(a) Every consumer reporting
agency shall, upon request, and subject to section 610(a)(1), clearly
and accurately disclose to the consumer:
(1) All information in the consumer’s file
at the time of the request, except that--
(A) if the consumer
to whom the file relates requests that the first 5 digits of the social
security number (or similar identification number) of the consumer
not be included in the disclosure and the consumer reporting agency
has received appropriate proof of the identity of the requester, the
consumer reporting agency shall so truncate such number in such disclosure;
and
(B) nothing
in this paragraph shall be construed to require a consumer reporting
agency to disclose to a consumer any information concerning credit
scores or any other risk scores or predictors relating to the consumer.
(2) The sources
of the information; except that the sources of information acquired
solely for use in preparing an investigative consumer report and actually
used for no other purpose need not be disclosed: Provided,
That in the event an action is brought under this title, such sources
shall be available to the plaintiff under appropriate discovery procedures
in the court in which the action is brought.
(3) (A) Identification
of each person (including each end-user identified under section 607(e)(1))
that procured a consumer report—
(i) for employment purposes,
during the 2-year period preceding the date on which the request is
made; or
(ii) for any other
purpose, during the 1-year period preceding the date on which the
request is made.
(B) An identification of a person under
subparagraph (A) shall include—
(i) the name of the person or,
if applicable, the trade name (written in full) under which such person
conducts business; and
(ii) upon request of the consumer, the address and telephone number
of the person.
(C) Subparagraph (A) does not apply
if—
(i) the end user is an agency or department
of the United States Government that procures the report from the
person for purposes of determining the eligibility of the consumer
to whom the report relates to receive access or continued access to
classified information (as defined in section 604(b)(4)(E)(i)); and
(ii) the head of the agency
or department makes a written finding as prescribed under section
604(b)(4)(A).
(4) The dates, original payees, and amounts
of any checks upon which is based any adverse characterization of
the consumer, included in the file at the time of the disclosure.
(5) A record of all inquiries
received by the agency during the 1-year period preceding the request
that identified the consumer in connection with a credit or insurance
transaction that was not initiated by the consumer.
(6) If the consumer requests the credit
file and not the credit score, a statement that the consumer may request
and obtain a credit score.
(b) The requirements
of subsection (a) respecting the disclosure of sources of information
and the recipients of consumer reports do not apply to information
received or consumer reports furnished prior to the effective date
of this title except to the extent that the matter involved is contained
in the files of the consumer reporting agency on that date.
6-1560.1
(c) Summary of rights to obtain and dispute
information in consumer reports and to obtain credit scores.
(1) (A)
The Bureau shall prepare a model summary of the rights of consumers
under this title.
(B) The summary of rights prepared under subparagraph (A) shall include
a description of—
(i) the right of a consumer to obtain a copy
of a consumer report under subsection (a) from each consumer reporting
agency;
(ii) the frequency
and circumstances under which a consumer is entitled to receive a
consumer report without charge under section 612;
(iii) the right of a consumer to dispute information
in the file of the consumer under section 611;
(iv) the right of a consumer to obtain a credit
score from a consumer reporting agency, and a description of how to
obtain a credit score;
(v) the method by which a consumer can contact, and obtain a consumer
report from, a consumer reporting agency without charge, as provided
in the regulations of the Bureau prescribed under section 211(c) of
the Fair and Accurate Credit Transactions Act of 2003; and
(vi) the method by which a consumer
can contact, and obtain a consumer report from, a consumer reporting
agency described in section 603(w), as provided in the regulations
of the Bureau prescribed under section 612(a)(1)(C).
(C) The Bureau shall—
(i) actively publicize the availability of the summary of rights
prepared under this paragraph;
(ii) conspicuously post on its Internet website
the availability of such summary of rights; and
(iii) promptly make such summary of rights
available to consumers, on request.
6-1560.11
(2) A consumer reporting
agency shall provide to a consumer, with each written disclosure by
the agency to the consumer under this section—
(A) the
summary of rights prepared by the Bureau under paragraph (1);
(B) in the case of a consumer
reporting agency described in section 603(p), a toll-free telephone
number established by the agency, at which personnel are accessible
to consumers during normal business hours;
(C) a list of all Federal agencies responsible
for enforcing any provision of this title, and the address and any
appropriate phone number of each such agency, in a form that will
assist the consumer in selecting the appropriate agency;
(D) a statement that the
consumer may have additional rights under State law, and that the
consumer may wish to contact a State or local consumer protection
agency or a State attorney general (or the equivalent thereof) to
learn of those rights; and
(E) a statement that a consumer reporting
agency is not required to remove accurate derogatory information from
the file of a consumer, unless the information is outdated under section
605 or cannot be verified.
6-1560.12
(d) Summary of rights of identity
theft victims.
(1) The Bureau, in consultation with the
Federal banking agencies and the National Credit Union Administration,
shall prepare a model summary of the rights of consumers under this
title with respect to the procedures for remedying the effects of
fraud or identity theft involving credit, an electronic fund transfer,
or an account or transaction at or with a financial institution or
other creditor.
(2)
Beginning 60 days after the date on which the model summary of rights
is prescribed in final form by the Bureau pursuant to paragraph (1),
if any consumer contacts a consumer reporting agency and expresses
a belief that the consumer is a victim of fraud or identity theft
involving credit, an electronic fund transfer, or an account or transaction
at or with a financial institution or other creditor, the consumer
reporting agency shall, in addition to any other action that the agency
may take, provide the consumer with a summary of rights that contains
all of the information required by the Bureau under paragraph
(1), and information on how to contact the Commission to obtain more
detailed information.
6-1560.13
(e) Information available to victims.
(1) For the purpose of documenting fraudulent
transactions resulting from identity theft, not later than 30 days
after the date of receipt of a request from a victim in accordance
with paragraph (3), and subject to verification of the identity of
the victim and the claim of identity theft in accordance with paragraph
(2), a business entity that has provided credit to, provided for consideration
products, goods, or services to, accepted payment from, or otherwise
entered into a commercial transaction for consideration with, a person
who has allegedly made unauthorized use of the means of identification
of the victim, shall provide a copy of application and business transaction
records in the control of the business entity, whether maintained
by the business entity or by another person on behalf of the business
entity, evidencing any transaction alleged to be a result of identity
theft to—
(A) the victim;
(B) any Federal, State, or local government
law enforcement agency or officer specified by the victim in such
a request; or
(C)
any law enforcement agency investigating the identity theft and authorized
by the victim to take receipt of records provided under this subsection.
6-1560.14
(2) Before a business
entity provides any information under paragraph (1), unless the business
entity, at its discretion, otherwise has a high degree of confidence
that it knows the identity of the victim making a request under paragraph
(1), the victim shall provide to the business entity—
(A) as proof
of positive identification of the victim, at the election of the business
entity—
(i) the presentation of a government-issued
identification card;
(ii)
personally identifying information of the same type as was provided
to the business entity by the unauthorized person; or
(iii) personally identifying
information that the business entity typically requests from new applicants
or for new transactions, at the time of the victim’s request for information,
including any documentation described in clauses (i) and (ii); and
(B)
as proof of a claim of identity theft, at the election of the business
entity—
(i) a copy of a police report evidencing the
claim of the victim of identity theft; and
(ii) a properly completed—
(I) copy of a standardized affidavit of identity
theft developed and made available by the Bureau; or
(II) an affidavit of fact that is acceptable
to the business entity for that purpose.
6-1560.15
(3) The request of a victim
under paragraph (1) shall—
(A) be in writing;
(B) be mailed to an address specified
by the business entity, if any; and
(C) if asked by the business entity,
include relevant information about any transaction alleged to be a
result of identity theft to facilitate compliance with this section
including—
(i) if known by the victim (or if readily
obtainable by the victim), the date of the application or transaction;
and
(ii) if known by the
victim (or if readily obtainable by the victim), any other identifying
information such as an account or transaction number.
(4) Information
required to be provided under paragraph (1) shall be so provided without
charge.
(5) A business
entity may decline to provide information under paragraph (1) if,
in the exercise of good faith, the business entity determines that—
(A) this subsection does not require disclosure of the information;
(B) after reviewing
the information provided pursuant to paragraph (2), the business
entity does not have a high degree of confidence in knowing the true
identity of the individual requesting the information;
(C) the request for the
information is based on a misrepresentation of fact by the individual
requesting the information relevant to the request for information;
or
(D) the information
requested is Internet navigational data or similar information about
a person’s visit to a website or online service.
6-1560.16
(6) Except as provided
in section 621, sections 616 and 617 do not apply to any violation
of this subsection.
(7) No business entity may be held civilly liable under any provision
of Federal, State, or other law for disclosure, made in good faith
pursuant to this subsection.
(8) Nothing in this subsection creates
an obligation on the part of a business entity to obtain, retain,
or maintain information or records that are not otherwise required
to be obtained, retained, or maintained in the ordinary course of
its business or under other applicable law.
(9) (A) No provision
of subtitle A of title V of Public Law 106-102, prohibiting the disclosure
of financial information by a business entity to third parties shall
be used to deny disclosure of information to the victim under this
subsection.
(B)
Except as provided in subparagraph (A), nothing in this subsection
permits a business entity to disclose information, including information
to law enforcement under subparagraphs (B) and (C) of paragraph (1),
that the business entity is otherwise prohibited from disclosing under
any other applicable provision of Federal or State law.
6-1560.17
(10) In any civil action
brought to enforce this subsection, it is an affirmative defense (which
the defendant must establish by a preponderance of the evidence) for
a business entity to file an affidavit or answer stating that—
(A) the business entity has made a reasonably diligent search of
its available business records; and
(B) the records requested under this
subsection do not exist or are not reasonably available.
(11) For purposes of this
subsection, the term “victim” means a consumer whose means of identification
or financial information has been used or transferred (or has been
alleged to have been used or transferred) without the authority of
that consumer, with the intent to commit, or to aid or abet, an identity
theft or a similar crime.
(12) This subsection shall become effective 180 days after the date
of enactment of this subsection.
(13) Not later than 18 months after the
date of enactment of this subsection, the Comptroller General of the
United States shall submit a report to Congress assessing the effectiveness
of this provision.
6-1560.18
(f) Disclosure of credit scores.
(1) Upon the request of a consumer for
a credit score, a consumer reporting agency shall supply to the consumer
a statement indicating that the information and credit scoring model
may be different than the credit score that may be used by the lender,
and a notice which shall include—
(A) the current credit
score of the consumer or the most recent credit score of the consumer
that was previously calculated by the credit reporting agency for
a purpose related to the extension of credit;
(B) the range of possible credit scores
under the model used;
(C) all of the key factors that adversely affected the credit score
of the consumer in the model used, the total number of which shall
not exceed 4, subject to paragraph (9);
(D) the date on which the credit score
was created; and
(E) the name of the person or entity that provided the credit score
or credit file upon which the credit score was created.
(2) For purposes of this
subsection, the following definitions shall apply:
(A) The
term “credit score”—
(i) means a numerical value or a categorization
derived from a statistical tool or modeling system used by a person
who makes or arranges a loan to predict the likelihood of certain
credit behaviors, including default (and the numerical value or the
categorization derived from such analysis may also be referred to
as a “risk predictor” or “risk score”); and
(ii) does not include—
(I) any mortgage score or rating of an automated
underwriting system that considers one or more factors in addition
to credit information, including the loan to value ratio, the amount
of down payment, or the financial assets of a consumer; or
(II) any other elements of the
underwriting process or underwriting decision.
(B) The
term “key factors” means all relevant elements or reasons adversely
affecting the credit score for the particular individual, listed in
the order of their importance based on their effect on the credit
score.
6-1560.19
(3)
The information required by this subsection shall be provided in the
same timeframe and manner as the information described in subsection
(a).
(4) This subsection
shall not be construed so as to compel a consumer reporting agency
to develop or disclose a score if the agency does not—
(A) distribute
scores that are used in connection with residential real property
loans; or
(B) develop
scores that assist credit providers in understanding the general credit
behavior of a consumer and predicting the future credit behavior of
the consumer.
(5) (A) This subsection shall not
be construed to require a consumer reporting agency that distributes
credit scores developed by another person or entity to provide a further
explanation of them, or to process a dispute arising pursuant to section
611, except that the consumer reporting agency shall provide the consumer
with the name and address and website for contacting the person or
entity who developed the score or developed the methodology of the
score.
(B) This
paragraph shall not apply to a consumer reporting agency that develops
or modifies scores that are developed by another person or entity.
6-1560.2
(6) This subsection shall
not be construed to require a consumer reporting agency to maintain
credit scores in its files.
(7) In complying with this subsection,
a consumer reporting agency shall—
(A) supply the consumer
with a credit score that is derived from a credit scoring model that
is widely distributed to users by that consumer reporting agency in
connection with residential real property loans or with a credit score
that assists the consumer in understanding the credit scoring assessment
of the credit behavior of the consumer and predictions about the future
credit behavior of the consumer; and
(B) a statement indicating that the
information and credit scoring model may be different than that used
by the lender.
(8) A consumer reporting agency may charge
a fair and reasonable fee, as determined by the Bureau, for providing
the information required under this subsection.
(9) If a key factor that adversely affects
the credit score of a consumer consists of the number of enquiries
made with respect to a consumer report, that factor shall be included
in the disclosure pursuant to paragraph (1)(C) without regard to the
numerical limitation in such paragraph.
6-1560.21
(g) Disclosure of credit scores
by certain mortgage lenders.
(1) Any person who makes or arranges loans
and who uses a consumer credit score, as defined in subsection (f),
in connection with an application initiated or sought by a consumer
for a closed end loan or the establishment of an open end loan
for a consumer purpose that is secured by 1 to 4 units of residential
real property (hereafter in this subsection referred to as the “lender”)
shall provide the following to the consumer as soon as reasonably
practicable:
(A) (i) A copy of the
information identified in subsection (f) that was obtained from a
consumer reporting agency or was developed and used by the user of
the information.
(ii) In
addition to the information provided to it by a third party that provided
the credit score or scores, a lender is only required to provide the
notice contained in subparagraph (D).
(B) (i) If
a person that is subject to this subsection uses an automated underwriting
system to underwrite a loan, that person may satisfy the obligation
to provide a credit score by disclosing a credit score and associated
key factors supplied by a consumer reporting agency.
(ii) However, if a numerical credit score
is generated by an automated underwriting system used by an enterprise,
and that score is disclosed to the person, the score shall be disclosed
to the consumer consistent with subparagraph (C).
(iii) For purposes of this subparagraph, the
term “enterprise” has the same meaning as in paragraph (6) of section
1303 of the Federal Housing Enterprises Financial Safety and Soundness
Act of 1992.
(C) A person that is subject to the
provisions of this subsection and that uses a credit score, other
than a credit score provided by a consumer reporting agency, may satisfy
the obligation to provide a credit score by disclosing a credit score
and associated key factors supplied by a consumer reporting agency.
6-1560.22
(D) A copy of the following
notice, which shall include the name, address, and telephone number
of each consumer reporting agency providing a credit score that was
used:
6-1560.23
(E) This subsection
shall not require any person to—
6-1560.24
(2)
(A) Any provision in a contract
that prohibits the disclosure of a credit score by a person who makes
or arranges loans or a consumer reporting agency is void.
(B) A lender shall not have liability under any contractual
provision for disclosure of a credit score pursuant to this subsection.
[15 USC 1681g.
As amended by acts of Sept. 23, 1994 (108 Stat. 2237); Sept. 30, 1996
(110 Stat. 3009-436, 437, 439); Nov. 2, 1998 (112 Stat. 3210); Dec.
4, 2003 (117 Stat. 1961, 1970, 1973, 1975); and July 21, 2010 (124
Stat. 2087).]
