(a) In general. Subject to subsection (c), any consumer reporting
agency may furnish a consumer report under the following circumstances
and no other:
(1) In response to the order of a court
having jurisdiction to issue such an order, a subpoena issued in connection
with proceedings before a Federal grand jury, or a subpoena issued
in accordance with section 5318 of title 31, United States Code, or
section 3486 of title 18, United States Code.
(2) In accordance with the written instructions
of the consumer to whom it relates.
(3) To a person which it has reason to
believe—
(A) intends to use the information in
connection with a credit transaction involving the consumer on whom
the information is to be furnished and involving the extension of
credit to, or review or collection of an account of, the consumer;
or
(B) intends to
use the information for employment purposes; or
(C) intends to use the information in
connection with the underwriting of insurance involving the consumer;
or
(D) intends to
use the information in connection with a determination of the consumer’s
eligibility for a license or other benefit granted by a governmental
instrumentality required by law to consider an applicant’s financial
responsibility or status; or
(E) intends to use the information,
as a potential investor or servicer, or current insurer, in connection
with a valuation of, or an assessment of the credit or prepayment
risks associated with, an existing credit obligation; or
(F) otherwise has a legitimate
business need for the information—
(i) in connection with a
business transaction that is initiated by the consumer; or
(ii) to review an account to determine whether the
consumer continues to meet the terms of the account.
(4) In response
to a request by the head of a State or local child support enforcement
agency (or a State or local government official authorized by the
head of such an agency), if the person making the request certifies
to the consumer reporting agency that—
(A) the
consumer report is needed for the purpose of establishing an individual’s
capacity to make child support payments, determining the appropriate
level of such payments, or enforcing a child support order, award,
agreement, or judgment;
(B) the parentage of the consumer for
the child to which the obligation relates has been established or
acknowledged by the consumer in accordance with State laws under which
the obligation arises (if required by those laws); and
(C) the consumer report
will be kept confidential, will be used solely for a purpose described
in subparagraph (A), and will not be used in connection with any other
civil, administrative, or criminal proceeding, or for any other purpose.
(5) To an
agency administering a State plan under section 454 of the Social
Security Act (42 U.S.C. 654) for use to set an initial or modified
child support award.
(6) To the Federal Deposit Insurance Corporation or the National
Credit Union Administration as part of its preparation for its appointment
or as part of its exercise of powers, as conservator, receiver, or
liquidating agent for an insured depository institution or insured
credit union under the Federal Deposit Insurance Act or the Federal
Credit Union Act, or other applicable Federal or State law, or in
connection with the resolution or liquidation of a failed or failing
insured depository institution or insured credit union, as applicable.
6-1554.1
(b) Conditions for furnishing
and using consumer reports for employment purposes.
(1) A consumer reporting agency may furnish
a consumer report for employment purposes only if—
(A) the
person who obtains such report from the agency certifies to the agency
that—
(i) the person has complied with paragraph
(2) with respect to the consumer report, and the person will comply
with paragraph (3) with respect to the consumer report if paragraph
(3) becomes applicable; and
(ii) information from the consumer report will not be used in violation
of any applicable Federal or State equal employment opportunity law
or regulation; and
(B) the consumer reporting agency provides
with the report, or has previously provided, a summary of the consumer’s
rights under this title, as prescribed by the Bureau under section
609(c)(3).
(2)(A) Except as provided in subparagraph
(B), a person may not procure a consumer report, or cause a consumer
report to be procured, for employment purposes with respect to any
consumer, unless—
(i) a clear and conspicuous disclosure has
been made in writing to the consumer at any time before the report
is procured or caused to be procured, in a document that consists
solely of the disclosure, that a consumer report may be obtained for
employment purposes; and
(ii) the consumer has authorized in writing (which authorization
may be made on the document referred to in clause (i)) the procurement
of the report by that person.
(B) If a consumer described in subparagraph
(C) applies for employment by mail, telephone, computer, or other
similar means, at any time before a consumer report is procured or
caused to be procured in connection with that application—
(i) the person who procures the consumer report on the consumer for
employment purposes shall provide to the consumer, by oral, written,
or electronic means, notice that a consumer report may be obtained
for employment purposes, and a summary of the consumer’s rights
under section 615(a)(3); and
(ii) the consumer shall have consented, orally, in writing, or electronically
to the procurement of the report by that person.
(C) Subparagraph (B) shall
apply to a person procuring a consumer report on a consumer in connection
with the consumer’s application for employment only if—
(i) the consumer is applying for a position over which the Secretary
of Transportation has the power to establish qualifications and maximum
hours of service pursuant to the provisions of section 31502 of title
49, or a position subject to safety regulation by a State transportation
agency; and
(ii) as of
the time at which the person procures the report or causes the report
to be procured the only interaction between the consumer and the person
in connection with that employment application has been by mail, telephone,
computer, or other similar means.
(3)(A) Except as provided in subparagraph
(B), in using a consumer report for employment purposes, before taking
any adverse action based in whole or in part on the report, the person
intending to take such adverse action shall provide to the consumer
to whom the report relates—
(i) a copy of the report; and
(ii) a description in writing
of the rights of the consumer under this title, as prescribed by the
Bureau under section 609(c)(3).
(B)(i) If
a consumer described in subparagraph (C) applies for employment by
mail, telephone, computer, or other similar means, and if a person
who has procured a consumer report on the consumer for employment
purposes takes adverse action on the employment application based
in whole or in part on the report, then the person must provide to
the consumer to whom the report relates, in lieu of the notices required
under subparagraph (A) of this section and under section 615(a), within
3 business days of taking such action, an oral, written or electronic
notification—
(I) that adverse action has been taken based in whole or in part
on a consumer report received from a consumer reporting agency;
(II) of the name, address
and telephone number of the consumer reporting agency that furnished
the consumer report (including a toll-free telephone number established
by the agency if the agency complies and maintains files on consumers
on a nationwide basis);
(III) that the consumer reporting agency did not make the decision
to take the adverse action and is unable to provide to the consumer
the specific reasons why the adverse action was taken; and
(IV) that the consumer may,
upon providing proper identification, request a free copy of a report
and may dispute with the consumer reporting agency the accuracy of
completeness of any information in a report.
(ii) If, under clause (B)(i)(IV),
the consumer requests a copy of a consumer report from the person
who procured the report, then, within 3 business days of receiving
the consumer’s request, together with proper identification,
the person must send or provide to the consumer a copy of a report
and a copy of the consumer’s rights as prescribed by the Bureau
under section 609(c)(3).
(C) Subparagraph (B) shall apply to
a person procuring a consumer report on a consumer in connection with
the consumer’s application for employment only if—
(i) the consumer is applying for a position over which the Secretary
of Transportation has the power to establish qualifications and maximum
hours of service pursuant to the provisions of section 31502 of title
49, or a position subject to safety regulation by a State transportation
agency; and
(ii) as of
the time at which the person procures the report or causes the report
to be procured the only interaction between the consumer and the person
in connection with that employment application has been by mail, telephone,
computer, or other similar means.
6-1554.11
(4)(A)
In the case of an agency or department of the United States Government
which seeks to obtain and use a consumer report for employment purposes,
paragraph (3) shall not apply to any adverse action by such agency
or department which is based in part on such consumer report, if the
head of such agency or department makes a written finding that—
(i) the consumer report is relevant to a national security investigation
of such agency or department;
(ii) the investigation is within the jurisdiction
of such agency or department;
(iii) there is reason to believe that compliance with paragraph (3)
will—
(I) endanger the life or
physical safety of any person;
(II) result in flight from prosecution;
(III) result in the destruction
of, or tampering with, evidence relevant to the investigation;
(IV) result in the intimidation
of a potential witness relevant to the investigation;
(V) result in the compromise of classified
information; or
(VI)
otherwise seriously jeopardize or unduly delay the investigation or
another official proceeding.
(B) Upon the conclusion
of a national security investigation described in subparagraph (A),
or upon the determination that the exception under subparagraph (A)
is no longer required for the reasons set forth in such subparagraph,
the official exercising the authority in such subparagraph shall provide
to the consumer who is the subject of the consumer report with regard
to which such finding was made—
(i) a copy of such consumer
report with any classified information redacted as necessary;
(ii) notice of any adverse action
which is based, in part, on the consumer report; and
(iii) the identification with reasonable specificity
of the nature of the investigation for which the consumer report was
sought.
(C) For purposes of subparagraphs (A) and (B), the head of any agency
or department of the United States Government may delegate his or
her authorities under this paragraph to an official of such agency
or department who has personnel security responsibilities and is a
member of the Senior Executive Service or equivalent civilian or military
rank.
(D) For purposes
of this paragraph, the following definitions shall apply:
(i) The term
“classified information” means information that is protected
from unauthorized disclosure under Executive Order No. 12958 or successor
orders.
(ii) The term
“national security investigation” means any official inquiry
by an agency or department of the United States Government to determine
the eligibility of a consumer to receive access or continued access
to classified information or to determine whether classified information
has been lost or compromised.
6-1554.2
(c) Furnishing reports in
connection with credit or insurance transactions that are not initiated
by the consumer.
(1) A consumer reporting agency may furnish
a consumer report relating to any consumer pursuant to subparagraph
(A) or (C) of subsection (a)(3) in connection with any credit or insurance
transaction that is not initiated by the consumer only if—
(A) the consumer authorizes the agency to provide such report to
such person; or
(B)(i) the transaction consists of a
firm offer of credit or insurance;
(ii) the consumer reporting agency has complied
with subsection (e);
(iii)
there is not in effect an election by the consumer, made in accordance
with subsection (e), to have the consumer’s name and address
excluded from lists of names provided by the agency pursuant to this
paragraph; and
(iv) the consumer
report does not contain a date of birth that shows that the consumer
has not attained the age of 21, or, if the date of birth on the consumer
report shows that the consumer has not attained the age of 21, such
consumer consents to the consumer reporting agency to such furnishing.
(2) A person may receive pursuant to paragraph (1)(B) only—
(A) the name and address of a consumer;
(B) an identifier that is not unique
to the consumer and that is used by the person solely for the purpose
of verifying the identity of the consumer; and
(C) other information pertaining to
a consumer that does not identify the relationship or experience of
the consumer with respect to a particular creditor or other entity.
(3) Except
as provided in section 609(a)(5), a consumer reporting agency shall
not furnish to any person a record of inquiries in connection with
a credit or insurance transaction that is not initiated by a consumer.
(d) [Reserved]
6-1554.3
(e) Election of consumer to be excluded
from lists.
(1) A consumer may elect to have the consumer’s
name and address excluded from any list provided by a consumer reporting
agency under subsection (c)(1)(B) in connection with a credit or insurance
transaction that is not initiated by the consumer, by notifying the
agency in accordance with paragraph (2) that the consumer does not
consent to any use of a consumer report relating to the consumer in
connection with any credit or insurance transaction that is not initiated
by the consumer.
(2)
A consumer shall notify a consumer reporting agency under paragraph
(1)—
(A) through the notification system
maintained by the agency under paragraph (5); or
(B) by submitting to the agency a signed
notice of election form issued by the agency for purposes of this
subparagraph.
(3) Upon receipt of notification of the
election of a consumer under paragraph (1) through the notification
system maintained by the agency under paragraph (5), a consumer reporting
agency shall—
(A) inform the consumer that the election
is effective only for the 5-year period following the election if
the consumer does not submit to the agency a signed notice of election
form issued by the agency for purposes of paragraph (2)(B); and
(B) provide to the
consumer a notice of election form, if requested by the consumer,
not later than 5 business days after receipt of the notification of
the election through the system established under paragraph (5), in
the case of a request made at the time the consumer provides notification
through the system.
(4) An election of a consumer under paragraph
(1)—
(A) shall be effective with respect
to a consumer reporting agency beginning 5 business days after the
date on which the consumer notifies the agency in accordance with
paragraph (2);
(B)
shall be effective with respect to a consumer reporting agency—
(i) subject to subparagraph (C), during the 5-year period beginning
5 business days after the date on which the consumer notifies the
agency of the election, in the case of an election for which a consumer
notifies the agency only in accordance with paragraph (2)(A); or
(ii) until the consumer
notifies the agency under subparagraph (C), in the case of an election
for which a consumer notifies the agency in accordance with paragraph
(2)(B);
(C) shall not be effective after the date on which the consumer notifies
the agency, through the notification system established by the agency
under paragraph (5), that the election is no longer effective; and
(D) shall be effective
with respect to each affiliate of the agency.
6-1554.4
(5)(A)
Each consumer reporting agency that, under subsection (c)(1)(B), furnishes
a consumer report in connection with a credit or insurance transaction
that is not initiated by a consumer, shall—
(i) establish and
maintain a notification system, including a toll-free telephone number,
which permits any consumer whose consumer report is maintained by
the agency to notify the agency, with appropriate identification,
of the consumer’s election to have the consumer’s name
and address excluded from any such list of names and addresses provided
by the agency for such a transaction; and
(ii) publish by not later than 365 days after
the date of enactment of the Consumer Credit Reporting Reform Act
of 1996, and not less than annually thereafter, in a publication of
general circulation in the area served by the agency—
(I) a notification that information in consumer
files maintained by the agency may be used in connection with such
transactions; and
(II)
the address and toll-free telephone number for consumers to use to
notify the agency of the consumer’s election under clause (i).
(B) Establishment and maintenance of
a notification system (including a toll-free telephone number) and
publication by a consumer reporting agency on the agency’s own
behalf and on behalf of any of its affiliates in accordance with this
paragraph is deemed to be compliance with this paragraph by each of
those affiliates.
(6) Each consumer reporting agency that
compiles and maintains files on consumers on a nationwide basis shall
establish and maintain a notification system for purposes of paragraph
(5) jointly with other such consumer reporting agencies.
6-1554.5
(f) Certain use or obtaining
of information prohibited. A person shall not use or obtain a
consumer report for any purpose unless—
(1) the consumer report is obtained for
a purpose for which the consumer report is authorized to be furnished
under this section; and
(2) the purpose is certified in accordance with section 607 by a
prospective user of the report through a general or specific certification.
6-1554.6
(g) Protection of medical
information.
(1) A consumer reporting agency shall not
furnish for employment purposes, or in connection with a credit or
insurance transaction, a consumer report that contains medical information
(other than medical contact information treated in the manner required
under section 605(a)(6)) about a consumer, unless—
(A) if furnished
in connection with an insurance transaction, the consumer affirmatively
consents to the furnishing of the report;
(B) if furnished for employment purposes
or in connection with a credit transaction—
(i) the information
to be furnished is relevant to process or effect the employment or
credit transaction; and
(ii) the consumer provides specific written consent for the furnishing
of the report that describes in clear and conspicuous language the
use for which the information will be furnished; or
(C) the information
to be furnished pertains solely to transactions, accounts, or balances
relating to debts arising from the receipt of medical services, products,
or devises, where such information, other than account status or amounts,
is restricted or reported using codes that do not identify, or do
not provide information sufficient to infer, the specific provider
or the nature of such services, products, or devices, as provided
in section 605(a)(6).
(2) Except as permitted pursuant to paragraph
(3)(C) or regulations prescribed under paragraph (5)(A), a creditor
shall not obtain or use medical information (other than medical
contact information treated in the manner required under section 605(a)(6))
pertaining to a consumer in connection with any determination of the
consumer’s eligibility, or continued eligibility, for credit.
(3) Section 603(d)(3)
shall not be construed so as to treat information or any communication
of information as a consumer report if the information or communication
is disclosed—
(A) in connection with the business
of insurance or annuities, including the activities described in section
18B of the model Privacy of Consumer Financial and Health Information
Regulation issued by the National Association of Insurance Commissioners
(as in effect on January 1, 2003);
(B) for any purpose permitted without
authorization under the Standards for Individually Identifiable Health
Information promulgated by the Department of Health and Human Services
pursuant to the Health Insurance Portability and Accountability Act
of 1996, or referred to under section 1179 of such Act, or described
in section 502(e) of Public Law 106-102; or
(C) as otherwise determined to be necessary
and appropriate, by regulation or order, by the Bureau or the applicable
State insurance authority (with respect to any person engaged in providing
insurance or annuities); or
(4) Any person that receives medical information
pursuant to paragraph (1) or (3) shall not disclose such information
to any other person, except as necessary to carry out the purpose
for which the information was initially disclosed, or as otherwise
permitted by statute, regulation, or order.
(5)(A) The Bureau
may, after notice and opportunity for comment, prescribe regulations
that permit transactions under paragraph (2) that are determined to
be necessary and appropriate to protect legitimate operational, transactional,
risk, consumer, and other needs (and which shall include permitting
actions necessary for administrative verification purposes), consistent
with the intent of paragraph (2) to restrict the use of medical information
for inappropriate purposes.
(6) No provision of this subsection shall
be construed as altering, affecting, or superseding the applicability
of any other provision of Federal law relating to medical confidentiality.
[15
USC 1681b. As amended by acts of Aug. 9, 1989 (103 Stat. 506); Aug.
22, 1996 (110 Stat. 2240); Sept. 30, 1996 (110 Stat. 3009-430, 431,
433, 434); Nov. 20, 1997 (111 Stat. 2255); Nov. 2, 1998 (112 Stat.
3208, 3209, 3210, 3211); Nov. 27, 2002 (116 Stat. 2426); Dec. 4, 2003
(117 Stat. 1979, 1999, 2003); Dec. 13, 2003 (117 Stat. 2625); Oct.
13, 2006 (120 Stat. 1998); May 22, 2009 (123 Stat. 1748); July 21,
2010 (124 Stat. 2087); Dec. 4, 2015 (129 Stat. 1792); and Jan. 1,
2021 (134 Stat. 4594).]
