Military Credit Monitoring
| Published date | 01 July 2019 |
| Citation | 84 FR 31180 |
| Record Number | 2019-13598 |
| Section | Rules and Regulations |
| Court | Federal Trade Commission |
Federal Register, Volume 84 Issue 126 (Monday, July 1, 2019)
[Federal Register Volume 84, Number 126 (Monday, July 1, 2019)]
[Rules and Regulations]
[Pages 31180-31192]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-13598]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
16 CFR Part 609
RIN 3084-AB54
Military Credit Monitoring
AGENCY: Federal Trade Commission.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Federal Trade Commission (``FTC'' or ``Commission'') is
publishing a final rule to implement the credit monitoring provisions
applicable to active duty military consumers in section 302 of the
Economic Growth, Regulatory Relief, and Consumer Protection Act, which
amends the Fair Credit Reporting Act (``FCRA''). That section requires
nationwide consumer reporting agencies (``NCRAs'') to provide a free
electronic credit monitoring service to active duty military consumers,
subject to certain conditions. The final rule defines ``electronic
credit monitoring service,'' ``contact information,'' ``material
additions or modifications to the file of a consumer,'' and
``appropriate proof of identity,'' among other terms. It also contains
requirements on how NCRAs must verify that an individual is an active
duty military consumer. Further, the final rule contains restrictions
on the use of personal information and on communications surrounding
enrollment in the electronic credit monitoring service.
DATES: The amendments are effective July 31, 2019. However, compliance
is not required until October 31, 2019.
[[Page 31181]]
ADDRESSES: Relevant portions of the record of this proceeding,
including this document, are available at https://www.ftc.gov.
FOR FURTHER INFORMATION CONTACT: Amanda Koulousias (202-326-3334),
[email protected], Bureau of Consumer Protection, Federal Trade
Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580.
SUPPLEMENTARY INFORMATION:
I. Overview and Background
The Economic Growth, Regulatory Relief, and Consumer Protection Act
(``the Act'') was signed into law on May 24, 2018. Public Law 115-174.
The Act, among other things, amends section 605A of the FCRA, 15 U.S.C.
1681c-1, to add a section 605A(k). Section 605A(k)(2) requires that
NCRAs provide free electronic credit monitoring services to active duty
military consumers.
Section 605A(k)(3) of the FCRA requires the Commission to issue a
regulation clarifying the meaning of certain terms used in section
605A(k)(2), including ``electronic credit monitoring service'' and
``material additions or modifications to the file of a consumer.'' In
addition, section 605A(k)(3) requires that the Commission's regulation
clarify what constitutes appropriate proof that an individual is an
active duty military consumer.
On November 16, 2018 (83 FR 57693), the Commission published a
notice of proposed rulemaking (``NPRM''). The proposed rule applied to
NCRAs, as defined in section 603(p) of the Fair Credit Reporting Act,
15 U.S.C. 1681a(p). The proposed rule required the NCRAs to provide a
free electronic credit monitoring service that notifies a consumer of
material additions or modifications to the consumer's file when the
consumer provides (1) contact information, (2) appropriate proof that
the consumer is an active duty military consumer, and (3) appropriate
proof of identity. The proposed rule specified that the NCRA must
provide notification to the consumer within 24 hours of the material
addition or modification. The proposed rule also required that the
notifications to consumers include a hyperlink to a summary of the
consumer's rights under the FCRA, as prescribed by the Bureau of
Consumer Financial Protection under 15 U.S.C. 1681g(c).
The proposed rule defined certain key terms, including ``electronic
credit monitoring service,'' ``electronic notification,'' and
``material additions or modifications.'' The proposed rule also
specified what constitutes appropriate proof that the consumer is an
active duty military consumer.
Further, the proposed rule restricted NCRAs' ability to use and
disclose the information they collect from consumers in order to
provide the required electronic credit monitoring service.
Additionally, the proposed rule contained some limitations on
communications surrounding enrollment in an electronic credit
monitoring service. Finally, the proposed rule prohibited asking or
requiring an active duty military consumer to agree to terms or
conditions in connection with obtaining a free electronic credit
monitoring service.
In response to the NPRM, the Commission received 19 comments from
industry representatives, military and consumer advocacy groups,
government agencies, members of Congress, and individual members of the
public.\1\ In addition to providing feedback on the proposed rule,
commenters highlighted the importance of military consumers' financial
health for overall military readiness and national security. These
commenters noted that ``servicemembers in financial distress are often
forced to leave the military due to loss of security clearance or for
other reasons.'' \2\ Commenters also noted the rule's importance in
protecting military consumers from fraud.\3\
---------------------------------------------------------------------------
\1\ All comments can be found on the FTC's website at: https://www.ftc.gov/policy/public-comments/2018/11/initiative-784.
\2\ See Veterans Education Success et al. (comment 22) at 1 (the
following veteran and military services organizations submitted a
joint comment: Army Aviation Association of America; Association of
Military Surgeons of the United States; Association of the United
States Navy; Enlisted Association of the National Guard of the
United States; Jewish War Veterans; National Guard Association of
the United States; National Military Family Association; Tragedy
Assistance Program for Survivors; Veterans Education Success;
Vietnam Veterans of America).
\3\ Robert Palmersheim (comment 2).
---------------------------------------------------------------------------
II. Section by Section Analysis
a. Scope of Regulations in This Part, Sec. 609.1
Proposed Sec. 609.1 described the statutory authority for the
proposed rule, section 605A(k)(2) of the FCRA, 15 U.S.C. 1681c-1(k)(2).
The Commission received no comments on this section, and adopts it as
proposed.
b. Definitions, Section 609.2
i. Definition of Active Duty Military Consumer, Sec. 609.2(a)
The NPRM proposed defining ``active duty military consumer'' as a
consumer in military service, as defined in the FCRA. Prior to
enactment of the Act, section 603(q)(1) of the FCRA, 15 U.S.C.
1681a(q)(1), defined an ``active duty military consumer'' as a consumer
in military service who--(A) is on active duty (as defined in section
101(d)(1) of title 10, United States Code) or is a reservist performing
duty under a call or order to active duty under a provision of law
referred to in section 101(a)(13) of title 10, United States Code; and
(B) is assigned to service away from the usual duty station of the
consumer. The Act added section 605A(k)(1) to the FCRA, 15 U.S.C.
1681c-1(k)(1), and specified that, in the credit monitoring subsection,
the term ``active duty military consumer'' also includes a member of
the National Guard, with the term ``National Guard'' having the meaning
given the term in section 101(c) of title 10, United States Code. Thus,
the proposed rule defined ``active duty military consumer'' as a
``consumer in military service as defined in 15 U.S.C. 1681a(q)(1) and
1681c-1(k)(1).'' \4\
---------------------------------------------------------------------------
\4\ The Department of Defense (``DoD'') suggested referencing 15
U.S.C. 1681c-1(i)(1) rather than 15 U.S.C. 1681c-1(k)(1), stating
that the former contains the provisions related to the National
Guard. This appears to be based on a misreading of the statute, as
15 U.S.C. 1681c-1(k)(1) does in fact in contain the provisions
related to the National Guard. See DoD--Defense Department (comment
12) at 2.
---------------------------------------------------------------------------
The Commission received several comments on this definition. DoD
expressed concern that the proposed definition could result in military
consumers receiving unequal access to the free credit monitoring
services based on their individual military component, duty status, or
location.\5\ For example, DoD stated that the requirement for the
consumer to be ``assigned to service away from the usual duty station''
is severely limiting, as a military consumer is likely to spend most of
her active duty career assigned to the ``usual duty station.'' DoD
recommended that the Commission modify the definition in order to be
consistent with the definition of active duty in the military
compensation statute,\6\ which does not require that the military
consumer be deployed away from her usual duty station. Military groups
commented that the Commission should defer to DoD on this
definition.\7\ Senators Carper and Coons commented that the rule should
cover ``the largest number of servicemembers as permitted by the
[[Page 31182]]
law.'' \8\ Another commenter recommended that the rule cover retired
military consumers.\9\
---------------------------------------------------------------------------
\5\ See DoD--Defense Department (comment 12) at 1-2.
\6\ 37 U.S.C. 101(18).
\7\ See Veterans Education Success et al. (comment 22) at 2.
This commenter noted that increased deployments and training require
Guard and Reserve members to maintain their financial readiness
because they can be called up at a moment's notice.
\8\ See Letter from Senator Thomas R. Carper and Senator
Christopher A. Coons of the United States Senate Regarding the
Military Credit Monitoring Rulemaking Proceeding and the Proposed
Rule Set Forth in the Notice of Proposed Rulemaking (January 23,
2019) at 2.
\9\ Patrick Mabry (comment 9).
---------------------------------------------------------------------------
While the Commission recognizes and appreciates the policy
rationale behind broadening the group of military consumers who are
eligible to receive free credit monitoring, the statutory language
limits the Commission's discretion on this topic. In amending the FCRA,
Congress recognized that the FCRA's existing definition of ``active
duty military consumer'' excluded members of the National Guard.
Congress specified that, for purposes of the credit monitoring
provisions, an ``active duty military consumer,'' includes a member of
the National Guard.\10\ The fact that the Act addressed the exclusion
of the National Guard, but not the definition's requirement that the
military consumer be ``assigned to service away from the usual duty
station,'' suggests that Congress may have intended for that limitation
to remain. To the extent that Congress intended to provide free credit
monitoring more broadly, i.e., to all active duty military, regardless
of their duty station, the Commission calls on Congress to address this
issue through additional legislation. If Congress passes legislation to
provide the Commission with statutory authority to promulgate a more
expansive rule, the Commission will act expeditiously to do so.
---------------------------------------------------------------------------
\10\ 15 U.S.C. 1681c-1(k)(1).
---------------------------------------------------------------------------
The Commission acknowledges that the proposed rule's definition did
not expressly address whether a National Guard member covered by the
definition in 15 U.S.C. 1681c-1(k)(1) also needs to be assigned to
service away from the usual duty station. The Commission recognizes
that providing National Guard members with free credit monitoring at
all times, while limiting the service for individuals serving in other
military components, such as the Army or Air Force, to those assigned
away from their usual duty station, would result in an inequitable
distribution of benefits. However, when Congress amended the FCRA to
add section 605A(k)(1), it did not expressly apply the duty station
requirement to National Guard members. Thus, the statutory language is
imprecise on this question. Therefore, notwithstanding this apparent
inequity, the Commission has interpreted the Act as providing the
benefit of free credit monitoring to members of the National Guard
regardless of whether they are assigned away from their usual duty
station. To ensure clarity on this issue, the Commission has determined
to modify the definition of active duty military consumer as (1) a
consumer in military service that meets the original FCRA definition of
``active duty military consumer'' (15 U.S.C. 1681a(q)(1)); or (2) a
member of the National Guard (10 U.S.C. 101(c)).
ii. Definition of Appropriate Proof of Identity, Sec. 609.2(b)
The NPRM proposed defining ``appropriate proof of identity'' as
having the same meaning set forth in 12 CFR 1022.123. That section
requires consumer reporting agencies (``CRAs'') to develop reasonable
policies for determining a consumer's identity for purposes of FCRA
sections 605A (obtaining a fraud alert), 605B (requesting that
information resulting from identity theft be blocked from one's
consumer report), and 609(a)(1) (requesting a file disclosure from a
CRA). The definition is risk-based, meaning that a CRA's policy with
respect to appropriate proof of identity should be commensurate with
the risk of harm to the consumer resulting from misidentification, and
should not unreasonably restrict a consumer's access to statutorily
required services. The NPRM specifically sought comment on whether the
rule should keep this cross-reference to 12 CFR 1022.123, stay silent
on the definition, or develop a different approach.
The Commission received one comment supporting the NPRM definition
and two comments recommending changes. The Consumer Data Industry
Association (``CDIA'') commented that referencing the existing standard
would reduce the implementation burden for its NCRA members.\11\
Consumer and military groups recommended that the Commission tailor
``appropriate proof of identity'' to the unique circumstances of
military consumers.\12\ These commenters noted that military consumers
often move frequently, making it burdensome for them to provide the 2-
year address history that CRAs currently require for identity
validation for file disclosures. These commenters also stated the NCRAs
require less identifying information from consumers who are purchasing
their credit report than they do from consumers who are seeking access
to their free annual credit report.
---------------------------------------------------------------------------
\11\ See CDIA (comment 23) at 10.
\12\ See National Consumer Law Center (``NCLC'') et al. (comment
20) at 5 (the following consumer groups submitted a joint comment:
NCLC, Americans For Financial Reform Education Fund, Center for
Digital Democracy, Consumer Action, Consumer Federation of America,
Demos, National Association of Consumer Advocates, Public Citizen,
US PIRG, Woodstock Institute, East Bay Community Law Center, Housing
and Economic Rights Advocates, Tzedek DC, and the Legal Aid Society
of Palm Beach County); Veterans Education Success et al. (comment
22) at 2.
---------------------------------------------------------------------------
After carefully considering the comments received, the Commission
has determined to retain the definition of ``appropriate proof of
identity'' without modification. The existing definition requires the
NCRAs to develop ``reasonable requirements'' that take into account the
``identifiable risk of harm'' that could result from
misidentification.\13\ The Commission interprets the existing
standard's reasonableness requirement to obligate the NCRAs to consider
the unique circumstances of military consumers in developing their
requirements for proof of identity for the free electronic credit
monitoring service. They must weigh any such considerations against the
risk of harm from providing sensitive credit report information to the
wrong consumer while not restricting access to the statutorily mandated
services unreasonably. In response to the concern that NCRAs currently
require less identifying information for paid services than for free
services, the Commission notes that the fact that a consumer is
requesting a free rather than a paid service should not by itself
prompt a higher standard for proof of identity, unless the NCRA is
using the payment method as an additional form of authentication or
there are other identified aspects of the unpaid service that increase
the fraud risk.
---------------------------------------------------------------------------
\13\ 12 CFR 1022.123(a).
---------------------------------------------------------------------------
iii. Definition of Electronic Credit Monitoring Service, Sec. 609.2(g)
The proposed rule defined ``electronic credit monitoring service''
as a service through which NCRAs provide, at a minimum, electronic
notification of material additions or modifications to a consumer's
file. The Commission solicited comment as to whether this definition is
adequate or if any modifications are necessary.
Several commenters stated that the proposed definition is not
adequate and that the Commission should expand it to include free
electronic access to the consumer's credit file following a
notification of a material addition or modification.\14\ Commenters
noted that
[[Page 31183]]
without this free access, military consumers may be required to pay to
examine their credit files following the receipt of a notification. One
commenter stated that the information contained in the files of the
three NCRAs is not always the same and recommended that the rule
provide free access to the credit files at all three NCRAs following a
notification.\15\ The commenters also noted that commercial credit
monitoring products typically include access to credit reports.
---------------------------------------------------------------------------
\14\ See, e.g., NCLC et al. (comment 20) at 2-3; Veterans
Education Success et al. (comment 22) at 1-2; Mass Mail Campaign
(comment 13); Law Office of Phillip R. Goldberg (comment 19); Jeff
Seymour (comment 18).
\15\ Veterans Education Success et al. (comment 22) at 1-2.
---------------------------------------------------------------------------
The Commission agrees with the commenters that free access to their
credit files following a notification will allow the active duty
military consumer to evaluate the addition or modification in the
context of their entire credit report without being required to pay for
that access in connection with a service that Congress intended them to
receive for free. Indeed, current commercial credit monitoring services
offered by the NCRAs advertise that they provide consumers with access
to their credit files. However, the Commission declines to require an
NCRA to pay the costs of obtaining a consumer's credit files from the
other two NCRAs for the purposes of providing the files to the
consumer. Instead, consumers who are concerned about potential
discrepancies in their files at the three NCRAs can request free credit
monitoring services from all three of them.
Given the comments received, the Commission modifies the definition
of electronic credit monitoring service as follows: A service through
which NCRAs provide, at a minimum, electronic notification of material
additions or modifications to a consumer's file and following a
notification, access to all information in the consumer's file at the
NCRA at the time of the notification, in accordance with 15 U.S.C.
1681g(a).\16\
---------------------------------------------------------------------------
\16\ 15 U.S.C. 1681c-1(k)(2) states that the free electronic
credit monitoring service shall ``at a minimum'' notify the consumer
of material additions or modifications to the file, and 15 U.S.C.
1681c-1(k)(3) requires the Commission's rule to define electronic
credit monitoring service. Thus, the statute contemplates that the
Commission can define electronic credit monitoring service to
include other features.
---------------------------------------------------------------------------
iv. Definition of Electronic Notification, Sec. 609.2(h)
The proposed rule defined ``electronic notification'' as a notice
provided to the consumer via a website; mobile application; email; or
text message. The NPRM asked whether this definition is adequate or
whether the rule should include additional methods.
The Commission received a number of comments on this definition.
CDIA commented that it appreciates the flexibility the definition gives
and noted that the proposed definition includes the methods of delivery
currently in use in the marketplace.\17\ Consumer groups raised a
concern that website notifications could result in the NCRAs not
actively informing military consumers of material changes, instead
requiring the consumer to regularly and proactively check their account
on the website. They recommended that the Commission clarify that, when
a notification is made via website, there should be some form of active
``push'' notification, whether via email, text, or mobile app
notification, of the fact that there have been material additions or
modifications.\18\ This would ensure a consumer is notified of changes,
even if the consumer must then go to the website to determine what that
actual change is. Blue Star Families recommended that the notification
methods include encrypted messaging platforms such as WhatsApp or
Signal, which military consumers may commonly use during training
events or deployment.\19\ They also recommended that military consumers
be able to designate an alternate point of contact when they don't have
access to notification platforms or the ability to take action based on
an alert.
---------------------------------------------------------------------------
\17\ See CDIA (comment 23) at 5.
\18\ See NCLC et al. (comment 20) at 4-5.
\19\ See Blue Star Families (comment 24) at 1.
---------------------------------------------------------------------------
The Commission has carefully considered the comments received. As
to the use of encrypted messaging platforms, the Commission notes that
the proposed definition already allows the NCRAs to provide notices via
mobile applications; thus, no change to the rule is necessary to allow
them to provide notices via these platforms. As to allowing an
alternate point of contact, the Commission is concerned about the
security implications of requiring NCRAs to transmit sensitive alerts
about consumers' credit information to multiple points of contact.
Although the Commission declines to modify the proposed rule to require
alternative points of contact, we understand the concerns that the
military consumer may be unable to access notification platforms or
take action based on alerts while deployed. Accordingly, the Commission
encourages the NCRAs to explore options for addressing these issues.
Finally, as to notification via website, the Commission agrees that
military consumers should not have to proactively log onto to a website
in order to continually check whether a material addition or
modification has been made to their files. Instead, there should be
some form of active notification. Accordingly, the final rule deletes
the reference to allowing notification by website. It continues to
require electronic notification of material additions or modifications
by mobile application, email, or text message, but clarifies that the
notices can link to a website where the consumer can find additional
information regarding the specifics of the addition or modification.
v. Definition of Free, Sec. 609.2(k)
The proposed rule defined ``free'' as ``provided at no cost to the
consumer.'' The Commission received one comment on this definition.
Senators Carper and Coons recommended that the Commission define
``free'' to prohibit the secondary use of military consumers' personal
information; the disclosure of such information to third parties; the
use of such information for marketing purposes; or the implication that
the consumer should purchase identity theft insurance.\20\ The
Commission agrees with the Senators that the rule should not allow
secondary uses, disclosures to third parties, or the use of information
for marketing purposes, but does not believe that a change to the
definition of ``free'' is necessary. As discussed below, the rule
already specifies that the NCRAs can use information collected to
provide the military credit monitoring service only in four instances:
To provide the service requested by the consumer; to process a
transaction requested by the consumer at the same time he or she
requests the service; to comply with applicable legal requirements; or
to update information the NCRA already maintains for the purpose of
providing consumer reports, with certain limitations. Thus, the rule
would not permit the uses contemplated by the commenters. As to the
suggestion that the definition of ``free'' prohibit the implication
that the consumer should purchase identity theft insurance, the rule
already requires NCRAs to delay all marketing until after the consumer
has enrolled in the free electronic credit monitoring service. This
requirement would include marketing of insurance products. Given the
restrictions on information use, disclosure, and marketing in other
sections of the rule, the Commission has determined to
[[Page 31184]]
adopt the proposed rule's definition of ``free'' without modification.
---------------------------------------------------------------------------
\20\ See Letter from Senator Thomas R. Carper and Senator
Christopher A. Coons of the United States Senate Regarding the
Military Credit Monitoring Rulemaking Proceeding and the Proposed
Rule Set Forth in the Notice of Proposed Rulemaking (January 23,
2019) at 2.
---------------------------------------------------------------------------
vi. Definition of Material Additions or Modifications, Sec. 609.2(l)
The NPRM defined ``material additions or modifications'' as
significant changes to a consumer's file, including the establishment
of new accounts; inquiries or requests for a consumer report, other
than for prescreening or account review; changes to name, address, or
phone number; changes to credit account limits; and negative
information. The Commission requested comment on whether this
definition was adequate or if the rule should add other elements. The
Commission also requested comment on specific issues related to this
definition, including whether changes to credit account limits should
remain; whether the exceptions for prescreening and account review are
appropriate; and whether NCRAs have the ability to differentiate
between inquiries made for the purposes of account review and
collection.
The Commission received two comments recommending global changes to
the definition of material additions or modifications. First, consumer
groups recommended that the definition provide an exhaustive list of
material changes and that the NCRAs be required to get Commission
approval to provide notifications for any changes not on that list.\21\
They expressed concern that without such a limitation, the NCRAs may
over-notify military consumers and cause unnecessary alarm. Second,
CDIA recommended that the list of material changes be examples and that
the Commission provide a safe harbor for the NCRAs to provide their
commercial credit monitoring services to active duty military consumers
for free.\22\ CDIA expressed concern that without a safe harbor, the
rule will force the NCRAs to develop new products and services. CDIA
noted that Congress chose to require only one portion of the consumer
reporting market--the NCRAs--to provide their credit monitoring
services to active duty military consumers for free. Therefore, CDIA
stated that the Commission should seek to reduce the burdens and costs
placed on the NCRAs.
---------------------------------------------------------------------------
\21\ See NCLC et al. (comment 20) at 4.
\22\ See CDIA (comment 23) at 6-9.
---------------------------------------------------------------------------
The Commission does not believe it is necessary for the rule to
provide an exhaustive list of material additions or modifications
because the Commission believes the risk of over-notification from
allowing NCRAs to notify consumers of additional changes is low. The
NCRAs do not have an incentive to increase their costs by providing
excessive notifications to military consumers.
The Commission also declines to grant the NCRAs a safe harbor for
providing their commercial credit monitoring services to military
consumers for free. The Act requires the Commission to promulgate a
rule that defines ``material additions or modifications to the file of
a consumer.'' In the absence of a minimum standard, NCRAs could create
new tiers for commercial credit monitoring products and offer active
duty military consumers free versions of a new product with only
limited features. Congress could not have intended this result.
At the same time, the Commission appreciates that providing a free
electronic credit monitoring service to active duty military consumers
will place costs and burdens on the NCRAs. Thus, as discussed below,
the Commission has sought to align the requirements with the NCRAs'
existing commercial credit monitoring services as much as possible
while ensuring that the service required by the rule provides
appropriate consumer protections.
In addition to receiving global comments on the definition of
``material addition or modification,'' the Commission received comments
on several specific proposals. First, the proposed rule's inclusion of
changes to a consumer's name, address, or phone number was the subject
of several comments. One commenter expressed support for including
these changes.\23\ Another commenter recommended that the rule also
include a change to email address as a material addition or
modification because the CRAs typically notify customers of their
commercial credit monitoring services of changes via email.\24\ On the
other hand, CDIA recommended that the Commission remove changes to
consumers' names, addresses and phone numbers from the definition
because those changes are not uniformly part of the NCRAs' commercial
credit monitoring products.\25\
---------------------------------------------------------------------------
\23\ See NCLC et al. (comment 20) at 3.
\24\ See Anonymous Students (comment 8).
\25\ See CDIA (comment 23) at 8.
---------------------------------------------------------------------------
After considering these comments, the Commission has decided to
retain the requirement to notify consumers of changes to their address.
The Commission is concerned that failing to provide a notification
about the appearance of a new address in a consumer's file will
potentially leave consumers without notice of a key indicator of fraud.
For example, an identity thief may change the address listed on a
consumer's existing credit card account in order to reroute statements
so that the consumer does not see fraudulent charges. At least one of
the NCRAs currently provides alerts for address changes.\26\
Additionally, it appears that new addresses are monitored in all three
of the NCRAs' consumer files.\27\ Furthermore, in other sections of the
FCRA, Congress has put in place requirements that suggest it believed
that a change in address could be a sign of fraud.\28\ To lessen the
chance of over-notification, the Commission has decided to modify the
requirement to clarify that only a material change to an address
requires notification. Thus, if the address 123 Main Street was already
included in a consumer's file, the NCRAs are not required to provide a
notification if a creditor reports an address of 123 Main St.\29\
---------------------------------------------------------------------------
\26\ See Equifax, What types of credit monitoring alerts should
I expect to receive?, https://help.equifax.com/s/article/What-types-of-credit-monitoring-alerts-should-I-expect-to-receive (last visited
May 2, 2019). A number of commercial credit monitoring services
provided by companies other than the NCRAs also advertise that they
provide alerts for address changes in consumers' files. See, e.g.,
LastPass, What triggers a credit monitoring alert, https://lastpass.com/support.php?cmd=showfaq&id=3926 (last visited May 2,
2019).
\27\ See myFICO, https://www.myfico.com/Include/Store/Legal/FAQAlertMatrix (last visited May 2, 2019).
\28\ 15 U.S.C. 1681c(h) (related to notice of discrepancy in
address); 15 U.S.C. 1681m(e)(C) (related to regulations for card
issuers regarding changes of address).
\29\ However, as discussed above, the rule's list of material
additions or modifications is non-exhaustive, thus the NCRAs may
provide notifications of these types of changes if they choose.
---------------------------------------------------------------------------
However, the Commission has decided to remove the requirement that
the NCRAs provide notifications for changes to name and phone number.
Unlike addresses, it is not clear whether changes to the names and
phone numbers in consumers' files are routinely monitored or included
in commercial credit monitoring alerts. For similar reasons, the
Commission declines to require notifications for changes to email
address. Of course, nothing in the rule prohibits the NCRAs from
providing such alerts if they choose to do so.
Second, several commenters addressed the definition's inclusion of
changes to credit account limits. Some commenters recommended retaining
notification for changes to credit account limits, noting that this
information is useful to military consumers.\30\ CDIA recommended
[[Page 31185]]
removing changes to credit account limits because NCRAs do not
uniformly include notification of changes to account limits in
commercial credit monitoring services, such changes are not indicative
of identity theft or fraud, and the proposed rule gives no guidance on
what level of change in account limits would be material.\31\
---------------------------------------------------------------------------
\30\ See NCLC et al. (comment 20) at 4; Blue Star Families
(comment 24) at 1. For example, NCLC noted that credit card issuers
are not always required to notify consumers about decreased account
limits.
\31\ See CDIA (comment 23) at 8.
---------------------------------------------------------------------------
The Commission has decided to retain the category of ``changes to
credit account limits'' in the list of material additions and
modifications of which consumers must be notified. The Commission
disagrees with the comment that changes to credit account limits are
not indicative of identity theft or fraud. For example, an identity
thief may call a credit card company and request that an account limit
be raised so that she can make additional fraudulent charges. Indeed,
in drafting the FCRA provision dealing with fraud alerts, Congress
prohibited creditors from increasing the credit limit on an existing
account that contains a fraud alert without verifying the requestor's
identity. This prohibition illustrates that Congress believed that such
a change in account limits could be indicative of fraud. For these
reasons, the Commission declines to remove changes to credit account
limits from the list of material additions or modifications. The
Commission does recognize that the proposed rule did not set a
threshold for a material change and that a lack of such a threshold
could create uncertainty in the marketplace. Thus, the Commission has
determined that the rule will require notifications for changes to
credit account limits of $100 or greater. These are the types of
changes that are monitored in at least one of the NCRA's consumer
files.\32\
---------------------------------------------------------------------------
\32\ See myFICO, https://www.myfico.com/Include/Store/Legal/FAQAlertMatrix (last visited May 2, 2019).
---------------------------------------------------------------------------
Third, the proposed rule included inquiries or requests for a
consumer report as a material addition or modification, with an
exception for inquiries for prescreening or account review. The NPRM
noted that notifying consumers of pre-screening or account review
inquiries could result in over-notification, making it difficult for
consumers to determine when an inquiry indicates that they are
potentially the victim of identity theft or other fraud. The proposed
rule did not include an exception for inquiries for the purposes of
account collection, but the NPRM asked whether NCRAs have the ability
to differentiate between account collection and account review
inquiries.
CDIA's comment indicated that NCRAs cannot distinguish between
account review and collection.\33\ CDIA explained that the NCRAs only
require companies to provide their permissible purpose for obtaining a
consumer report, but that the permissible purpose for account review
and account collection is the same. Thus, if the rule were to require
notifications of inquiries made for account collection (as the proposed
rule did), NCRAs would likely provide notifications of inquiries for
account review, which could result in overnotification. Accordingly,
CDIA recommended notification be limited to ``inquiries or requests for
a consumer report in connection with the establishment of a new credit
plan or extension of credit, other than under an open-end credit plan
(as defined in section 103(i)),\34\ in the name of the consumer.'' \35\
CDIA noted that similar language is used elsewhere in the FCRA.\36\
---------------------------------------------------------------------------
\33\ See CDIA (comment 23) at 9.
\34\ An open-end credit plan is ``a plan under which the
creditor reasonably contemplates repeated transactions, which
prescribes the terms of such transactions, and which provides for a
finance charge which may be computed from time to time on the
outstanding unpaid balance.'' 15 U.S.C. 1602(j). A typical example
of an open-end credit plan is a credit card. Thus, under the
recommended language an inquiry triggered by a creditor conducting
account review for an existing credit card account would not require
notification.
\35\ See CDIA (comment 23) at 6-7.
\36\ See 15 U.S.C. 1681c-1(h).
---------------------------------------------------------------------------
Given that the NCRAs do not differentiate between inquiries for
account review and account collection, the Commission agrees that
inquiries for account collection should be excepted. The Commission
notes that if a company establishes a new collection account, the NCRA
would already have to send a notification because new accounts are
included in the list of material additions or modifications. To ensure
that there is no ambiguity about that requirement, the Commission has
decided to modify Sec. 609.2(l)(1) to provide that significant changes
to a consumer's file includes new accounts opened in the consumer's
name, including new collection accounts. With respect to Sec.
609.2(l)(2), the Commission declines to adopt CDIA's proposed language.
The proposed language would only require notification for inquiries or
requests for a consumer report in connection with a credit transaction.
Thus, for example, military consumers would not receive a notification
if an employer or insurer requested their report because someone
applied for employment or insurance in their name, which could be
indicative of identity theft. Therefore, the Commission has determined
to modify Sec. 609.2(l)(2)(i) to provide that an inquiry made for a
prescreened list obtained for the purpose of making a firm offer of
credit or insurance as described in 15 U.S.C. 1681b(c)(1)(B) or for the
purpose of reviewing or collecting an account of the consumer shall not
be considered a material addition or modification.
Finally, two commenters recommended adding a significant drop in
credit score, such as 25 points or more, to the list of material
additions or modifications. These commenters suggested that such a drop
may indicate a significant change to the consumer's file, possibly due
to fraud.\37\ Military groups also noted that a large drop in credit
score could signal a problem that leads to revocation of a military
consumer's security clearance.
---------------------------------------------------------------------------
\37\ See NCLC et al. (comment 20) at 3 (NCLC suggested that a
credit score drop might be caused by a drastic increase in the usage
of a credit line, due to existing account fraud); Veterans Education
Success et al. (comment 22) at 2-3.
---------------------------------------------------------------------------
Although the Commission is sympathetic to these concerns, it
declines to make this change. The rule already requires the NCRAs to
provide a notification about events that would likely cause a
significant drop in credit score, such as a delinquency. Beyond
requiring notification of substantive events that would likely cause a
significant drop in credit score, the Commission does not have
information at this time to determine the feasibility and costs of this
proposal. For example, it is not clear how often the NCRAs are
calculating credit scores in the absence of a request from a consumer
or creditor. Nor is it clear how much it would cost NCRAs to
continuously monitor credit scores for the purpose of providing an
alert when there is a significant drop. Thus, the Commission declines
to include this change.
vii. Definition of Negative Information, Sec. 609.2(n)
The NPRM defined ``negative information'' as having the meaning
provided in 15 U.S.C. 1681s-2(a)(7)(G)(i), which in turn defines
``negative information'' to mean ``information concerning a customer's
delinquencies, late payments, insolvency, or any form of default,'' in
the context of furnishers providing information to the CRAs. The
Commission received one comment on this definition. CDIA noted that the
proposed definition does not provide enough specificity to the NCRAs as
to
[[Page 31186]]
when notification is required.\38\ CDIA recommended that the Commission
modify the definition as follows: Accounts furnished to the NCRAs as
more than 30 days delinquent, accounts furnished to the NCRAs as being
included in bankruptcy petition filings, and new public records (such
as suits or judgments). The Commission believes that CDIA's proposed
language covers the negative information that the Commission intended
for the proposed rule to require notification of and therefore has
decided to modify the language to provide the NCRAs greater
specificity. The Commission is also adding additional detail to provide
a non-exhaustive list of what types of new public records may
constitute negative information. Thus, the Commission has decided to
modify the definition of ``negative information'' as follows: Accounts
furnished to the NCRAs as more than 30 days delinquent, accounts
furnished to the NCRAs as being included in bankruptcy petition
filings, and new public records, including, but not limited to,
bankruptcy filings, civil court judgments, foreclosures, liens, and
convictions.
---------------------------------------------------------------------------
\38\ See CDIA (comment 23) at 8-9.
---------------------------------------------------------------------------
viii. Definitions of Consumer, Consumer Report, Contact Information,
Credit, File, Firm Offer of Credit, and Nationwide Consumer Reporting
Agency
The Commission received no comments on the proposed rule's
definitions of ``consumer,'' ``consumer report,'' ``contact
information,'' ``credit,'' ``file,'' ``firm offer of credit,'' and
``nationwide consumer reporting agency.'' The Commission adopts these
definitions without modification.
c. Requirement To Provide Free Electronic Credit Monitoring Service,
Sec. 609.3
Proposed Sec. 609.3(a) required the NCRAs to provide a free
electronic credit monitoring service to active duty military
consumers.\39\ Proposed Sec. 609.3(b) allowed the NCRAs to condition
provision of the service upon the consumer providing appropriate proof
of identity; contact information; and appropriate proof that the
consumer is an active duty military consumer. Proposed Sec. 609.3(c)
provided the methods for verifying a consumer's status as an active
duty military consumer. Proposed Sec. 609.3(d) limited the ways that
the NCRAs can use or disclose the information collected from consumers
as a result of a request to obtain the service. Proposed Sec. 609.3(e)
placed limitations on the types of communications that may surround
enrollment in the service. Proposed Sec. 609.3(f) prohibited asking or
requiring a consumer to agree to terms or conditions in connection with
obtaining the service.
---------------------------------------------------------------------------
\39\ The Commission received one comment stating that the FTC
should seek rulemaking authority to provide free credit monitoring
services to all U.S. residents and not just active duty military
consumers. Electronic Privacy Information Center (comment 26) at 2-
3. The Commission does not take a position on the merits of this
proposal because it is outside the scope of this rulemaking.
---------------------------------------------------------------------------
i. Appropriate Proof of Active Duty Military Consumer Status, Sec.
609.3(c)
The proposed rule required NCRAs to verify a consumer's status as
an active duty military consumer through one of four methods: A copy of
the consumer's active duty orders; a copy of a certification of active
duty status issued by the DoD; a method or service approved by the DoD;
or a certification of active duty status approved by the NCRA. The
Commission requested comment on whether these methods are adequate or
if other methods should be included. The Commission also asked whether
it is burdensome for consumers to provide appropriate proof, and if so,
if there are ways to minimize the burden.
The Commission received several comments on the methods for
validating a consumer's active duty military consumer status. CDIA
recommended that the Commission work with DoD to come up with an
automated system to conclusively determine whether a consumer is
eligible for the service and that will also verify the time period for
which the consumer is eligible for the service.\40\ Absent an automated
system, CDIA stated that the Commission should clarify that the
determination of active duty status is valid for two years and then
must be renewed. Consumer groups similarly suggested that the NCRAs be
allowed to use the DoD developed database that lenders use to comply
with the Military Lending Act (``MLA'').\41\
---------------------------------------------------------------------------
\40\ See CDIA (comment 23) at 11.
\41\ See NCLC et al. (comment 20) at 6.
---------------------------------------------------------------------------
With respect to the requests for an automated system run by the
DoD, the Commission notes that if DoD were to develop such a system, it
would be considered ``a method or service approved by the DoD'' and
thus would not require any modification to the rule. The Commission
will work with the DoD to explore whether a DoD-run system or database
is viable.\42\ The Commission agrees that in the absence of an
automated system, the rule should specify a period of time for which
the determination of active duty status is valid. The Commission
believes that the two-year time period suggested by CDIA is reasonable.
Indeed, it is twice as long as the duration of an active duty military
fraud alert.\43\ Therefore, the Commission is adding a provision to the
final rule establishing that an NCRA's verification of active duty
military consumer status is valid for two years. After the expiration
of the two-year period, the NCRA may require the consumer to provide
proof that the consumer continues to be an active duty military
consumer.
---------------------------------------------------------------------------
\42\ With respect to the comment that NCRAs be allowed to use
the MLA database, the Commission notes that DoD currently only
allows the database to be used for determining whether someone is
eligible for MLA protections. In any event, the definition of a
covered borrower under the MLA is more expansive than the rule's
definition of active duty military consumer. For example, the MLA
regulations do not require that a military consumer be assigned to
service away from their usual duty station. They also cover
dependents. See 32 CFR 232.3(g).
\43\ 12 CFR 1022.121.
---------------------------------------------------------------------------
Military groups recommended that the Commission remove the option
for a certification approved by the NCRA because it may allow
inadequate methods of proof.\44\ The Commission believes that it would
benefit military consumers to allow the NCRAs to accept additional
certifications of their choosing, such as having the consumer check a
box certifying that they are an active duty military consumer. If the
NCRA decides that the ease of such a method outweighs the risk that
some consumers may misrepresent that they are eligible for the free
service, any costs of such a determination would be borne by the NCRA.
---------------------------------------------------------------------------
\44\ See Veterans Education Success et al. (comment 22) at 2.
---------------------------------------------------------------------------
Various commenters recommended additional methods of validation.
One commenter raised concerns about whether the current methods of
proof would cover members of the National Guard when not on active duty
orders.\45\ This commenter suggested that a current leave and earnings
statement is a method of proof that would be available to the National
Guard.\46\ Another commenter suggested that a letter from the
consumer's commanding officer should be appropriate proof.\47\
---------------------------------------------------------------------------
\45\ See NCLC et al. (comment 20) at 6-7.
\46\ See NCLC et al. (comment 20) at 6. See also Veterans
Education Success et al. (comment 22) at 2; NCLC et al.
\47\ American Financial Services Association (comment 21) at 2.
Another commenter suggested that the methods should include a letter
other than active duty orders because the commenter stated that
orders may include the consumer's Social Security number. See
Marlatt (comment 7).
---------------------------------------------------------------------------
The Commission understands the desire to provide military consumers
[[Page 31187]]
and the NCRAs flexibility in the types of documentation that they can
use to verify active duty military consumer status. In light of the
fact that what constitutes appropriate proof for National Guard members
will likely differ from that for active duty military more generally,
the Commission has decided not to attempt to include a list of all
suitable documents in the rule. Rather, to allow maximum flexibility,
the Commission has decided to retain two of the methods from the
proposed rule: (1) A method or service approved by the DoD; and (2) a
certification of active duty status approved by the NCRA. The
Commission notes that while it is removing the two additional methods
that were in the proposed rule: (1) A copy of the consumer's active
duty orders; and (2) a copy of a certification of active duty status
issued by the DoD--those documents, as well as the additional documents
recommended by the commenters, can still be incorporated into a
certification method approved by DoD or the NCRA.
The Commission is also clarifying that the procedures that the
NCRAs use to determine appropriate proof of active duty military
consumer status must include methods that allow all eligible consumers
to enroll. For example, an NCRA cannot decide that the only proof of
status it will accept from a member of the National Guard is active
duty orders, given that most members of the National Guard will not
have active duty orders. To the extent that the NCRAs find it difficult
to verify that individuals meet the definition of an ``active duty
military consumer,'' particularly with respect to whether they are
assigned to service away from their usual duty station, the Commission
encourages the NCRAs to err on the side of providing the free service
more broadly. To provide an incentive for the NCRAs to provide the free
service to a broader set of military consumers and to reduce the
likelihood that an eligible consumer is excluded from the free service,
the Commission will deem an NCRA to be in compliance with this
provision if it provides free electronic credit monitoring services to
(1) consumers who self-certify active duty status, as defined in 10
U.S.C. 101(d); (2) consumers who self-certify that they are a reservist
performing duty under a call or order to active duty under a provision
of law referred to in 10 U.S.C. 101(a)(13); and (3) consumers who self-
certify that they are a member of the National Guard, as defined in 10
U.S.C. 101(c).
ii. Information Use and Disclosure, Sec. 609.3(d)
The proposed rule limited the ways that the NCRAs can use or
disclose the information collected from consumers as a result of a
request to obtain the free electronic credit monitoring service. The
proposed rule allowed NCRAs to use the information collected only: (1)
To provide the free electronic credit monitoring service requested by
the consumer; (2) to process a transaction requested by the consumer at
the same time as a request for the service; (3) to comply with
applicable legal requirements; or (4) to update information already
maintained by the NCRA for the purpose of providing consumer reports,
with certain limitations. The NPRM noted that these restrictions on use
and disclosure are identical to the requirements placed on the NCRAs'
collection of personally identifiable information from consumers using
the centralized source for annual credit reports.\48\ The Commission
requested comment on whether the allowed uses and disclosures are
appropriate and whether the rule should permit additional uses.
---------------------------------------------------------------------------
\48\ 12 CFR 1022.136(f).
---------------------------------------------------------------------------
Several commenters supported these restrictions and noted that they
would prevent the use of the personal information collected from
military consumers for marketing or other unanticipated uses.\49\ On
the other hand, CDIA commented that the restrictions are unnecessary in
light of the Commission's authority under Section 5 of the FTC Act to
address unfair or deceptive acts or practices.\50\ CDIA also argued
that the restrictions are beyond the scope of the FTC's statutory
authority under the Act. The American Financial Services Association
commented that the Commission should ensure that the restrictions do
not prevent the information's use for the purpose of studying the
effect the MLA regulations are having on the availability of
credit.\51\
---------------------------------------------------------------------------
\49\ See Electronic Privacy Information Center (comment 26) at
2; NCLC et al. (comment 20) at 7; Veterans Education Success et al.
(comment 22) at 2.
\50\ See CDIA (comment 23) at 12.
\51\ American Financial Services Association (comment 21) at 1-
2. This commenter also requested that the Commission encourage the
DoD to grant consumer reporting agencies permission to pull data
from the MLA database for purposes of such a study. The Commission
does not have any role in administering the MLA database and defers
to DoD as to appropriate uses of the information contained therein.
---------------------------------------------------------------------------
The Commission does not agree that the agency's Section 5 authority
renders the proposed rule's restrictions unnecessary. Under Section 5,
the Commission would be limited to pursuing a law enforcement action in
circumstances where an NCRA deceived a military consumer or used or
disclosed the information in a manner that caused or was likely to
cause substantial injury that was not reasonably avoidable by consumer
themselves and not outweighed by countervailing benefits to consumers
or to competition. However, even in circumstances not involving
deception or substantial injury, the Commission does not believe that
it would be appropriate to make an active duty military consumer's
access to the free electronic credit monitoring service contingent on
the consumer's willingness to allow a NCRA to use the consumer's
information for unrelated, secondary uses. The Commission believes that
the use and disclosure restrictions are within its authority under the
Act because they are necessary to ensure that the Act's purpose of
providing active duty military consumers with free electronic credit
monitoring is not undermined by consumers' concerns about secondary
uses of their personal information.\52\
---------------------------------------------------------------------------
\52\ Section 605A(k)(3) of the FCRA, 15 U.S.C. 1681c-1(k)(3),
requires the Commission to promulgate regulations that ``at a
minimum'' define electronic credit monitoring service and material
additions or modifications to the file of a consumer and state what
constitutes appropriate proof of active duty military status. Thus,
the statute contemplates that the Commission's regulations may go
beyond defining those terms.
---------------------------------------------------------------------------
With respect to the specific request to allow the information to be
used for the purpose of studying the effect MLA regulations have on the
availability of credit, the Commission declines to grant an exception
to allow military consumers' personal information to be used for such a
purpose, which is unrelated to their request for the free electronic
credit monitoring. For these reasons, the Commission has decided to
retain the proposed rule's information use and disclosure restrictions
without modification.
iii. Communications Surrounding Enrollment in Electronic Credit
Monitoring Service, Sec. 609.3(e)
Proposed Sec. [thinsp]609.3(e) placed limitations on the types of
communications that may surround enrollment in the electronic credit
monitoring service, similar to the restriction on advertising on the
annual credit report website.\53\ Proposed Sec. 609.3(e)(1) restricted
any advertising or marketing for products or services, or any
communications or instructions that advertise or market any products
and services, to a consumer who has
[[Page 31188]]
indicated an interest in signing up for the free electronic credit
monitoring service until after the consumer has enrolled in the
service. Section 609.3(e)(2) of the proposed rule specified that any
communications, instructions, or permitted advertising or marketing may
not interfere with, detract from, contradict, or otherwise undermine
the purpose of providing a free electronic credit monitoring service to
active duty military consumers. Section 609.3(e)(3) of the proposed
rule provided examples of conduct that would interfere with, detract
from, contradict, or undermine the purpose of the rule. The Commission
solicited comment on whether the limitations are necessary to ensure
that active duty military consumers are able easily to obtain their
free electronic credit monitoring service. The Commission also asked
whether the limitations impose undue burdens on the NCRAs, and if so,
whether there are ways to minimize the burdens. The Commission also
asked whether there are more examples of prohibited conduct that should
be included in the rule.
---------------------------------------------------------------------------
\53\ 12 CFR 1022.136(g).
---------------------------------------------------------------------------
Consumer groups stated that the limitations are necessary to allow
military consumers to get the free credit monitoring easily without
encountering distracting advertising.\54\ They further recommended that
the Commission prohibit the NCRAs from representing or implying that
the service is inferior to the NCRA's commercial credit monitoring
services. They also recommended that the Commission prohibit the NCRAs
from offering identity theft insurance at any time in connection with
the free credit monitoring because of concerns about the usefulness of
such insurance.
---------------------------------------------------------------------------
\54\ See NCLC et al. (comment 20) at 7; see also Veterans
Education Success et al. (comment 22) at 2.
---------------------------------------------------------------------------
After carefully considering these suggestions, the Commission has
decided not to add prohibitions beyond those already included in the
proposed rule. Section 609.3(e)(3)'s prohibited communications are
designed to ensure that active duty military consumers are not confused
or deceived by communications related to a NCRA's products and
services. If a NCRA makes a deceptive representation to consumers about
its commercial credit monitoring products or identity theft insurance,
the Commission can pursue an enforcement action under Section 5 of the
FTC Act. Some consumers may be interested in paying an additional fee
in order to obtain services that may not be available within the free
electronic credit monitoring service. Therefore, given that the rule
already prohibits marketing until after the consumer has enrolled in
the free service, the Commission does not believe it is necessary to
prohibit truthful advertising regarding the NCRA's products and
services after enrollment.
CDIA stated that the restrictions are unnecessary and outside of
the Commission's statutory authority under the Act.\55\ CDIA also noted
that unlike free annual credit reports, which the NCRAs offer through a
centralized website, the NCRAs will offer the free electronic credit
monitoring through their own commercial websites. CDIA argued that this
makes it more difficult to determine when advertising is and is not
permitted. CDIA criticized the proposed rule's standard of delaying
marketing ``once a consumer has indicated that the consumer is
interested in obtaining the service . . . such as by clicking on a link
for services'' as ambiguous. Therefore, if the Commission retains the
marketing limitations, CDIA requested additional clarification on this
point to make clear that marketing is prohibited only during the
enrollment process. CDIA recommended the following language for Sec.
609.3(e)(1): ``once a consumer is in the process of accessing the
ability to enroll in the service required under paragraph (a) of this
section and only during the enrollment process. . . .''
---------------------------------------------------------------------------
\55\ See CDIA (comment 23) at 13.
---------------------------------------------------------------------------
After considering the comments, the Commission has determined that
retaining the restrictions on communications is necessary to further
the Act's purpose of providing active duty military consumers with a
free electronic credit monitoring service. These restrictions help
ensure that active duty military consumers are not thwarted by
confusing advertisements or communications that dissuade them from
enrolling in the free service.
The Commission recognizes that the proposed rule's limitation on
advertising from the time the consumer ``has indicated an interest in
signing up for the free electronic credit monitoring service'' may have
been unclear. The Commission did not intend to ban advertising on all
web pages of the NCRAs; rather, it sought to limit advertising on pages
that are part of the product enrollment process. To provide greater
clarity, the Commission has decided to modify Sec. 609.3(e)(1) to
provide that once a consumer is in the process of accessing the ability
to enroll in the service required under paragraph (a) and only during
the enrollment process, any advertising or marketing for products or
services, or any communications or instructions that advertise or
market any products and services, must be delayed until after the
consumer has enrolled in that service. The Commission interprets this
to mean that the NCRAs shall not advertise on the pages of the NCRA's
website or app dedicated to providing active duty military consumers
with their rights under this regulation, until after the consumer has
enrolled in the service.
iv. Other Prohibited Practices, Sec. 609.3(f)
The proposed rule also prohibited asking or requiring an active
duty military consumer to agree to terms or conditions in connection
with obtaining a free electronic credit monitoring service. The
Commission asked whether this prohibition is necessary; whether CRAs
currently require customers of commercial credit monitoring services to
agree to terms or conditions; and whether the prohibition imposes undue
burdens on the NCRAs. Commenters that supported the inclusion of these
prohibitions specifically pointed out that without them, the NCRAs
could require military consumers to agree to mandatory arbitration
clauses in order to receive free credit monitoring.\56\ However, CDIA
commented that the prohibitions are unnecessary and outside of the
FTC's statutory authority under the Act.\57\ CDIA also expressed
concern that the NCRAs would be in violation of these prohibitions if
they sought to condition providing the service on the provision of
appropriate proof of identity, contact information, and appropriate
proof of active duty military status, as required by the proposed rule.
CDIA further posited that seeking the consumer's written instructions
to comply with the FCRA's permissible purpose requirements or consent
to receive text notifications pursuant to the Telephone Consumer
Protection Act could violate this provision.
---------------------------------------------------------------------------
\56\ See NCLC et al. (comment 20) at 8; see also Veterans
Education Success et al. (comment 22) at 2.
\57\ See CDIA (comment 23) at 14-15.
---------------------------------------------------------------------------
As the NPRM noted, this restriction is similar to the restriction
for the annual credit report website.\58\ The Commission believes it is
within its statutory authority to ensure that an active duty military
consumer's right to obtain a free electronic credit monitoring service
is unfettered and without any restrictions or conditions, apart from
providing appropriate proof of identity, contact information, and
appropriate proof that the consumer is an active duty military
consumer. The
[[Page 31189]]
Commission believes that allowing the NCRAs to condition provision of
the free electronic credit monitoring service on the consumer's
agreement to a variety of terms and conditions could dissuade military
consumers from availing themselves of the service. However, the
Commission recognizes that there may be certain instances in which
legal requirements may require the NCRAs to receive consumers' consent
for certain aspects of the service. Thus, the Commission has decided to
retain the prohibition with the following modification: A NCRA shall
not ask or require an active duty military consumer to agree to terms
or conditions in connection with obtaining a free electronic credit
monitoring service, other than those terms or conditions required to
comply with applicable legal requirements.
---------------------------------------------------------------------------
\58\ 12 CFR 1022.136(h).
---------------------------------------------------------------------------
d. Timing of Electronic Credit Monitoring Notices, Sec. 609.4
The proposed rule required that the electronic notifications be
provided within 24 hours of any material additions or modifications to
a consumer's file. The Commission requested comment on whether the
proposed rule's 24-hour timing was appropriate. The Commission received
one comment on the timing requirements. CDIA commented that the timing
requirement is outside of the Commission's statutory authority and that
it should be kept out of the final rule. It recommended that if the
timing requirement remains, the Commission should instead require
notifications within 48 hours to be consistent with the NCRA's
commercial credit monitoring services. CDIA also recommended that the
Commission provide a safe harbor for NCRAs to provide notifications
within the same timing that they use for their commercial credit
monitoring services.\59\
---------------------------------------------------------------------------
\59\ See CDIA (comment 23) at 15.
---------------------------------------------------------------------------
The Commission believes it is necessary and within its statutory
authority under the Act to specify the time within which electronic
notifications must be made. If military consumers are not notified of
the material additions or modifications to their files within a
reasonable amount of time, the electronic credit monitoring service
would not be as effective. For example, if a consumer is notified
promptly about a new account that has been fraudulently opened in his
or her name and appears on his or her consumer report, he or she may
decide to place a fraud alert or security freeze on their file, which
may help prevent the opening of additional fraudulent accounts. The
Commission declines to give the NCRAs a safe harbor for providing the
notifications within the same timing that they use for their commercial
credit monitoring products because that timing could change in the
future, and the Commission believes it is necessary to set a baseline.
However, the Commission has decided to modify the timing requirement to
require notification within 48 hours of any material additions or
modifications to a consumer's file. This will align the requirement
with the timing that CDIA states the NCRAs currently use for their
commercial services, while still requiring that the NCRAs provide the
notifications in a prompt manner upon making a change to the consumer's
file.\60\
---------------------------------------------------------------------------
\60\ The Commission notes that there is a lag between when many
events, such as a late payment, occur and when a creditor reports
them to the NCRA and the NCRA updates its files. Thus, the NCRAs can
only provide notification once they are aware of these events, which
means that even with prompt credit monitoring notifications, there
is a delay between when an event occurs and when the consumer will
receive an alert.
---------------------------------------------------------------------------
e. Additional Information To Be Included in Electronic Credit
Monitoring Notices, Sec. 609.5
The proposed rule also required that the electronic notifications
include a hyperlink to a summary of the consumer's rights under the
FCRA, as prescribed by the Bureau of Consumer Financial Protection.\61\
The Commission noted that it would be useful for consumers to be able
to easily access information about their rights to, for example, obtain
consumer reports and dispute information on their reports. The
Commission requested comment on whether requiring this link would
provide useful information to consumers and whether there is a
different method of providing this information that would be more
effective.
---------------------------------------------------------------------------
\61\ 15 U.S.C. 1681g(c).
---------------------------------------------------------------------------
Consumer groups commented that the Commission should also require
the provision of the Summary of Rights of Identity Theft Victims
outlined in 15 U.S.C. 1681g(d).\62\ While the Commission agrees that
the Summary of Rights for Identity Theft Victims also provides useful
information for consumers, the Commission does not believe it is
appropriate to mandate its inclusion in the electronic notifications.
The language of that document contemplates that it will be given to
consumers when they have contacted a CRA about being the victim of
identity theft, which likely will not be true for many of the
recipients of the electronic credit monitoring notices.\63\
---------------------------------------------------------------------------
\62\ See NCLC et al. (comment 20) at 8-9.
\63\ For example, it states at the beginning of the document,
``[y]ou are receiving this information because you have notified a
consumer reporting agency that you believe that you are a victim of
identity theft.'' The Bureau's model document can be found at:
https://files.consumerfinance.gov/f/documents/bcfp_consumer-identity-theft-rights-summary_2018-09.docx.
---------------------------------------------------------------------------
NCLC also recommended that the Commission require a more prominent
method of providing the summary of rights, such as including the
document in the same email or web page, rather than just a
hyperlink.\64\ NCLC also suggested that if the rule requires access to
the credit report following a notification, the summary of rights could
be appended to the report. On the other hand, CDIA commented that it
had no objections to the general requirement, but expressed concern
about including the hyperlink in text message or mobile application
notifications, which may be space limited. CDIA recommended that the
NCRAs have the flexibility to provide the link on any page within the
electronic credit monitoring service to which the notification may
direct the consumer.
---------------------------------------------------------------------------
\64\ See NCLC et al. (comment 20) at 9.
---------------------------------------------------------------------------
Given the space constraints in text messages and mobile
applications, the Commission will modify the rule to allow the NCRAs to
provide the link to the summary of rights on the first page of the
website to which the electronic notification may direct the consumer.
The Commission will also modify the rule to require that the summary of
rights be included with the credit report that consumers can choose to
access following the receipt of a notification, as required when a
consumer requests a copy of their file under section 609 of the FCRA,
15 U.S.C. 1681g.
f. Severability, Sec. 609.6
Proposed Sec. 609.6 stated that the provisions of the proposed
rule are separate and severable from one another, so that if any
provision was stayed or determined to be invalid, it was the
Commission's intention that the remaining provisions shall continue in
effect. The Commission received no comments on this provision and
adopts it without modification.
g. Compliance Date
The proposed rule did not address the date by which the NCRAs will
be required to comply with the rule. CDIA commented that the rule needs
to provide an appropriate amount of time for the NCRAs to implement the
service
[[Page 31190]]
required by the rule.\65\ CDIA stated that one year from the effective
date would be necessary, but that the time could be reduced if the
NCRAs are given a safe harbor for providing their existing credit
monitoring services to active duty military consumers for free.
---------------------------------------------------------------------------
\65\ See CDIA (comment 23) at 16-17.
---------------------------------------------------------------------------
The Commission recognizes that the NCRAs will need time following
the publication of the final rule to implement the service. For
example, they will likely need to create systems to accept proof of
active duty military status. They may need to make engineering and
product changes to generate alerts about certain changes to a credit
file. However, the Commission also notes that Congress gave the
Commission only one year from the enactment of the Act to promulgate
these regulations, presumably to ensure that active duty military
consumers receive the free credit monitoring sooner rather than later.
For example, Senators Carper and Coons, who drafted the credit
monitoring provision of the Act, requested that the Commission,
``conclude the rulemaking process expeditiously so that servicemembers
may begin benefiting from this service as soon as possible.'' \66\
---------------------------------------------------------------------------
\66\ Letter from Senator Thomas R. Carper and Senator
Christopher A. Coons of the United States Senate Regarding the
Military Credit Monitoring Rulemaking Proceeding and the Proposed
Rule Set Forth in the Notice of Proposed Rulemaking (January 23,
2019) at 2.
---------------------------------------------------------------------------
Balancing these factors, the Commission has determined to set a
compliance date of 3 months from the effective date of these
regulations. However, to give the NCRAs additional time to set up their
systems, while still allowing consumers to benefit from the new rights
created by the Act, the Commission will allow the NCRAs to comply with
Sec. Sec. 609.3(a), 609.4, and 609.5 by offering their commercial
credit monitoring service for free, for a period of up to one year from
the effective date of the rule.
Paperwork Reduction Act
The Paperwork Reduction Act (PRA), 44 U.S.C. chapter 35, requires
federal agencies to seek and obtain OMB approval before undertaking a
collection of information directed to ten or more persons.\67\ Under
the PRA, a rule creates a ``collection of information'' when ten or
more persons are asked to report, provide, disclose, or record
information in response to ``identical questions.'' \68\ As the
notification requirements fall upon the three NCRAs, it does not meet
the PRA threshold count of ten or more persons to constitute a
``collection of information.'' Further, the proof of identity the rule
requires of those for whom the rulemaking is designed to benefit,
consumers on active duty military status, falls within OMB's general
exception for disclosures that require persons to provide or display
only facts necessary to identify themselves.\69\
---------------------------------------------------------------------------
\67\ 44 U.S.C. 3502(3)(A)(i).
\68\ See 44 U.S.C. 3502(3)(A).
\69\ See 5 CFR 1320.3(h)(1).
---------------------------------------------------------------------------
Regulatory Flexibility Act
The Regulatory Flexibility Act (RFA) \70\ requires that the
Commission conduct an initial and a final analysis of the anticipated
economic impact of the rule on small entities. The purpose of a
regulatory flexibility analysis is to ensure the agency considers the
impacts on small entities and examines regulatory alternatives that
could achieve the regulatory purpose while minimizing burdens on small
entities. The RFA \71\ provides that such an analysis is not required
if the agency head certifies that the regulatory action will not have a
significant economic impact on a substantial number of small entities.
---------------------------------------------------------------------------
\70\ 5 U.S.C. 601-612.
\71\ 5 U.S.C. 605.
---------------------------------------------------------------------------
The Commission believes that the rule will not have a significant
economic impact on small entities. The final rule applies to NCRAs. The
Commission has not identified any NCRAs that are small entities.\72\
Therefore, the Commission certifies that the rule will not have a
significant economic impact on a substantial number of small
businesses.
---------------------------------------------------------------------------
\72\ The size standard the Small Business Administration has
identified by the North American Industry Classification System code
for credit bureaus (code number 561450), i.e., CRAs, is $15 million.
See 13 CFR 121.201. The rule only applies to NCRAs. There are
currently only three NCRAs, Equifax, Experian, and TransUnion, and
all exceed this size standard.
---------------------------------------------------------------------------
The final rule is similar to the rule proposed in the NPRM. In its
Initial Regulatory Flexibility Analysis (IRFA), the Commission
determined that the proposed rule would not have a significant impact
on small entities because the NCRAs to which the proposed rule would
apply were not small entities.
Although the Commission certifies under the RFA that the rule will
not have a significant impact on a substantial number of small
entities, and hereby provides notice of that certification to the Small
Business Administration, the Commission nonetheless has determined that
publishing a final regulatory flexibility analysis (FRFA) is
appropriate to ensure that the impact of the rule is fully addressed.
Therefore, the Commission has prepared the following analysis:
A. Need for and Objectives of the Final Rule
The Economic Growth, Regulatory Relief, and Consumer Protection
Act, Public Law 115-174, directs the Commission to promulgate
regulations to implement section 302(d)(1) of the Act, which shall at a
minimum: (1) Define ``electronic credit monitoring service'' and
``material additions or modifications to the file of a consumer,'' and
(2) establish what constitutes appropriate proof that a consumer is an
active duty military consumer. In this action, the Commission issues a
rule that would fulfill the statutory mandate. The Act requires that
the Commission promulgate this rule not later than one year after the
date of enactment, or May 24, 2019.
B. Significant Issues Raised in Public Comments
The Commission did not receive any comments that addressed the
burden on small entities.
C. Small Entities To Which the Final Rule Will Apply
The final rule will apply only to NCRAs. The Commission has not
identified any NCRAs that are small entities.
D. Projected Reporting, Recordkeeping, and Other Compliance
Requirements, Including Classes of Covered Small Entities and
Professional Skills Needed To Comply
Under the final rule, NCRAs will have to provide free electronic
credit monitoring services to active duty military consumers. There are
no reporting or recordkeeping requirements, or types of professional
skills necessary for preparation of any such report or record, under
the rule. In any event, as noted earlier, the final rule applies only
to NCRAs, and they are not small entities.
E. Significant Alternatives to the Final Rule
The Commission has not identified any particular alternative
methods of compliance as necessary to reduce burdens on small entities,
because the Commission does not believe any NCRAs subject to the final
rule are small entities, as noted earlier.
Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.),
the Office of Information and Regulatory Affairs designated this rule
as not a ``major rule,'' as defined by 5 U.S.C. 804(2).
[[Page 31191]]
List of Subjects in 16 CFR Part 609
Consumer reporting agencies, Consumer reports, Credit, Fair Credit
Reporting Act, Trade practices.
Accordingly, the Federal Trade Commission amends title 16, chapter
I, subchapter F, of the Code of Federal Regulations as follows:
0
1. Revise the heading of subchapter F to read as follows:
SUBCHAPTER F--FAIR CREDIT REPORTING ACT
0
2. Add part 609 to subchapter F to read as follows:
PART 609--FREE ELECTRONIC CREDIT MONITORING FOR ACTIVE DUTY
MILITARY
Sec.
609.1 Scope of regulations in this part.
609.2 Definitions.
609.3 Requirement to provide free electronic credit monitoring
service.
609.4 Timing of electronic credit monitoring notices.
609.5 Additional information to be included in electronic credit
monitoring notices.
609.6 Severability.
Authority: 15 U.S.C. 1681c-1(k).
Sec. [thinsp]609.1 Scope of regulations in this part.
This part implements Section 605A(k)(2) of the Fair Credit
Reporting Act, 15 U.S.C. 1681c-1(k)(2), which requires consumer
reporting agencies that compile and maintain files on consumers on a
nationwide basis to provide a free electronic credit monitoring service
to active duty military consumers that, at a minimum, notifies them of
any material additions or modifications to their files.
Sec. [thinsp]609.2 Definitions.
For purposes of this part, the following definitions apply:
(a) Active duty military consumer means:
(1) A consumer in military service as defined in 15 U.S.C.
1681a(q)(1); or
(2) A member of the National Guard as defined in 10 U.S.C. 101(c).
(b) Appropriate proof of identity has the meaning set forth in 12
CFR 1022.123.
(c) Consumer has the meaning provided in 15 U.S.C. 1681a(c).
(d) Consumer report has the meaning provided in 15 U.S.C. 1681a(d).
(e) Contact information means information about a consumer, such as
a consumer's first and last name and email address, that is reasonably
necessary to collect in order to provide the electronic credit
monitoring service.
(f) Credit has the meaning provided in 15 U.S.C. 1681a(r)(5).
(g) Electronic credit monitoring service means a service through
which nationwide consumer reporting agencies provide, at a minimum,
electronic notification of material additions or modifications to a
consumer's file and following a notification, access to all information
in the consumer's file at the nationwide consumer reporting agency at
the time of the notification, in accordance with 15 U.S.C. 1681g(a).
(h) Electronic notification means:
(1) A notice provided to the consumer via:
(i) Mobile application;
(ii) Email; or
(iii) Text message;
(2) If the notice in paragraph (h)(1) of this section does not
inform the consumer of the specific material addition or modification
that has been made, such notice must link to a website that provides
that information.
(i) File has the meaning provided in 15 U.S.C. 1681a(g).
(j) Firm offer of credit has the meaning provided in 15 U.S.C.
1681a(l).
(k) Free means provided at no cost to the consumer.
(l) Material additions or modifications means significant changes
to a consumer's file, including:
(1) New accounts opened in the consumer's name, including new
collection accounts;
(2) Inquiries or requests for a consumer report;
(i) However, an inquiry made for a prescreened list obtained for
the purpose of making a firm offer of credit or insurance as described
in 15 U.S.C. 1681b(c)(1)(B) or for the purpose of reviewing or
collecting an account of the consumer shall not be considered a
material addition or modification.
(ii) [Reserved]
(3) Material changes to a consumer's address;
(4) Changes to credit account limits of $100 or greater; and
(5) Negative information.
(m) Nationwide consumer reporting agency has the meaning provided
in 15 U.S.C. 1681a(p).
(n) Negative information means accounts furnished to the nationwide
consumer reporting agencies as more than 30 days delinquent, accounts
furnished to the nationwide consumer reporting agencies as being
included in bankruptcy petition filings, and new public records,
including, but not limited to, bankruptcy filings, civil court
judgments, foreclosures, liens, and convictions.
Sec. 609.3 Requirement to provide free electronic credit monitoring
service.
(a) General requirements. Nationwide consumer reporting agencies
must provide a free electronic credit monitoring service to active duty
military consumers.
(b) Determining whether a consumer must receive electronic credit
monitoring service. Nationwide consumer reporting agencies may
condition provision of the service required under paragraph (a) of this
section upon the consumer providing:
(1) Appropriate proof of identity;
(2) Contact information; and
(3) Appropriate proof that the consumer is an active duty military
consumer.
(c) Appropriate proof of active duty military consumer status. (1)
A consumer's status as an active duty military consumer can be verified
through:
(i) A method or service approved by the Department of Defense; or
(ii) A certification of active duty military consumer status
approved by the nationwide consumer reporting agency.
(2) Provided, however, that the procedures a nationwide consumer
reporting agency uses to determine appropriate proof of active duty
military consumer status must include methods that allow all eligible
consumers to enroll. A nationwide consumer reporting agency shall be
deemed in compliance with paragraph (c) of this section if it provides
free electronic credit monitoring services to:
(i) Consumers who self-certify active duty status, as defined in 10
U.S.C. 101(d);
(ii) Consumers who self-certify that they are a reservist
performing duty under a call or order to active duty under a provision
of law referred to in 10 U.S.C. 101(a)(13); and
(iii) Consumers who self-certify that they are a member of the
National Guard, as defined in 10 U.S.C. 101(c).
(3) A nationwide consumer reporting agency's verification of active
duty military consumer status is valid for two years. After the
expiration of the two-year period, the nationwide consumer reporting
agency may require the consumer to provide proof that the consumer
continues to be an active duty military consumer in accordance with
paragraphs (c)(1) and (2) of this section.
(d) Information use and disclosure. Any information collected from
consumers as a result of a request to obtain the service required under
paragraph (a) of this section, may be used or disclosed by the
nationwide consumer reporting agency only:
(1) To provide the free electronic credit monitoring service
requested by the consumer;
[[Page 31192]]
(2) To process a transaction requested by the consumer at the same
time as a request for the free electronic credit monitoring service;
(3) To comply with applicable legal requirements; or
(4) To update information already maintained by the nationwide
consumer reporting agency for the purpose of providing consumer
reports, provided that the nationwide consumer reporting agency uses
and discloses the updated information subject to the same restrictions
that would apply, under any applicable provision of law or regulation,
to the information updated or replaced.
(e) Communications surrounding enrollment in electronic credit
monitoring service. (1) Once a consumer is in the process of accessing
the ability to enroll in the service required under paragraph (a) of
this section and only during the enrollment process, any advertising or
marketing for products or services, or any communications or
instructions that advertise or market any products and services, must
be delayed until after the consumer has enrolled in that service.
(2) Any communications, instructions, or permitted advertising or
marketing shall not interfere with, detract from, contradict, or
otherwise undermine the purpose of providing a free electronic credit
monitoring service to active duty military consumers that notifies them
of any material additions or modifications to their files.
(3) Examples of interfering, detracting, inconsistent, and/or
undermining communications include:
(i) Materials that represent, expressly or by implication, that an
active duty military consumer must purchase a paid product or service
in order to receive the service required under paragraph (a) of this
section; or
(ii) Materials that falsely represent, expressly or by implication,
that a product or service offered ancillary to receipt of the free
electronic credit monitoring service, such as identity theft insurance,
is free, or that fail to clearly and prominently disclose that
consumers must cancel a service, advertised as free for an initial
period of time, to avoid being charged, if such is the case.
(f) Other prohibited practices. A nationwide consumer reporting
agency shall not ask or require an active duty military consumer to
agree to terms or conditions in connection with obtaining a free
electronic credit monitoring service, other than those terms or
conditions required to comply with applicable legal requirements.
Sec. [thinsp]609.4 Timing of electronic credit monitoring notices.
The notice required in Sec. 609.3(a) must be provided within 48
hours of any material additions or modifications to a consumer's file.
Sec. [thinsp]609.5 Additional information to be included in
electronic credit monitoring notices.
(a) The notice required in Sec. 609.3(a), or the first page within
the electronic credit monitoring service to which the notice may direct
the consumer, shall include a hyperlink to a summary of the consumer's
rights under the Fair Credit Reporting Act, as prescribed by the Bureau
of Consumer Financial Protection under 15 U.S.C. 1681g(c).
(b) The nationwide consumer reporting agency shall provide to a
consumer, with each file disclosure provided in Sec. 609.3(a), the
summary of the consumer's rights under the Fair Credit Reporting Act,
as prescribed by the Bureau of Consumer Financial Protection under 15
U.S.C. 1681g(c).
Sec. [thinsp]609.6 Severability.
The provisions of this part are separate and severable from one
another. If any provision is stayed, or determined to be invalid, it is
the Commission's intention that the remaining provisions shall continue
in effect.
By direction of the Commission.
April J. Tabor,
Acting Secretary.
[FR Doc. 2019-13598 Filed 6-28-19; 8:45 am]
BILLING CODE 6750-01-P
