary. A summary may accurately reflect changes to those items (such as

         [[Page 42622]]

         telephone numbers) that may change over time and remain in compliance.

         Remedying the Effects of Identity Theft: Summary of Consumer Rights Under the Fair Credit Reporting Act

         You are receiving this information because you have notified a consumer reporting agency that you believe you are a victim of identity theft. Identity theft occurs when someone uses your name, Social Security number, date of birth, or other identifying information, without lawful authority, to commit fraud, such as opening a credit card account or obtaining a loan in your name. For more information, visit http://www.consumer.gov/idtheft and www.ftc.gov/

         credit.

         The Fair Credit Reporting Act (FCRA) governs the collection and use of information about you, including how you pay your bills. Consumer reporting agencies, such as credit bureaus, collect this information and provide it to your creditors and other persons who have a right to the information. In 2003, Congress amended the FCRA to give you specific rights when you are, or believe that you are, the victim of identity theft. These rights are intended to help you recover from identity theft.

         Here's a brief overview of the FCRA rights, designed to help you deal with the problems that identity theft can cause:

      1. You have the right to a free copy of your consumer report if you believe it has inaccurate information due to fraud or identity theft. This report is in addition to the free report all consumers may obtain every twelve months under another provision of the FCRA. See http://www.ftc.gov/credit.

      2. You have the right to place a ``fraud alert'' on your consumer report to let potential creditors and others know that you may be a victim of identity theft. A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to protect you. It also may delay your ability to obtain credit. You may place a fraud alert in your file by calling one of the three nationwide consumer reporting agencies. As soon as that agency processes your fraud alert, it will notify the other two, which then also must place fraud alerts on your credit report.

         Equifax: 1-800-525-6285; http://www.equifax.comExperian: 1-888-397-3742; www.experian.com

         TransUnion: 1-800-680-7289; http://www.transunion.com

         An initial fraud alert stays in your file for 90 days and entitles you to a free copy of your consumer report. An extended alert stays in your file for seven years and entitles you to two free consumer reports in a 12-month period. The additional consumer reports may help you detect signs of fraud, like whether additional fraudulent accounts have been opened in your name or whether someone has reported a change in your address. A consumer reporting agency will require appropriate proof of your identity, which may include your Social Security number, to place either of these alerts on your report. In addition, you must provide an identity theft report--a copy of a report filed by you with a Federal, State, or local law enforcement agency--to place an extended alert on your consumer report. Be sure to include as many details as you can, such as dates, account numbers, or any logical details, if known to you, that would help document the suspected fraud.

      3. You have the right to obtain documents relating to accounts opened in your name. A creditor or other business must give you copies of applications and other business records relating to a transaction, or account in your name that you believe was the result of identity theft. The business may ask you for proof of your identity, a police report, and an affidavit before it gives you the documents.

      4. You have the right to obtain information from a debt collector. If you ask, a debt collector must provide you with certain information about the debt you believe was incurred in your name by an identity thief--like the name of the creditor and the amount of the debt.

      5. You have the right to block information from your consumer report that relates to accounts an identity thief opened in your name. An identity thief may run up bills in your name and not pay them. If that happens, information about the unpaid bills may appear on your consumer report. You can ask a consumer reporting agency to block this information from appearing on your consumer report. To do so, you must identify which information to block, and provide the consumer reporting agency with proof of your identity and a copy of the report you filed with law enforcement (the identity theft report). The consumer reporting agency can refuse or cancel your request for a block if, for example, you don't have the necessary supporting documentation, or where the block results from an error or a material misrepresentation of fact made by you. If the agency declines or rescinds the block, it must notify you. Once a debt resulting from identity theft has been blocked, a person or business with notice of the block may not sell, transfer, or place the debt for collection.

      6. You also may prevent businesses from reporting information to the consumer reporting agencies about an account in your name opened by an identity thief. To do so, you must send a request to the address specified by the business that reports the information to the consumer reporting agency. The business will expect you to document that you are an identity theft victim. You may do so by submitting an identity theft report.

         You can learn more about identity theft and how to undo the effects of this fraud at the FTC's identity theft Web site at http://www.consumer.gov/idtheft.

         In addition to the new rights and procedures to help consumers deal with the effects of indentity theft, the FCRA has a host of other important protections. Described in more detail at http://www.ftc.gov/credit, these include the right to dispute inaccurate

         information with a consumer reporting agency; the right to have inaccurate information deleted from your consumer report; the right to know you credit score; the right to a free consumer report every year; and the right to receive additional free consumer reports when appropriate.

         You will receive a summary of these rights from a consumer reporting agency every time you receive a consumer report.

         Appendix F to Part 698--General Summary of Consumer Rights

         The prescribed form for this summary is a disclosure that is substantially similar to the Commission's model summary with all information clearly and prominently displayed. A summary may accurately reflect changes to those items that may change over time (e.g., dollar amounts, or phone numbers and addresses of Federal agencies) and remain in compliance.

         A Summary of Your Rights Under the Fair Credit Reporting Act

         The Federal Fair Credit Reporting Act (FCRA) promotes the accuracy, fairness, and privacy of information in the files of consumer reporting agencies. There are many types of consumer reporting agencies, including credit bureaus that gather and sell information about your creditworthiness to creditors, employers, landlords, and other businesses. The FCRA gives you specific rights, which are summarized below. You may have additional rights under state law. For more information, go to http://www.ftc.gov/credit, or write

         to: Consumer Response Center, Federal Trade Commission, 600 Pennsylvania Ave., NW., Washington, DC 20580.

         You must be told if information in your file has been used against you. Anyone who uses information from a consumer reporting agency to deny your application for credit, insurance, or employment--or take another adverse action against you--must tell you and give you the name, address, and phone number of the agency that provided the information.

         You can find out what is in your file. At any time, you may request and obtain your report from a consumer reporting agency. You will be asked to provide proper identification, which may include your Social Security number. In many cases the report will be free. You are entitled to free reports if a person has taken adverse action against you because of information in a report; if you are the victim of identify theft; if you are the victim of fraud; if you are on public assistance; or if you are unemployed but expect to apply for employment within 60 days. In addition, you are entitled to one free report every twelve months from each of the nationwide credit bureaus and from some specialized consumer reporting agencies. See http://www.ftc.gov/credit for details about how to obtain

         your free report.

         You have a right to know your credit score. Credit scores are numerical summaries of a consumer's creditworthiness based on information from consumer reports. For a fee, you may get your credit score. For more information, click on http://www.ftc.gov/credit. In

         some mortgage transactions, you will get credit score information without charge.

         You can dispute inaccurate information with the consumer reporting agency. If you tell a consumer reporting agency that your file has inaccurate information, the agency must take certain steps to investigate unless

         [[Page 42623]]

         your dispute is frivolous. For an explanation of dispute procedures, go to http://www.ftc.gov/credit.

         Inaccurate information must be corrected or deleted. A consumer reporting agency or furnisher must remove or correct information verified as inaccurate, usually within 30 days after you dispute it. However, a consumer reporting agency may continue to report negative data that it verifies as being accurate.

         Outdated negative information may not be reported. In most cases, a consumer reporting agency may not report negative information that is more than seven years old, or bankruptcies that are more than 10 years old.

         Access to your file is limited. A consumer reporting agency may provide information about you only to people with a valid need as determined by the FCRA--usually to consider an application with a creditor, insurer, employer, landlord, or other business.

         Your consent is required for reports that are provided to employers. A consumer reporting agency may not give out information about you to your employer, or potential employer, without your written consent. Blanket consent may be given at the time of employment or later.

         You may choose to remove your name from consumer reporting agency lists for unsolicited credit and insurance offers. These offers must include a toll-free phone number you can call if you choose to take your name and address off lists in the future. You may opt-out at the major credit bureaus by calling 1-800-XXXXXXX.

         You may seek damages from violators. If a consumer reporting agency, a user of consumer reports, or, in some cases, a furnisher of information to a consumer reporting agency violates the FCRA, you may sue them in State or Federal court.

         Identity theft victims and active duty military personnel have additional rights. Victims of identity theft have new rights under the FCRA. Active-duty military personnel who are away from their regular duty station may file ``active duty'' alerts to help prevent identity theft. For more information, visit http://www.ftc.gov/credit.

         The FCRA gives several federal agencies authority to enforce the FCRA:

         To complain and for information

         Please contact

         Consumer reporting agencies, creditors Federal Trade Commission, and others not listed below.

         Consumer Response Center-- FCRA, Washington, DC 20580, 1- 877-382-4367 (Toll-Free). National banks, federal branches/

         Office of the Comptroller of agencies of foreign banks (word

         the Currency Compliance ``National'' or initials ``N.A.''

         Management, Mail Stop 6-6, appear in or after bank's name).

         Washington, DC 20219, 800-613- 6743. Federal Reserve System member banks Federal Reserve Board, Division (except national banks, and federal of Consumer & Community branches/agencies of foreign banks). Affairs, Washington, DC 20551, 202-452-3693. Savings associations and federally Office of Thrift Supervision, chartered savings banks (word

         Consumer Programs Washington, ``Federal'' or initials ``F.S.B.'' DC 20552, 800-842-6929. appear in federal institution's name). Federal credit unions (words ``Federal National Credit Union Credit Union'' appear in institution's Administration, 1775 Duke name).

         Street, Alexandria, VA 22314, 703-518-6360. State-chartered banks that are not Federal Deposit Insurance members of the Federal Reserve System. Corporation, Division of Compliance & Consumer Affairs, Washington, DC 20429, 800-934- FDIC. Air, surface, or rail common carriers Department of Transportation, regulated by former Civil Aeronautics Office of Financial Board or Interstate Commerce

         Management, Washington, DC Commission.

         20590, 202-366-1306. Activities subject to the Packers and Department of Agriculture, Stockyards Act, 1921.

         Office of Deputy Administrator--GIPSA, Washington, DC 20250, 202-720- 7051.

         Appendix G to Part 698--Notice of Furnisher Responsibilities

         The prescribed form for this disclosure is a separate document that is substantially similar to the Commission's notice with all information clearly and prominently displayed. Consumer reporting agencies may limit the disclosure to only those items that they know are relevant to the furnisher that will receive the notice.

         Notice to Furnishers of Information: Obligations of Furnishers Under the FCRA

         The Federal Fair Credit Reporting Act (FCRA),15 U.S.C. 1681- 1681y, imposes responsibilities on all persons who furnish information to consumer reporting agencies (CRAs). These responsibilities are found in Section 623 of the FCRA. State law may impose additional requirements. All furnishers of information to CRAs should become familiar with the applicable laws and may want to consult with their counsel to ensure that they are in compliance. The text of the FCRA is set forth in full at the Federal Trade Commission's Internet Web site at http://www.ftc/credit.

         Section 623 imposes the following duties upon furnishers:

         Accuracy Guidelines

         The banking and credit union regulators and the Federal Trade Commission (FTC) will promulgate guidelines and regulations dealing with the accuracy of information provided to CRAs by furnishers. The regulations and guidelines issued by the FTC will be available at http://www.ftc.gov/credit when they are issued. Section 623(e).

         General Prohibition on Reporting Inaccurate Information

         The FCRA prohibits information furnishers from providing information to a CRA that they know or have reasonable cause to believe is inaccurate. However, the furnisher is not subject to this general prohibition if it clearly and conspicuously specifies an address to which consumers may write to notify the furnisher that certain information is inaccurate. Sections 623(a)(1)(A) and (a)(1)(C).

         Duty to Correct and Update Information

         If at any time a person who regularly and in the ordinary course of business furnishes information to one or more CRAs determines that the information provided is not complete or accurate, the furnisher must provide complete and accurate information to the CRA. In addition, the furnisher must notify all CRAs that received the information of any corrections, and must thereafter report only the complete and accurate information. Section 623(a)(2).

         Duties After Notice of Dispute From Consumer

         The Federal banking and credit union regulators and the FTC will issue regulations that will identify when an information furnisher must investigate a dispute made directly to the furnisher by a consumer. Once these regulations are issued, furnishers must comply with them and complete an investigation within 30 days (or 45 days, if the consumer later provides relevant additional information) unless the dispute is frivolous or irrelevant or comes from a ``credit repair'' organization. The FTC regulations will be available at http://www.ftc.gov/credit. Section 623(a)(8).

         If a consumer notifies a furnisher that the consumer disputes the completeness or accuracy of any information reported by the furnisher, the furnisher may not subsequently report that information to a CRA without providing notice of the dispute. Section 623(a)(3).

         Duties After Notice of Dispute From Consumer Reporting Agency

         If a CRA notifies a furnisher that a consumer disputes the completeness or accuracy of information provided by the furnisher, the furnisher has a duty to follow certain procedures. The furnisher must:

         Conduct an investigation and review all relevant information provided by the CRA, including information given to the CRA by the consumer. Sections 623(b)(1)(A) and (b)(1)(B).

         Report the results to the CRA that referred the dispute, and, if the investigation establishes that the information was, in fact, incomplete or inaccurate, report the results to all CRAs to which the furnisher provided the information that compile and maintain files

         [[Page 42624]]

         on a nationwide basis. Section 623(b)(1)(c) and (b)(1)(D).

         Promptly modify or delete the information, or block its transmission in the future. Sections 623(b)(1)(E).

         Complete the above steps within 30 days from the date the CRA receives the dispute (or 45 days, if the consumer later provides relevant additional information to the CRA). Section 623(b)(2).

         Duty to Report Voluntary Closing of Credit Accounts

         If a consumer voluntarily closes a credit account, any person who regularly and in the ordinary course of business furnishes information to one or more CRAs must report this fact when it provides information to CRAs for the time period in which the account was closed. Section 623(a)(4).

         Duty to Report Dates of Delinquencies

         If a furnisher reports information concerning a delinquent account placed for collection, charged to profit or loss, or subject to any similar action, the furnisher must, within 90 days after reporting the information, provide the CRA with the month and the year of the commencement of the delinquency that immediately preceded the action, so that the agency will know how long to keep the information in the consumer's file. Section 623(a)(5).

         Debt collectors that report information to CRAs comply with the requirements of Section 623(a)(5) (until there is a consumer dispute) if they report the same delinquency date previously reported by the creditor. If they do not have this, they comply with the FCRA if they establish reasonable procedures to obtain and report delinquency dates, or, if the delinquency dates cannot be reasonably obtained, they follow reasonable procedures to ensure that the dates reported precede the date the account was placed for collection, charged to profit or loss, or subjected to any similar action. Section 623(a)(5).

         Duties of Financial Institutions When Reporting Negative Information

         Furnishers who are financial institutions must notify consumers in writing if they furnish negative information to a CRA. Section 623(a)(7). The Federal Reserve Board has prescribed a model disclosure, 12 CFR Part 222, App. B.

         Duties When Furnishing Medical Information

         A furnisher whose primary business is providing medical services, products, or devices (and the furnisher's agents or assignees) is a medical information furnisher for the purposes of the FCRA and must notify all CRAs that it reports to of this fact. Section 623(a)(9). This will enable CRAs to comply with their duties under Section 604(g) when reporting medical information.

         Duties When ID Theft Occurs

         All furnishers must have in place reasonable procedures to respond to notifications from CRAs that information furnished is the result of identity theft and to prevent refurnishing the information in the future. Furnishers must also establish procedures so that information reported directly to the furnisher by consumers about accounts that are linked to identity theft will not be furnished to any CRA unless the furnisher subsequently knows or is informed by the consumer that the information is correct. Section 623(a)(6). When any furnisher of information is notified pursuant to the procedures set forth in Section 605B that a debt has resulted from identity theft, the furnisher may not sell, transfer, or place for collection the debt. Section 615(f).

         Appendix H to Part 698--Notice of User Responsibilities

         The prescribed form for this disclosure is a separate document that is substantially similar to the Commission's notice with all information clearly and prominently displayed. Consumer reporting agencies may limit the disclosure to only those items that they know are relevant to the user that will receive the notice.

         Notice to Users of Consumer Reports: Obligations of Users Under the FCRA

         The Fair Credit Reporting Act (FCRA), 15 U.S.C. 1681-1681y, requires that this notice be provided to inform users of consumer reports of their legal obligations. State law may impose additional requirements. The text of the FCRA is set forth in full at the Federal Trade Commission's Internet Web site at http://www.ftc.gov/credit.

         The first section of this summary sets forth the responsibilities imposed by the FCRA on all users of consumer reports. The subsequent sections discuss the duties of users of reports that contain specific types of information, or that are used for certain purposes, and the legal consequences of violations. If you are a furnisher of information to a consumer reporting agency (CRA), you have additional obligations and will receive a separate notice from the CRA describing your duties as a furnisher.

1. Obligations of All Users of Consumer Reports

   1. Users Must Have a Permissible Purpose

      Congress has limited the use of consumer reports to protect consumers' privacy. All users must have a permissible purpose under the FCRA to obtain a consumer report. Section 604 of the FCRA contains a list of the permissible purposes under the law. These are:

      As ordered by a court or a Federal grand jury subpoena. Section 604(a)(1)

      As instructed by the consumer in writing. Section 604(a)(2)

      For the extension of credit as a result of an application from a consumer, or the review or collection of a consumer's account. Section 604(a)(3)(A)

      For employment purposes, including hiring and promotion decisions, where the consumer has given written permission. Sections 604(a)(3)(B) and 604(b)

      For the underwriting of insurance as a result of an application from a consumer. Section 604(a)(3)(C)

      When there is a legitimate business need, in connection with a business transaction that is initiated by the consumer. Section 604(a)(3)(F)(i)

      To review a consumer's account to determine whether the consumer continues to meet the terms of the account. Section 604(a)(3)(F)(ii)

      To determine a consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status. Section 604(a)(3)(D)

      For use by a potential investor or servicer, or current insurer, in a valuation or assessment of the credit or prepayment risks associated with an existing credit obligation. Section 604(a)(3)(E)

      For use by State and local officials in connection with the determination of child support payments, or modifications and enforcement thereof. Sections 604(a)(4) and 604(a)(5)

      In addition, creditors and insurers may obtain certain consumer report information for the purpose of making unsolicited offers of credit or insurance. Section 604(c). The particular obligations of users of ``prescreened'' information are described in Section VII below.

   2. Users Must Provide Certifications

      Section 604(f) of the FCRA prohibits any person from obtaining a consumer report from a consumer reporting agency (CRA) unless the person has certified to the CRA (by a general or specific certification, as appropriate) the permissible purpose(s) for which the report is being obtained and certifies that the report will not be used for any other purpose.

   3. Users Must Notify Consumers When Adverse Actions Are Taken

      The term ``adverse action'' is defined very broadly by Section 603 of the FCRA. ``Adverse actions'' include all business, credit, and employment actions affecting consumers that can be considered to have a negative impact--such as unfavorably changing credit or contract terms or conditions, denying or canceling credit or insurance, offering credit on less favorable terms than requested, or denying employment or promotion.

      1. Adverse Actions Based on Information Obtained From a CRA

         If a user takes any type of adverse action that is based at least in part on information contained in a consumer report, the user is required by Section 615(a) of the FCRA to notify the consumer. The notification may be done in writing, orally, or by electronic means. It must include the following:

         The name, address, and telephone number of the CRA (including a toll-free telephone number, if it is a nationwide CRA) that provided the report.

         A statement that the CRA did not make the adverse decision and is not able to explain why the decision was made.

         A statement setting forth the consumer's right to obtain a free disclosure of the consumer's file from the CRA if the consumer requests the report within 60 days.

         A statement setting forth the consumer's right to dispute directly with the CRA the accuracy or completeness of any information provided by the CRA.

         [[Page 42625]]

      2. Adverse Actions Based on Information Obtained From Third Parties Who Are Not Consumer Reporting Agencies

         If a person denies (or increases the charge for) credit for personal, family, or household purposes based either wholly or partly upon information from a person other than a CRA, and the information is the type of consumer information covered by the FCRA, Section 615(b)(1) of the FCRA requires that the user clearly and accurately disclose to the consumer his or her right to obtain disclosure of the nature of the information that was relied upon by making a written request within 60 days of notification. The user must provide the disclosure within a reasonable period of time following the consumer's written request.

      3. Adverse Actions Based on Information Obtained From Affiliates

         If a person takes an adverse action involving insurance, employment, or a credit transaction initiated by the consumer, based on information of the type covered by the FCRA, and this information was obtained from an entity affiliated with the user of the information by common ownership or control, Section 615(b)(2) requires the user to notify the consumer of the adverse action. The notification must inform the consumer that he or she may obtain a disclosure of the nature of the information relied upon by making a written request within 60 days of receiving the adverse action notice. If the consumer makes such a request, the user must disclose the nature of the information not later than 30 days after receiving the request. (Information that is obtained directly from an affiliated entity relating solely to its transactions or experiences with the consumer, and information from a consumer report obtained from an affiliate are not covered by Section 615(b)(2). If consumer report information is used, the procedures discussed above for consumer reports apply.)

   4. Users Have Obligations When Fraud and Active Duty Military Alerts Are in Files

      When a consumer has placed a fraud alert, including one relating to identity theft, or an active duty military alert in his or her consumer report, Section 605A(h) imposes limitations on users of the reports. For initial fraud alerts and active duty alerts, the user must have reasonable policies and procedures in place to form a belief that the user knows the identity of the applicant or contact the consumer at a telephone number specified by the consumer; in the case of extended fraud alerts, the user must contact the consumer in accordance with the contact information provided in the consumer's alert.

   5. Users Have Obligations When Notified of an Address Discrepancy

      CRAs will notify users that request reports when the address for a consumer provided by the user in requesting the report is different from the address in the consumer's file. Users must comply with regulations specifying the procedures to be followed when this occurs to be issued by the Federal Trade Commission and the banking and credit union regulators. The Federal Trade Commission's regulations will be available at http://www.ftc.gov/credit.

   6. Users Have Obligations When Disposing of Records

      Section 628 of the FCRA requires that all users of consumer report information have in place procedures to properly dispose of records containing this information. The Federal Trade Commission, the Securities and Exchange Commission, and the banking and credit union regulators have issued regulations covering disposal. The Federal Trade Commission's regulations may be found at http://www.ftc.gov/credit .

2. Creditors Must Make Additional Disclosures

   If a person makes credit decisions using a risk-based model-- i.e., the credit grantor offers some consumers interest rates and terms less favorable than those offered to other consumers based on the consumer's credit risk profile derived using consumer report information and makes a credit offer to a consumer ``on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers,'' Section 615(h) of the FCRA requires the credit grantor to disclose this fact to the consumer and to provide certain information. Consumers who receive a notice will be entitled to a free copy of their consumer report. The Federal Trade Commission and the Federal Reserve Board will jointly prescribe rules implementing Section 615(h).

   Section 609(g) requires a disclosure by all persons that make or arrange loans secured by residential real property (one to four units) and that use credit scores. These credit grantors must provide credit scores to applicants and make the disclosure set forth in Section 609(g)(1)(D) (''Notice to the Home Loan Applicant'').

3. Obligations of Users When Consumer Reports Are Obtained for Employment Purposes

   1. Employment Other Than in the Trucking Industry

      If information from a CRA is used for employment purposes, the user has specific duties, which are set forth in Section 604(b) of the FCRA. The user must:

      Make a clear and conspicuous written disclosure to the consumer before the report is obtained, in a document that consists solely of the disclosure, that a consumer report may be obtained.

      Obtain prior written authorization from the consumer.

      Certify to the CRA that the above steps have been followed, that the information being obtained will not be used in violation of any Federal or State equal opportunity law or regulation, and that, if any adverse action is to be taken based on the consumer report, a copy of the report and a summary of the consumer's rights will be provided to the consumer.

      Before taking an adverse action, the user must provide a copy of the report to the consumer as well as the summary of consumer's rights. (The user should receive this summary from the CRA.) A Section 615(a) adverse action notice should be sent after the adverse action is taken.

      An adverse action notice also is required in employment situations if credit information (other than transactions and experience data) obtained from an affiliate is used to deny employment. Section 615(b)(2)

      The procedures for investigative consumer reports and post- employment misconduct investigations are set forth below.

   2. Employment in the Trucking Industry

      Special rules apply for truck drivers where the only interaction between the consumer and the potential employer is by mail, telephone, or computer. In this case, the consumer may provide consent orally or electronically, and an adverse action may be made orally, in writing, or electronically. The consumer may obtain a copy of any report relied upon by the trucking company by contacting the company.

4. Obligations When Investigative Consumer Reports Are Used

   Investigative consumer reports are a special type of consumer report in which information about a consumer's character, general reputation, personal characteristics, and mode of living is obtained through personal interviews. Consumers who are the subjects of such reports are given special rights under the FCRA. If a user intends to obtain an investigative consumer report, Section 606 of the FCRA requires the following:

   The user must disclose to the consumer that an investigative consumer report may be obtained. This must be done in a written disclosure that is mailed, or otherwise delivered, to the consumer at some time before or not later than three days after the date on which the report was first requested. The disclosure must include a statement informing the consumer of his or her right to request additional disclosures of the nature and scope of the investigation as described below, and the summary of consumer rights required by Section 609 of the FCRA. (The summary of consumer rights will be provided by the CRA that conducts the investigation.)

   The user must certify to the CRA that the disclosures set forth above have been made and that the user will make the disclosure described below.

   Upon the written request of a consumer made within a reasonable period of time after the disclosures required above, the user must make a complete disclosure of the nature and scope of the investigation. This must be made in a written statement that is mailed, or otherwise delivered, to the consumer no later than five days after the date on which the request was received from the consumer or the report was first requested, whichever is later in time.

5. Special Proceedures for Employee Investigations

   Section 603(x) of the FCRA provides special procedures for investigations of suspected misconduct by an employee or for compliance with Federal, State or local laws and regulations or the rules of a self-regulatory organization, and compliance with written policies of the employer. These investigations are not treated as consumer reports so long as the employer or its agent complies with the procedures set forth in

   [[Page 42626]]

   Section 603(x), and a summary describing the nature and scope of the inquiry is made to the employee if an adverse action is taken based on the investigation.

6. Obligations of Users of Medical Information

   Section 604(g) of the FCRA limits the use of medical information obtained from consumer reporting agencies (other than payment information that appears in a coded form that does not identify the medical provider). If the information is to be used for an insurance transaction, the consumer must consent to the furnishing of the report or the information must be coded. If the report is to be used for employment purposes or in connection with a credit transaction, the consumer must provide specific written consent and the medical information must be relevant. Any user who receives medical information shall not disclose the information to any other person (except where necessary to carry out the purpose for which the information was disclosed, or as permitted by statute, regulation, or order). The banking and credit union regulators have authority to issue regulations in this area.

7. Obligations of Users of ``Prescreened'' Lists

   The FCRA permits creditors and insurers to obtain limited consumer report information for use in connection with unsolicited offers of credit or insurance under certain circumstances. Sections 603(l), 604(c), 604(e), and 615(d). This practice is known as ``prescreening'' and typically involves obtaining a list of consumers from a CRA who meet certain preestablished criteria. If any person intends to use prescreened lists, that person must (1) before the offer is made, establish the criteria that will be relied upon to make the offer and to grant credit or insurance, and (2) maintain such criteria on file for a three-year period beginning on the date on which the offer is made to each consumer. In addition, any user must provide with each written solicitation a clear and conspicuous statement that:

   Information contained in a consumer's CRA file was used in connection with the transaction.

   The consumer received the offer because he or she satisfied the criteria for credit worthiness or insurability used to screen for the offer.

   Credit or insurance may not be extended if, after the consumer responds, it is determined that the consumer does not meet the criteria used for screening or any applicable criteria bearing on credit worthiness or insurability, or the consumer does not furnish required collateral.

   The consumer may prohibit the use of information in his or her file in connection with future prescreened offers of credit or insurance by contacting the notification system established by the CRA that provided the report. The statement must include the address and toll-free telephone number of the appropriate notification system.

   The Federal Trade Commission will by rule establish the format, type size, and manner of the disclosure required by Section 615(d). The FTC's regulations will be at http://www.ftc.gov/credit. There also are

   special procedures that must be followed with using information obtained from affiliates. These procedures are found in Section 624 of the FCRA.

8. Obligations of Resellers

   1. Disclosure and Certification Requirements

      Section 607(e) of the FCRA requires any person who obtains a consumer report for resale to take the following steps:

      Disclose the identity of the end-user to the source CRA.

      Identify to the source CRA each permissible purpose for which the report will be furnished to the end-user.

      Establish and follow reasonable procedures to ensure that reports are resold only for permissible purposes, including procedures to obtain: (1) the identity of all end-users; (2) certifications from all users of each purpose for which reports will be used; and (3) certifications that reports will not be used for any purpose other than the purpose(s) specified to the reseller. Resellers must make reasonable efforts to verify this information before selling the report.

   2. Reinvestigations by Resellers

      Section 611(f) exempts resellers from the general reinvestigation duties that apply to CRAs, but requires resellers to investigate errors for which they are responsible and to refer other errors to the consumer reporting agencies that provided the reseller with the information that is the subject of the dispute. When any of those CRAs notify the reseller of the results of their investigation, the reseller shall immediately reconvey the information to the consumer.

   3. Fraud Alerts and Resellers

      Section 605A(f) requires resellers who receive fraud alerts or active duty alerts from another consumer reporting agency to include these in their reports.

9. Liability for Violations of the FCRA

   Failure to comply with the FCRA can result in state or federal enforcement actions, as well as private lawsuits. Sections 616, 617, and 621. In addition, any person who knowingly and willfully obtains a consumer report under false pretenses may face criminal prosecution. Section 619.

   By direction of the Commission. Donald S. Clark, Secretary.

   [FR Doc. 04-16010 Filed 7-15-04; 8:45 am]

   BILLING CODE 6750-01-P