Fair Credit Reporting Act (FCRA)

§ 609. Disclosures to consumers [15 U.S.C. § 1681g]

(a) Information on file; sources; report recipients. Every consumer reporting agency shall,
upon request, and subject to 610(a)(1) [§ 1681h], clearly and accurately disclose to
the consumer:

(1) All information in the consumer's file at the time of the request except that--

(A) if the consumer to whom the file relates requests that the first 5 digits of
the social security number (or similar identification number) of the
consumer not be included in the disclosure and the consumer reporting
agency has received appropriate proof of the identity of the requester, the
consumer reporting agency shall so truncate such number in such
disclosure; and
(B) nothing in this paragraph shall be construed to require a consumer
reporting agency to disclose to a consumer any information concerning
credit scores or any other risk scores or predictors relating to the
consumer.

(2) The sources of the information; except that the sources of information acquired
solely for use in preparing an investigative consumer report and actually use for
no other purpose need not be disclosed: Provided, That in the event an action is
brought under this title, such sources shall be available to the plaintiff under
appropriate discovery procedures in the court in which the action is brought.
(3)

(A) Identification of each person (including each end-user identified under
section 607(e)(1) [§ 1681e]) that procured a consumer report

(i) for employment purposes, during the 2-year period preceding the date
on which the request is made; or
(ii) for any other purpose, during the 1-year period preceding the date on
which the request is made.

(B) An identification of a person under subparagraph (A) shall include

(i) the name of the person or, if applicable, the trade name (written in full)
under which such person conducts business; and
(ii) upon request of the consumer, the address and telephone number of the
person.

(i) the end user is an agency or department of the United States
Government that procures the report from the person for purposes of
determining the eligibility of the consumer to whom the report relates
to receive access or continued access to classified information (as
defined in section 604(b)(4)(E)(i)); and
(ii) the head of the agency or department makes a written finding as
prescribed under section 604(b)(4)(A).

(4) The dates, original payees, and amounts of any checks upon which is based any
adverse characterization of the consumer, included in the file at the time of the
disclosure.
(5) A record of all inquiries received by the agency during the 1-year period
preceding the request that identified the consumer in connection with a credit or
insurance transaction that was not initiated by the consumer.
(6) If the consumer requests the credit file and not the credit score, a statement that the
consumer may request and obtain a credit score.

(b) Exempt information. The requirements of subsection (a) of this section respecting the
disclosure of sources of information and the recipients of consumer reports do not
apply to information received or consumer reports furnished prior to the effective
date of this title except to the extent that the matter involved is contained in the files
of the consumer reporting agency on that date.

(1) Commission Summary of Rights Required

(A) In general. The Commission shall prepare a model summary of the rights
of consumers under this title.
(B) Content of summary. The summary of rights prepared under subparagraph
(A) shall include a description of–

(i) the right of a consumer to obtain a copy of a consumer report under
subsection (a) from each consumer reporting agency;
(ii) the frequency and circumstances under which a consumer is entitled to
receive a consumer report without charge under section 612;
(iii) the right of a consumer to dispute information in the file of the
consumer under section 611;
(iv) the right of a consumer to obtain a credit score from a consumer
reporting agency, and a description of how to obtain a credit score;
(v) the method by which a consumer can contact, and obtain a consumer
report from, a consumer reporting agency without charge, as provided
in the regulations of the Commission prescribed under section 211(c)
of the Fair and Accurate Credit Transactions Act of 2003; and
(vi) the method by which a consumer can contact, and obtain a consumer
report from, a consumer reporting agency described in section 603(w),
as provided in the regulations of the Commission prescribed under
section 612(a)(1)(C).

(i) actively publicize the availability of the summary of rights prepared
under this paragraph;
(ii) conspicuously post on its Internet website the availability of such
summary of rights; and
(iii) promptly make such summary of rights available to consumers, on request.

(2) Summary of rights required to be included with agency disclosures. A consumer
reporting agency shall provide to a consumer, with each written disclosure by the
agency to the consumer under this section--

(A) the summary of rights prepared by the Commission under paragraph (1);
(B) in the case of a consumer reporting agency described in section 603(p), a
toll-free telephone number established by the agency, at which personnel
are accessible to consumers during normal business hours;
(C) a list of all Federal agencies responsible for enforcing any provision of this
title, and the address and any appropriate phone number of each such agency,
in a form that will assist the consumer in selecting the appropriate agency;
(D) a statement that the consumer may have additional rights under State law,
and that the consumer may wish to contact a State or local consumer
protection agency or a State attorney general (or the equivalent thereof) to
learn of those rights; and
(E) a statement that a consumer reporting agency is not required to remove
accurate derogatory information from the file of a consumer, unless the
information is outdated under section 605 or cannot be verified.

(d) Summary of Rights of Identity Theft Victims

(1) In general. The Commission, in consultation with the Federal banking agencies and
the National Credit Union Administration, shall prepare a model summary of the
rights of consumers under this title with respect to the procedures for remedying the
effects of fraud or identity theft involving credit, an electronic fund transfer, or an
account or transaction at or with a financial institution or other creditor.
(2) Summary of rights and contact information. Beginning 60 days after the date on
which the model summary of rights is prescribed in final form by the Commission
pursuant to paragraph (1), if any consumer contacts a consumer reporting agency
and expresses a belief that the consumer is a victim of fraud or identity theft
involving credit, an electronic fund transfer, or an account or transaction at or
with a financial institution or other creditor, the consumer reporting agency shall,
in addition to any other action that the agency may take, provide the consumer
with a summary of rights that contains all of the information required by the
Commission under paragraph (1), and information on how to contact the
Commission to obtain more detailed information.

(e) Information Available to Victims

(1) In general. For the purpose of documenting fraudulent transactions resulting from
identity theft, not later than 30 days after the date of receipt of a request from a
victim in accordance with paragraph (3), and subject to verification of the identity of
the victim and the claim of identity theft in accordance with paragraph (2), a business
entity that has provided credit to, provided for consideration products, goods, or
services to, accepted payment from, or otherwise entered into a commercial
transaction for consideration with, a person who has allegedly made unauthorized
use of the means of identification of the victim, shall provide a copy of application
and business transaction records in the control of the business entity, whether
maintained by the business entity or by another person on behalf of the business
entity, evidencing any transaction alleged to be a result of identity theft to--

(A) the victim;
(B) any Federal, State, or local government law enforcement agency or officer
specified by the victim in such a request; or
(C) any law enforcement agency investigating the identity theft and authorized
by the victim to take receipt of records provided under this subsection.

(2) Verification of identity and claim. Before a business entity provides any information
under paragraph (1), unless the business entity, at its discretion, otherwise
has a high degree of confidence that it knows the identity of the victim making a
request under paragraph (1), the victim shall provide to the business entity--

(A) as proof of positive identification of the victim, at the election of the
business entity–

(i) the presentation of a government-issued identification card;
(ii) personally identifying information of the same type as was provided to
the business entity by the unauthorized person; or
(iii) personally identifying information that the business entity typically
requests from new applicants or for new transactions, at the time of the
victim's request for information, including any documentation
described in clauses (i) and (ii); and

(B) as proof of a claim of identity theft, at the election of the business entity--

(i) a copy of a police report evidencing the claim of the victim of identity
theft; and
(ii) a properly completed--
(I) copy of a standardized affidavit of identity theft developed and
made available by the Commission; or
(II) an affidavit of fact that is acceptable to the business entity for that
purpose.

(3) Procedures. The request of a victim under paragraph (1) shall--

(A) be in writing;
(B) be mailed to an address specified by the business entity, if any; and
(C) if asked by the business entity, include relevant information about any
transaction alleged to be a result of identity theft to facilitate compliance
with this section including–

(i) if known by the victim (or if readily obtainable by the victim), the date
of the application or transaction; and
(ii) if known by the victim (or if readily obtainable by the victim), any
other identifying information such as an account or transaction
number.

(4) No charge to victim. Information required to be provided under paragraph (1)
shall be so provided without charge.

(5) Authority to decline to provide information. A business entity may decline to
provide information under paragraph (1) if, in the exercise of good faith, the
business entity determines that--

(A) this subsection does not require disclosure of the information;
(B) after reviewing the information provided pursuant to paragraph (2), the
business entity does not have a high degree of confidence in knowing the
true identity of the individual requesting the information;
(C) the request for the information is based on a misrepresentation of fact by
the individual requesting the information relevant to the request for
information; or
(D) the information requested is Internet navigational data or similar
information about a person's visit to a website or online service.

(6) Limitation on liability. Except as provided in section 621, sections 616 and 617 do
not apply to any violation of this subsection.
(7) Limitation on civil liability. No business entity may be held civilly liable under
any provision of Federal, State, or other law for disclosure, made in good faith
pursuant to this subsection.
(8) No new recordkeeping obligation. Nothing in this subsection creates an obligation
on the part of a business entity to obtain, retain, or maintain information or
records that are not otherwise required to be obtained, retained, or maintained in
the ordinary course of its business or under other applicable law.
(9) Rule of Construction

(A) In general. No provision of subtitle A of title V of Public Law 106-102,
prohibiting the disclosure of financial information by a business entity to
third parties shall be used to deny disclosure of information to the victim
under this subsection.
(B) Limitation. Except as provided in subparagraph (A), nothing in this
subsection permits a business entity to disclose information, including
information to law enforcement under subparagraphs (B) and (C) of
paragraph (1), that the business entity is otherwise prohibited from
disclosing under any other applicable provision of Federal or State law.

(10) Affirmative defense. In any civil action brought to enforce this subsection, it is an
affirmative defense (which the defendant must establish by a preponderance of
the evidence) for a business entity to file an affidavit or answer stating that--

(A) the business entity has made a reasonably diligent search of its available
business records; and
(B) the records requested under this subsection do not exist or are not
reasonably available.

(11) Definition of victim. For purposes of this subsection, the term “victim” means a
consumer whose means of identification or financial information has been used or
transferred (or has been alleged to have been used or transferred) without the
authority of that consumer, with the intent to commit, or to aid or abet, an identity
theft or a similar crime.
(12) Effective date. This subsection shall become effective 180 days after the date of
enactment of this subsection.
(13) Effectiveness study. Not later than 18 months after the date of enactment of this
subsection, the Comptroller General of the United States shall submit a report to
Congress assessing the effectiveness of this provision.

(f) Disclosure of Credit Scores

(1) In general. Upon the request of a consumer for a credit score, a consumer
reporting agency shall supply to the consumer a statement indicating that the
information and credit scoring model may be different than the credit score that
may be used by the lender, and a notice which shall include--

(A) the current credit score of the consumer or the most recent credit score of
the consumer that was previously calculated by the credit reporting agency
for a purpose related to the extension of credit;
(B) the range of possible credit scores under the model used;
(C) all of the key factors that adversely affected the credit score of the
consumer in the model used, the total number of which shall not exceed 4,
subject to paragraph (9);
(D) the date on which the credit score was created; and
(E) the name of the person or entity that provided the credit score or credit file
upon which the credit score was created.

(2) Definitions. For purposes of this subsection, the following definitions shall apply:

(A) The term “credit score” --

(i) means a numerical value or a categorization derived from a statistical
tool or modeling system used by a person who makes or arranges a loan
to predict the likelihood of certain credit behaviors, including default
(and the numerical value or the categorization derived from such analysis
may also be referred to as a “risk predictor” or “risk score”); and
(ii) does not include--
(I) any mortgage score or rating of an automated underwriting system
that considers one or more factors in addition to credit information,
including the loan to value ratio, the amount of down payment, or the
financial assets of a consumer; or
(II) any other elements of the underwriting process or underwriting decision.

(B) The term “key factors” means all relevant elements or reasons adversely
affecting the credit score for the particular individual, listed in the order of
their importance based on their effect on the credit score.

(3) Timeframe and manner of disclosure. The information required by this subsection
shall be provided in the same timeframe and manner as the information described
in subsection (a).

(4) Applicability to certain uses. This subsection shall not be construed so as to
compel a consumer reporting agency to develop or disclose a score if the agency
does not--

(A) distribute scores that are used in connection with residential real property
loans; or
(B) develop scores that assist credit providers in understanding the general
credit behavior of a consumer and predicting the future credit behavior of
the consumer.

(5) Applicability to credit scores developed by another person.

(A) In general. This subsection shall not be construed to require a consumer
reporting agency that distributes credit scores developed by another person
or entity to provide a further explanation of them, or to process a dispute
arising pursuant to section 611, except that the consumer reporting agency
shall provide the consumer with the name and address and website for
contacting the person or entity who developed the score or developed the
methodology of the score.
(B) Exception. This paragraph shall not apply to a consumer reporting agency
that develops or modifies scores that are developed by another person or
entity.

(6) Maintenance of credit scores not required. This subsection shall not be construed
to require a consumer reporting agency to maintain credit scores in its files.
(7) Compliance in certain cases. In complying with this subsection, a consumer
reporting agency shall--

(A) supply the consumer with a credit score that is derived from a credit
scoring model that is widely distributed to users by that consumer
reporting agency in connection with residential real property loans or with
a credit score that assists the consumer in understanding the credit scoring
assessment of the credit behavior of the consumer and predictions about
the future credit behavior of the consumer; and
(B) a statement indicating that the information and credit scoring model may
be different than that used by the lender.

(8) Fair and reasonable fee. A consumer reporting agency may charge a fair and
reasonable fee, as determined by the Commission, for providing the information
required under this subsection.
(9) Use of enquiries as a key factor. If a key factor that adversely affects the credit
score of a consumer consists of the number of enquiries made with respect to a
consumer report, that factor shall be included in the disclosure pursuant to
paragraph (1)(C) without regard to the numerical limitation in such paragraph.

(g) Disclosure of Credit Scores by Certain Mortgage Lenders

(1) In general. Any person who makes or arranges loans and who uses a consumer
credit score, as defined in subsection (f), in connection with an application
initiated or sought by a consumer for a closed end loan or the establishment of an
open end loan for a consumer purpose that is secured by 1 to 4 units of residential
real property (hereafter in this subsection referred to as the “lender”) shall provide
the following to the consumer as soon as reasonably practicable:

(A) Information Required under Subsection (f)

(i) In general. A copy of the information identified in subsection (f) that
was obtained from a consumer reporting agency or was developed and
used by the user of the information.
(ii) Notice under subparagraph (D). In addition to the information provided
to it by a third party that provided the credit score or scores, a lender is
only required to provide the notice contained in subparagraph (D).

(B) Disclosures in Case of Automated Underwriting System

(i) In general. If a person that is subject to this subsection uses an automated
underwriting system to underwrite a loan, that person may
satisfy the obligation to provide a credit score by disclosing a credit
score and associated key factors supplied by a consumer reporting
agency.
(ii) Numerical credit score. However, if a numerical credit score is
generated by an automated underwriting system used by an enterprise,
and that score is disclosed to the person, the score shall be disclosed to
the consumer consistent with subparagraph (C).
(iii) Enterprise defined. For purposes of this subparagraph, the term “enterprise”
has the same meaning as in paragraph (6) of section 1303 of the
Federal Housing Enterprises Financial Safety and Soundness Act of
1992.

(C) Disclosures of credit scores not obtained from a consumer reporting agency.
A person that is subject to the provisions of this subsection and that uses a
credit score, other than a credit score provided by a consumer reporting
agency, may satisfy the obligation to provide a credit score by disclosing a
credit score and associated key factors supplied by a consumer reporting
agency.
(D) Notice to home loan applicants. A copy of the following notice, which shall
include the name, address, and telephone number of each consumer
reporting agency providing a credit score that was used:
“Notice To The Home Loan Applicant
“In connection with your application for a home loan, the lender must disclose to you the
score that a consumer reporting agency distributed to users and the lender used in connection
with your home loan, and the key factors affecting your credit scores.
“The credit score is a computer generated summary calculated at the time of the request
and based on information that a consumer reporting agency or lender has on file. The scores
are based on data about your credit history and payment patterns. Credit scores are important
because they are used to assist the lender in determining whether you will obtain a loan. They
may also be used to determine what interest rate you may be offered on the mortgage. Credit
scores can change over time, depending on your conduct, how your credit history and
payment patterns change, and how credit scoring technologies change.
“Because the score is based on information in your credit history, it is very important that
you review the credit-related information that is being furnished to make sure it is accurate.
Credit records may vary from one company to another.
“If you have questions about your credit score or the credit information that is furnished to
you, contact the consumer reporting agency at the address and telephone number provided
with this notice, or contact the lender, if the lender developed or generated the credit score.
The consumer reporting agency plays no part in the decision to take any action on the loan
application and is unable to provide you with specific reasons for the decision on a loan
application.
“If you have questions concerning the terms of the loan, contact the lender.”
(E) Actions not required under this subsection. This subsection shall not require
any person to–

(i) explain the information provided pursuant to subsection (f);
(ii) disclose any information other than a credit score or key factors, as
defined in subsection (f);
(iii) disclose any credit score or related information obtained by the user
after a loan has closed;
(iv) provide more than 1 disclosure per loan transaction; or
(v) provide the disclosure required by this subsection when another person
has made the disclosure to the consumer for that loan transaction.

(F) No Obligation for Content

(i) In general. The obligation of any person pursuant to this subsection
shall be limited solely to providing a copy of the information that was
received from the consumer reporting agency.
(ii) Limit on liability. No person has liability under this subsection for the
content of that information or for the omission of any information
within the report provided by the consumer reporting agency.

(G) Person defined as excluding enterprise. As used in this subsection, the term
“person” does not include an enterprise (as defined in paragraph (6) of section
1303 of the Federal Housing Enterprises Financial Safety and Soundness Act
of 1992).

(2) Prohibition on Disclosure Clauses Null and Void

(A) In general. Any provision in a contract that prohibits the disclosure of a credit
score by a person who makes or arranges loans or a consumer reporting agency
is void.
(B) No liability for disclosure under this subsection- A lender shall not have liability
under any contractual provision for disclosure of a credit score pursuant to this
subsection.