Appendix C to Part 601
Prescribed Notice of User Responsibilities
This appendix prescribes the content of the required notice.
NOTICE TO USERS OF CONSUMER
The federal Fair Credit Reporting Act (FCRA) requires that this notice be provided to inform users of consumer reports of their legal obligations. State law may impose additional requirements. This first section of this summary sets forth the responsibilities imposed by the FCRA on all users of consumer reports. The subsequent sections discuss the duties of users of reports that contain specific types of information, or that are used for certain purposes, and the legal consequences of violations. The FCRA, 15 U.S.C. 1681-1681u, is set forth in full at the Federal Trade Commission's Internet web site (http://www.ftc.gov).
I. OBLIGATIONS OF ALL USERS OF CONSUMER REPORTS
A. Users Must Have a Permissible Purpose
Congress has limited the use of consumer reports to protect consumers' privacy. All users must have a permissible purpose under the FCRA to obtain a consumer report. Section 604 of the FCRA contains a list of the permissible purposes under the law. These are:
In addition, creditors and insurers may obtain certain consumer report information for the purpose of making unsolicited offers of credit or insurance. The particular obligations of users of this "prescreened" information are described in Section V below.
B. Users Must Provide Certifications
Section 604(f) of the FCRA prohibits any person from obtaining a consumer report from a consumer reporting agency (CRA) unless the person has certified to the CRA (by a general or specific certification, as appropriate) the permissible purpose(s) for which the report is being obtained and certifies that the report will not be used for any other purpose.
C. Users Must Notify Consumers When Adverse Actions Are Taken
The term "adverse action" is defined very broadly by Section 603 of the FCRA. "Adverse actions" include all business, credit, and employment actions affecting consumers that can be considered to have a negative impact -- such as unfavorably changing credit or contract terms or conditions, denying or canceling credit or insurance, offering credit on less favorable terms than requested, or denying employment or promotion.
1. Adverse Actions Based on Information Obtained From a CRA
If a user takes any type of adverse action that is based at least in part on information contained in a consumer report, the user is required by Section 615(a) of the FCRA to notify the consumer. The notification may be done in writing, orally, or by electronic means. It must include the following:
2. Adverse Actions Based on Information Obtained From Third Parties Who Are Not Consumer Reporting Agencies
If a person denies (or increases the charge for) credit for personal, family, or household purposes based either wholly or partly upon information from a person other than a CRA, and the information is the type of consumer information covered by the FCRA, Section 615(b)(1) of the FCRA requires that the user clearly and accurately disclose to the consumer his or her right to obtain disclosure of the nature of the information that was relied upon by making a written request within 60 days of notification. The user must provide the disclosure within a reasonable period of time following the consumer's written request.
3. Adverse Actions Based on Information Obtained From Affiliates
If a person takes an adverse action involving insurance, employment, or a credit transaction initiated by the consumer, based on information of the type covered by the FCRA, and this information was obtained from an entity affiliated with the user of the information by common ownership or control, Section 615(b)(2) requires the user to notify the consumer of the adverse action. The notification must inform the consumer that he or she may obtain a disclosure of the nature of the information relied upon by making a written request within 60 days of receiving the adverse action notice. If the consumer makes such a request, the user must disclose the nature of the information not later than 30 days after receiving the request. (Information that is obtained directly from an affiliated entity relating solely to its transactions or experiences with the consumer, and information from a consumer report obtained from an affiliate are not covered by Section 615(b)(2).)
II. OBLIGATIONS OF USERS WHEN CONSUMER REPORTS ARE OBTAINED FOR EMPLOYMENT PURPOSES
If information from a CRA is used for employment purposes, the user has specific duties, which are set forth in Section 604(b) of the FCRA. The user must:
Before taking an adverse action, provide a copy of the report to the consumer as well as the summary of the consumer's rights. (The user should receive this summary from the CRA, because Section 604(b)(1)(B) of the FCRA requires CRAs to provide a copy of the summary with each consumer report obtained for employment purposes.)
III. OBLIGATIONS OF USERS OF INVESTIGATIVE CONSUMER REPORTS
Investigative consumer reports are a special type of consumer report in which information about a consumer's character, general reputation, personal characteristics, and mode of living is obtained through personal interviews. Consumers who are the subjects of such reports are given special rights under the FCRA. If a user intends to obtain an investigative consumer report, Section 606 of the FCRA requires the following:
IV. OBLIGATIONS OF USERS OF CONSUMER REPORTS CONTAINING MEDICAL INFORMATION
Section 604(g) of the FCRA prohibits consumer reporting agencies from providing consumer reports that contain medical information for employment purposes, or in connection with credit or insurance transactions, without the specific prior consent of the consumer who is the subject of the report. In the case of medical information being sought for employment purposes, the consumer must explicitly consent to the release of the medical information in addition to authorizing the obtaining of a consumer report generally.
V. OBLIGATIONS OF USERS OF "PRESCREENED" LISTS
The FCRA permits creditors and insurers to obtain limited consumer report information for use in connection with unsolicited offers of credit or insurance under certain circumstances. Sections 603(l), 604(c), 604(e), and 615(d) This practice is known as "prescreening" and typically involves obtaining a list of consumers from a CRA who meet certain preestablished criteria. If any person intends to use prescreened lists, that person must (1) before the offer is made, establish the criteria that will be relied upon to make the offer and to grant credit or insurance, and (2) maintain such criteria on file for a three-year period beginning on the date on which the offer is made to each consumer. In addition, any user must provide with each written solicitation a clear and conspicuous statement that:
The consumer may prohibit the use of information in his or her file in connection with future prescreened offers of credit or insurance by contacting the notification system established by the CRA that provided the report. This statement must include the address and toll-free telephone number of the appropriate notification system.
VI. OBLIGATIONS OF RESELLERS
Section 607(e) of the FCRA requires any person who obtains a consumer report for resale to take the following steps:
VII. LIABILITY FOR VIOLATIONS OF THE FCRA
Failure to comply with the FCRA can result in state or federal enforcement actions, as well as private lawsuits. Sections 616, 617, and 621. In addition, any person who knowingly and willfully obtains a consumer report under false pretenses may face criminal prosecution. Section 619