October 27, 1997
Michael Cast
Compliance Services Manager
Capitol Federal Savings
P.O. Box 3505
Topeka, Kansas 66601-3505
Re: Merged Consumer Reports
Dear Mr. Cast:
This is in response to your July 15, 1997 letter requesting a staff opinion concerning the amended Fair Credit Reporting Act ("FCRA"), which took effect on September 30, 1997. According to your letter, Capitol Federal Savings' mortgage lending operation is considering "adding a credit report 'merge and purge' component to the revised processing function." By "merge and purge" component, I understand you to mean a system by which consumer reports on individual consumers from each of the three largest credit repositories -- Trans Union, Experian and Equifax -- will be merged to create one consumer report per consumer and, in the process, duplicative information will be removed. You ask a number of questions related to the addition of the merge and purge system. I have reprinted your questions in italics below and added my responses, based on the amended FCRA.
1. Assume that we utilize an intermediary to pull credit report information from the three main repositories, conduct a "merge and purge" of that information, and provide us with a finalized credit report. It is our understanding that we are to report that intermediary in the event of adverse action and that we can provide a copy of the finalized credit report (under the intermediary's name) in the event of adverse action. Please indicate whether we are correct in these determinations.
If an intermediary pulls consumer report information from the three main repositories, conducts a "merge and purge" of the information to create another consumer report, and provides that report to Capitol Federal, the intermediary will be a consumer reporting agency for purposes of the FCRA, and Capitol Federal will be a "user" of consumer reports. If Capitol Federal takes an adverse action based on information contained in one of these consumer reports, Capitol Federal must comply with Section 615(a) of the FCRA, 15 U.S.C. § 1681m(a). That section requires Capitol Federal to provide the following to the consumer orally, in writing, or electronically: (1) a notice of the adverse action; (2) the name, address, and telephone number of the intermediary (consumer reporting agency) that created the merged and purged consumer report (including a toll-free number for the intermediary if it maintains files on consumers on a nationwide basis); (3) a statement that the intermediary did not make the decision to take the adverse action; (4) a notice that the consumer has the right to obtain a free copy of their consumer report from the intermediary; and (5) a notice that the consumer has the right to dispute the accuracy or completeness of any information in the consumer report. The FCRA does not forbid companies that take adverse action against a consumer, based on information in their consumer report, from providing a copy of the report to the consumer.(1)
2. Assume that we purchase a software package to pull credit report information from the three main repositories, conduct a "merge and purge" of that information on our computer system, and print out a finalized credit report.
a. Would such an arrangement mean that Capitol Federal is a "consumer reporting agency"? What about the software provider?
To be a "consumer reporting agency," a person must "assembl[e] or evaluat[e] . . . information on consumers for the purpose of furnishing consumer reports to third parties." Section 603(f), 15 U.S.C. § 1681a(f). Under the scenario described above, Capitol Federal would not be a consumer reporting agency if it used the "merged and purged" consumer reports for its own, internal purposes because the company would not be assembling the information to furnish consumer reports to third parties. The software provider also would not be a consumer reporting agency because it would not be assembling or evaluating information at all. The software that Capitol Federal purchased could be said to assemble and evaluate the information, but the software provider no longer has any connection at all to the information.
b. Are we to report all three repositories in the event of adverse action? Or, can we report only one of the three repositories?
Section 615(a) of the amended FCRA, 15 U.S.C. § 1681m(a), provides that any person that takes any adverse action with respect to a consumer that is based "in whole or in part on any information contained in a consumer report" shall provide to the consumer the name, address, and telephone number of the consumer reporting agency "that furnished the report to the person." Thus, Capitol Federal must provide the name, address and telephone number of each of the three repositories whose consumer report included information on which Capitol Federal based its decision, in whole or in part, to take the adverse action. If only one of the three repositories' reports contained such information, Section 615(a) requires that Capitol Federal give only that repository's name, address and telephone number. If, however, Capitol Federal used information from all three repositories' consumer reports to make the decision to take adverse action, Capitol Federal must give the consumer the name, address and telephone number of all three repositories.
c. If all three repositories must be disclosed, how specific must we be? For example, must we identify which repository provided each individual piece of information which contributed to the adverse action?
Section 615 of the FCRA does not require that Capitol Federal disclose which repository provided which piece of information that contributed to the adverse action.
d. If we provide a copy of the "merged and purged" report to the consumer, is the report to be issued under the name of Capitol Federal, the software company, the names of each repository, or how?
If Capitol Federal does provide merged consumer reports to those consumers about whom Capitol Federal takes an adverse action, the FCRA does not address the issue of which name should go on top of the report.
3. In a question probably asked by thousands, we have heard that regulations will not be issued implementing the Fair Credit Reporting Act, but that a "staff commentary," including model disclosures, is to be issued. Is this true?
The Federal Trade Commission does not have the authority to issue substantive regulations implementing the amended FCRA. The Commission has, however, issued three notices as required by the FCRA amendments. The notices are (1) a summary of consumer rights that consumer reporting agencies will include whenever they deliver a consumer report to a consumer; (2) a notice to individuals and companies that furnish information to consumer reporting agencies; and (3) a notice to users of consumer reports. The notices were published in the Federal Register at 62 Fed. Reg. 35,586 (1997) (to be codified at 16 C.F.R. pt. 601). While Commission staff may issue a commentary on the amended FCRA some time in the future, we believe it would premature to do so until we have addressed a wide variety of requests for staff opinions such as this one.
The views set forth in this opinion are those of the staff, and are not binding on the Commission.
Sincerely,
Thomas E. Kane
Endnotes:
1. Section 607(c) of the amended FCRA, 15 U.S.C. § 1681e(c), states that a consumer reporting agency may not prohibit a user of a consumer report provided by the agency from disclosing the contents of the report to a consumer who has suffered adverse action based on the report.