Comments:

Joint Comments of

Consumer Federation of America

Consumers Union

National Association of Consumer Advocates

Privacy Rights Clearinghouse

Privacy Times

U.S. PIRG

TO: Federal Trade Commission (FTC)

RE: Comments Regarding FACTA Free File Disclosures Proposed Rule, Matter No. R411005

Filed by Internet

The undersigned consumer protection organizations and privacy advocates provide the following comments on the proposed FACTA Free File Disclosures Proposed Rule, Matter No. R411005.

SUMMARY OF THE COMMENTS

(1) There is no need for a staggered nationwide rollout, but if it is done, it should be done more rapidly, with the burden on the credit bureaus to prove the potential need for additional staggering following a one-region test. The FTC could still achieve the primary intent of providing as many American consumers as possible rapid access to free credit reports, while considering the potential, yet heretofore unsubstantiated, unrealized and unproven concerns of the nationwide Consumer Reporting Agencies (CRAs).

(2) Without Congressional authorization, the proposal appears to improperly allow unfettered collection and use of information for secondary purposes, which could deter consumers from taking advantage of their statutory right to a free credit report or could expose consumers who exercise their statutory right to a free report to unexpected and potentially adverse consequences.

(3) Again without Congressional authorization, the proposal fails to explicitly ban the marketing of other products. In our view, the Commission needs to establish a bright line test: The centralized source [and throughout we refer to the Internet site, telephone number and mailing address] should only market Congressionally-mandated free credit reports and Congressionally-mandated fair and reasonably priced credit scores.

(4) The proposal fails to require that the centralized source include a Spanish language mirror website and telephone number, or any Spanish language outreach at all. While the Congress did not explicitly require this, it is imperative that the FTC require the CRAs to include this reasonable provision. A more extensive comment letter on this issue has been filed by the National Council of La Raza, Consumers Union, and many national and local consumer and community organizations.

(5) The tests for "extraordinary request volume," which would then allow bureaus to refuse consumer requests for statutorily mandated free reports, generally describe very low thresholds to obtain relief. One newspaper story or security breach could trigger implementation of the delaying exceptions. Such low exemption thresholds deprive consumers of a right Congress wanted them to have.

In additional to detailed recommendations below concerning these and other important issues, we also recommend the following:

Establish a Centralized Source Advisory Committee or Board -- The centralized source should be required to establish a board consisting of consumer representatives to monitor and oversee the design and implementation of the disclosure process.

Marketing -- If the Commission rejects our detailed analysis that marketing should not be allowed, and marketing is permitted by the central source, there should be equivalent opportunities for consumer groups to provide, at no participation cost, and at equal prominence to the most prominent form of marketing on the site, educational materials, including materials that explain, assess, compare, and review the for-fee services being offered.

(C) Combine the centralized source with the pre-screening opt-out requirement. The Commission should consider using its broad authority to also require that the centralized source offer consumers who seek free annual reports the option to opt-out of pre-screening. The contact with consumers offers a wonderful opportunity to explain the choice that consumers have and to give each consumer the choice of opting-out or opting-in.

DETAILED DISCUSSION OF THESE AND OTHER RECOMMENDATIONS

Introduction

Why is Congress providing free annual credit reports? There are, of course, many reasons. Among the most important are these two: identity theft and credit report mistakes. Congress has recognized that that it makes sense to give data subjects the right to audit their own reports for errors or fraudulent activity.

It is the view of the undersigned consumer and privacy advocates that the regulations implementing the centerpiece of the FACT Act must be explicit and prescriptive because the history of this industry in implementing required rights is poor. Further, the new free report right will likely be hard for consumers to use without strong, comprehensive regulation.

A brief history of the industry's compliance problems is illustrative of the need for strong regulation. In the late 1980s-early 1990s, complaints about credit bureaus became the leading complaint to the FTC. The FTC placed Equifax, Experian (TRW) and Trans Union under court-ordered consent decrees. Several states also imposed consent decrees.

In 1996, in its last major amendments to the FCRA prior to the enactment of the FACT Act,  Congress imposed new customer service responsibilities on the "Big Three" CRAs [and any others that would join a new, 603(p) category of nationwide CRA], requiring them to have adequate staff to assist consumers, in addition to imposing other new requirements to improve credit reporting.

Then, the FTC's "Operation Busy Signal" investigation found that the three major credit bureaus had engaged in shoddy customer service in violation of the new law. So, in January 2000 the FTC imposed a combined $2.5 million in civil penalties on these CRAs for failing to comply with these new customer service duties.

The firms were severely penalized, enjoined from further violations and ordered, for example, in the case of Experian, to maintain a "blocked call rate of no greater than ten percent (10%); [and] an average speed of answer of no greater than three (3) minutes and thirty (30) seconds."

Yet, the Commission was forced to act again, just three years later, with respect to Equifax. In July 2003, the Commission explained the problem with dealing with the credit bureaus succinctly when it penalized Equifax an additional $250,000:

"In January 2000, the three credit bureaus paid a total of $2.5 million to settle charges that each violated this provision of the FCRA. According to the FTC's complaints, the bureaus blocked calls from over a million consumers who wanted to discuss the contents of, and possible errors in, their credit reports, and kept others on hold for unreasonably long periods of time. To ensure that credit bureau personnel were accessible to consumers, the settlements required that the bureaus meet specific performance standards, including limiting the number of calls that the agencies could block and the amount of time consumers could be placed on hold. Equifax failed to meet the specific performance standards in the consent decree for blocked calls and hold times for certain periods in 2001. The settlement announced today will require Equifax to pay an additional $250,000 for violating the original consent decree." [See FTC news release, 30 July 2003, "Equifax to Pay $250,000 to Settle Charges."]

The proposed rule should bend over backwards to prevent the continuation of poor customer service that fails to meet the standards Congress has intended this industry to meet. Instead, the Commission must understand that the history of credit bureau compliance with federal law shows the need for strong--stronger than what has been proposed--regulation.

That the proposed rule's slow rollout is an over-reaction is further emphasized when the Commission's own economic analysis is reviewed. The Commission provides evidence in the proposed rule that the annual profit to the bureaus is $1.2 billion and that the cost of compliance with this rule would amount to only a "small percentage" [$8.41 million or 0.7% annually] of that total. [See FTC, Free File Disclosures, Proposed FACTA Rule, footnote 37.]

(1) NO STAGGERED ROLLOUT: There is no need for a staggered nationwide rollout. But, if one is allowed under the "considerations" granted to the FTC, it should be re-structured so that only a shorter, one-region test occurs followed by a review, after which the FTC could order an immediate national rollout to the remainder of the country. The FTC can still achieve the primary intent of providing as many American consumers as possible rapid access to free credit reports, while still considering the potential, yet heretofore unsubstantiated, unrealized and unproven concerns of the CRAs.

We presume that the CRAs, to comply with the new law, are already increasing capacity to meet some reasonable level of anticipated increases in volume.

Further, the Commission's own analysis suggests that the initial rollout will require rapid capacity increases in the event volumes are higher than expected (see footnote 22 of the proposed rule), which means that the CRAs would be expecting to ramp up even more during the first round of the proposed staggered rollout. In our view, after 30 days of that rollout (on 1 January 2005) the Commission would be in a position to determine whether the entire remainder of the country could become eligible on 1 February 2005, rather than over the next nine months.

We are disappointed that, without any evidence, the proposed rule grants unnecessary deference to the claims of the consumer reporting agencies (CRAs) that free report requests will damage their ability to perform other duties. This will result in enormous delays in access to free credit reports for millions of Americans and confusion about the new rights of access that will diminish the effectiveness of the law.

Since the CRAs have failed to provide justification for their proposed staggered rollout, the FTC should make free reports available to all Americans on 1 December 2004.

We note that if the FTC does proceed with some form of relief, we do prefer a geographical rollout to, for example, a birth month rollout, for both consumer education and household financial management reasons. Consumer educators can target their educational releases to different states on a geographic basis, rather than try to pitch the media to do yet another story on a continually deflating "If it's your birthday, time to order your report" press release each month. Further, in many families, one spouse or partner is responsible for financial matters. Why shouldn't that couple be able to obtain their reports together even if born six months apart? Access to both files is extremely important in many circumstances, for example if they seek to make a home purchase or refinance.

(2) NO USE OF INFORMATION FOR SECONDARY PURPOSES: Without Congressional authorization, the proposal appears to allow unfettered collection and use of information for secondary purposes, which could deter consumers from taking advantage of their statutory right to a free credit report or could expose consumers who exercise their statutory right to a free report to unexpected and potentially adverse consequences. Because privacy is a key motivating factor for consumers to request their credit reports, failure to ensure consumers' privacy will seriously impair the trust in this process.

The rule should provide that consumer information provided to request a free report and any other service or product ordered or purchased through the centralized site (and we propose limiting this only to fair and reasonably priced credit scores) may be used only for fulfilling requests for annual file disclosures or other concurrent orders. All other uses of the information--especially for marketing or profiling--should be expressly prohibited. The Commission has expressed concerns that the CRAs may use and disclose personally identifiable information collected through the centralized source for secondary purposes, or even share the information with affiliated companies or third parties. We, too, share these concerns, and support a bright line test: use information collected only to complete the requested transaction.

If, on the basis of information provided by a consumer to the centralized source, a credit bureau determines that it may not hold accurate personal information on that consumer that is essential to accurately identifying this person, we would not oppose efforts by a bureau to separately and independently verify and update such information.  However, this independent verification process should only involve that personally identifiable information which is essential to accurately matching the identity of a consumer, such as the name, social security number and address of the consumer, to the credit information about this person already held by the bureau.  The process could not involve the updating or addition of any other information collected by the bureau about the consumer through the centralized source, such as credit or payment information or other non-essential personally identifiable information, such as an e mail address or phone number.   Any information updated through such a separate verification process should not be allowed to be used for secondary purposes involving marketing or profiling or other uses other than identity verification.  The verification of such updated information would also have to be consistent with existing laws, for example, designed to prevent identity theft.

In addition, the Commission must make it very clear that contact through the central source to obtain Congressionally-mandated credit reports (and/or credit scores) does not establish a previous customer relationship that would act as an opt-in for additional marketing or a waiver of privacy rights under any interpretation of any other law.

We also refer the Commission to a recent article that details how the CRAs are already collecting personal information from consumers when they seek to obtain free reports or other products from the credit bureaus. Here is an excerpt: [See Oldenburg, Don, "Free Credit Reports That Cost You Your Privacy", The Washington Post, 17 Feb 04]

"And the other "gotcha": "There is an even higher price," the reader says. "Reading the privacy disclosure information, I was surprised that you were agreeing to let them use everything in your credit report for marketing -- by them, by their affiliated companies and by others."

Bad enough that many privacy policies state that they're going to share your name, address, phone, Social Security number, birth date, even credit-card number for marketing purposes -- resulting in more junk mail, spam and telemarketing calls (yes, even if you signed on to the federal Do Not Call Registry, because now you have a business relationship).

But the free-reports companies have the whole enchilada -- your entire credit report. "I certainly do not want everything in a credit report going into a marketer's database," says the reader." [See Oldenburg, Don, "Free Credit Reports That Cost You Your Privacy", The Washington Post, 17 Feb 04]

(3) NO MARKETING, EXCEPT OF MANDATED CREDIT SCORES: Again without Congressional authorization, the proposal fails to explicitly ban the marketing of other products. In our view, the Commission needs to establish a bright line test: The centralized source [and throughout we refer to the Internet site, telephone number and mailing address] should only market Congressionally-mandated free credit reports and Congressionally-mandated fair and reasonably priced credit scores. No additional advertising or links to any other products or upselling should be allowed, otherwise the primary Congressional goals will not be achieved.

We are particularly concerned that advertising for products that the FACT Act does not require CRAs to provide, such as subscription services or identity theft insurance, would either compete with the free credit report opportunity or dilute or confuse the purpose of the centralized source. We are deeply concerned that the marketing of for-profit services through a source which exists to fulfill a mandate to provide access to a free product is inherently contradictory, and that the incentives to sell profitable services instead of providing the free service simply cannot be corralled by "type of marketing" restrictions.

The Commission has posed a test that other marketing be allowed unless efforts "interfere, detract from, contradict or undermine" the purpose of the centralized source. We would respectfully submit that deference be paid to our expert view that this test simply cannot be met. Further, while there is an enormous amount of Congressional history demonstrating the primary Congressional intent of providing free credit reports, we know of no Congressional history promoting the notion that Congress wanted to dilute its message with advertising.

While we agree with the Commission that the FTC Act's prohibition on unfair and deceptive practices applies to the operations of the centralized source as well as to the operations of the individual CRAs, we believe that the Congress has set a higher bar here--not only must the activities not be unfair or deceptive, but they also cannot interfere, detract from, contradict or undermine a consumer's right to a statutory free credit report disclosure on request. The potential that the bureaus will attempt to upsell or steer consumers to different products is grave. Marketing should be rejected on a bright line basis.

We do support requiring CRAs to prominently disclose on the centralized source that consumers have a right under the FACT Act to purchase a credit score--and to offer for sale the scores that the Act requires CRAs to sell at the as yet undetermined "fair and reasonable fee" mandated by the Act.  Section 212 of the Act not only mandates that CRAs offer scores to the public – the first such national requirement--it mandates that if a consumer requests a free credit report and not a credit score that he or she be informed of the right to request and obtain a credit score.

While the FACT Act mandates that there be a centralized source for consumer to request credit reports from all credit bureaus, it does not specify the timing or nature of the delivery. Ideally, the three reports should be delivered together, but even if the Commission determines that the reports can be delivered separately, CRAs should be required to generate all reports simultaneously, in a manner equivalent to the simultaneous generation of reports for lenders, in order to allow meaningful comparison.  Research has shown that information in a single consumer’s credit reports can vary dramatically among consumer reporting agencies [see e.g., "Credit Score Accuracy and Implications for Consumers," Consumer Federation of America and National Credit Reporting Association, 17 December 2002].  Consumers must be provided an opportunity to make a meaningful comparison. 

Furthermore, any credit scores purchased during the same request session should be delivered with the underlying reports upon which they were based.  The credit score and credit report will be of most use to consumers when delivered in tandem. The score will give consumers important information about their relative creditworthiness, making the credit report more easily understood. In addition, the score will very likely serve as an alert for inaccuracies, incompleteness, or fraudulent information in the underlying credit report. Consumer access to credit scores also has the potential to improve consumer understanding of the direct impact of credit related behavior on their creditworthiness. However, consumers must be able to review the underlying credit information upon which the score was based in order to follow up on suspicions raised by unexpected changes in credit scores, and when the underlying report is accurate, to understand the relationship between their behavior and the resulting credit score.

(4) ADD A SPANISH LANGUAGE REQUIREMENT: The proposal fails to require that the centralized source include a Spanish language mirror website and telephone number, or any Spanish language outreach at all. While the Congress did not explicitly require this, it is imperative that the FTC require the CRAs to include this reasonable provision. We incorporate by reference the views in a more extensive comment letter on this issue, which has been filed by the National Council of La Raza, Consumers Union, and many national and local consumer and community organizations.

(5) VOLUME TESTS OVER-COMPENSATE: The tests for "extraordinary request volume," generally describe very low thresholds to obtain relief. In general, the companies are granted some relief when requests exceed "115% of the 7 day rolling volume" and other relief when requests exceed "double the average daily volume over 90 days." One newspaper story or security breach could trigger implementation of the delaying exceptions. Such low exemption thresholds deprive consumers of a right Congress wanted them to have. We believe further that the rule's complex provisions regarding natural disasters, telecommunications interruptions and the like could be solved by simply requiring the CRAs to ramp up capacity more quickly and to plan to meet reasonable, but higher peaks. One-hundred-fifteen percent is not excessive, 200% may be more appropriate to delay providing reports in a timely manner. "Double" the average on a 90-day basis is extremely low--Four times the average is a more appropriate peak to grant such extraordinary relief as is contemplated by the rule. If the Commission sets its rules more reasonably, then it will encourage the CRAs to ultimately improve their service in all areas.

Furthermore, in times of relief, the bureaus should not be allowed to simply refuse requests for credit reports.  In times of extraordinary request volume, the proposed rule would allow a bureau to ask consumers to make their requests again at a time when the centralized source is reasonably expected to be able to accept them. The option places an unreasonable burden on consumers. It would be easier for the centralized source or bureau to hold requests until they can be processed.  The source or bureau can notify each consumer of the delay and indicate an estimated time for compliance with the request.

(6) REPORTS SHOULD BE AVAILABLE ON CALENDAR YEAR BASIS: The way the "every 12 months" (not a calendar year) provision may end up working--if it is built on top of first year staggering as it appears it is -- would be to make a confusing form of rationing permanent. The more flexible alternative would be to have a regional rollout in the first year--then, to allow any consumer to get their report at any time in the next calendar year.

(7) PROVIDE DEFERENCE TO GRANDFATHERED STATES: The proposal does not appear to address amendments made by FACTA to Section 625(h) of FCRA, grandfathering the free report laws in 7 states (Colorado, Georgia, Maine, Maryland, Massachusetts, New Jersey, Vermont). The final rule should make clear that rights of consumers in these states to also obtain free report(s) under state law are not diminished or changed, and that consumers need not use the centralized system or the centralized system calendar to request those reports. The easiest solution to any potential confusion would be to have consumers from these states eligible to obtain reports at any time, regardless of any phase-in.

(8) CIRCUMVENTION: We agree with the Commission's finding that an "associate" relationship could not be used by a CRA to circumvent the law's requirements. We further believe that when the combination of the Congressional intent evidenced by the anti-circumvention provisions and the enactment of the Frank floor amendment broadening availability of free credit reports, leads to the conclusion that Congress intends the Commission, by rule, to define "substantially nationwide" CRAs as nationwide CRAs required to provide free credit reports and to comply with all duties of 603(p) entities. Otherwise, the industry would be able to re-organize into business models that attempt to somehow comply with a "substantially nationwide" exception without violating the anti-circumvention rule.

(9) DISCLOSURE OF ADDITIONAL FREE REPORT RIGHTS: The proposed rule does not make clear that the centralized source should explicitly describe that consumers may have numerous additional rights to free reports even if that report cannot be obtained on the central site. For example, FACTA provides identity theft victims with additional rights to reports. FCRA already provided a person who is unemployed or a recipient of welfare assistance or has a fraud alert on his or her credit report, as well as any person who has had an adverse action, with additional, non-diminished separate rights to free reports. The rule should make clear that the centralized source must clearly point out these additional rights (as well as the rights of consumers living in grandfathered states) and, further, that taking advantage of the new statutory free report does not diminish these additional rights.

The centralized source, as well as all FTC-mandated brochures and disclosures should, in prominent, plain language, in English and in Spanish, disclose these other rights to a free report and how to order those free reports. In particular, we are unaware of any efforts of any sort by any of the CRAs to make it clear to consumers that they may not need to pay for their reports if they are indigent or unemployed.

(10) NATIONWIDE SPECIALTY CREDIT BUREAUS: The proposed rule points out that many of these firms have never experienced significant demand for reports. Indeed, our organizations also believe that some of them have gone so far as to deter consumers from requesting copies of their files. We urge the Commission to impose the most stringent requirements possible under the rule to require these firms to raise their visibility and improve their customer service. In addition, we urge the Commission to make it a priority to conduct an educational campaign about them: "What is a tenant screening bureau?" "What is the MIB?" "Is a check approval company a credit bureau?" "What is my Clue report?"

Consumer polling conducted last summer shows that consumers have very little awareness of even the three major consumer reporting agencies (Equifax, Experian, and Transunion). A mere three percent of consumers know the names of these agencies, despite their status of the leading businesses in the sector [See testimony of Travis Plunkett, Consumer Federation of America,  before U.S. Senate Banking Committee, 29 July 2003] . Consumer awareness of less prominent agencies is almost certainly even lower. For this reason, it is imperative for the centralized source to also assist consumers in identifying how to exercise their rights with respect to these specialty credit bureaus. The centralized source should list the names of all nationwide specialty consumer reporting agencies and their respective toll free telephone numbers.

In additional to detailed recommendations below concerning these and other issues, we also recommend the following:

-- Establish a Centralized Source Advisory Committee or Board--The centralized source should be required to establish a board consisting of consumer representatives to monitor and oversee the design and implementation of the disclosure process.

-- If the Commission rejects our detailed analysis that marketing should not be allowed, and marketing is permitted by the central source, there should be equivalent opportunities for consumer groups to provide, at no participation cost, and at equal prominence to the most prominent form of marketing on the site, educational materials, including materials that explain, assess, compare, and review the for-fee services being offered.

-- Finally, combine the centralized source with the pre-screening opt-out requirement. The Commission should consider using its broad authority to also require that the centralized source offer consumers who seek free annual reports the option to opt-out of pre-screening. The contact with consumers offers a wonderful opportunity to explain the choice that consumers have and to give each consumer the choice of opting-out or opting-in.

For additional questions about these comments, please contact Edmund Mierzwinski at U.S. PIRG at 202-546-9707 x314, (ed@pirg.org) or Gail Hillebrand at Consumers Union (415-431-6747 (hillga@consumer.org) or Travis Plunkett at the Consumer Federation of America at 202-386-6121 (tplunkett@consumerfed.org)

Thank you for the opportunity to submit these comments.