The recently enacted amendments to the Fair Credit Reporting Act contain both substantial new benefits and new responsibilities for banks.
In previous articles in this series, we discussed the benefits of provisions relating to prescreening and affiliate information sharing. We also described the significant new responsibilities imposed on banks that regularly furnish consumer data to credit bureaus.
This final article focuses on other important aspects of the amended law, including the duties imposed on banks that use consumer reports, the enforcement rules for banks, and the preemption of state law that establishes federal law as the national uniform standard in a number of key areas.
Historically, the Fair Credit Reporting Act had imposed few requirements on users of consumer reports. The most significant obligation was to notify the consumer when adverse action is taken based on information in a credit bureau report. This notice must include the name and address of the credit bureau that furnished the report.
The amended law, however, requires that the consumer must also be given the telephone number of the credit bureau that provided the report (including a toll-free number if it is a nationwide credit bureau), a statement that the credit bureau did not make the decision to take adverse action, notice of the consumer's right to obtain a free copy of the report from the credit bureau upon written request within 60 days, and notice of the consumer's right to dispute with the credit bureau the accuracy or completeness of any information in its report.
As a result, banks must modify their adverse-action notice forms in order to comply with the new requirements. But all the required information can be presented on a single form, and this disclosure can still be combined with the notice required for credit denials under the federal Equal Credit Opportunity Act.
To ensure flexibility and to accommodate electronic communications, the amended law also states that this notification can be given orally or in written or electronic form.
The federal law has long provided that a credit bureau may furnish a credit report only to a person who has a "permissible purpose" for the report, and the list of acceptable purposes is set forth in the law itself.
The statute adds a corresponding provision mandating that a bank or other entity wishing to obtain such reports from a credit bureau must certify to the bureau the legally authorized purpose or purposes for which it will use credit reports.
The law itself makes it clear that this can be done through use of either a general or a specific certification. Therefore, a bank that regularly uses credit reports need not certify its intended use of each report separately.
Instead, it may operate under a general certification stating the purposes for which it will receive or electronically obtain such reports. It is anticipated that such general certifications will be included in most agreements between banks and credit bureaus, just as they typically are today.
Though the law has always prohibited credit bureaus from giving a credit report to a recipient without a permissible purpose, the old law did not require a report recipient to certify a permissible purpose to the bureau. Under the old law, a credit report recipient would only violate the law if it knowingly obtained the report under false pretenses.
The new law's affirmative certification requirement, however, provides a basis for action by federal or state law enforcement authorities, and consumers, against a person or organization that improperly obtains a credit report, regardless of whether false pretenses were involved.
Thus, it becomes easier to challenge a bank or bank employee that improperly obtains a credit report. In addition, the amended law expands civil liability and increases criminal liability for obtaining a credit report under false pretenses.
Several other important aspects of the amendments to the credit reporting law should be noted as well.
First, the revised law makes it clear that, as a general rule, the new obligations of banks and others that furnish information to credit bureaus may be enforced only by the Federal Trade Commission, federal banking agencies, and state attorneys general.
As a result, unlike other federal consumer laws, the amended credit reporting statute does not authorize individuals to bring lawsuits alleging violations of these new obligations. The only exception is that a consumer may sue if a furnisher of credit data fails to reinvestigate when the consumer disputes information in a credit bureau file.
Although no federal agency has authority to write rules under the amended law, the FTC has been the agency principally interpreting the statute.
Under the revised statute, however, the Federal Reserve Board is given specific authority to issue interpretations of the law for all federally insured financial institutions, as well as their holding companies and affiliates.
These interpretations by the Fed, which are to be developed in consultation with other federal banking agencies, are expected to help clarify the application of the law to the operations of banks and their affiliates, including all nonbank affiliates.
Finally, and perhaps most importantly, the revised law preempts all state and local laws (both as to requirements and prohibitions) in a number of important areas for banks. By preempting all such provisions, the amended statute establishes itself as the national uniform standard in these areas.
Specifically, the federal law now preempts any state or local law relating to any aspect of prescreening. It also preempts any state or local law regarding the sharing of information among affiliated companies, such as members of the same bank holding company family, with the exception of one narrow Vermont law.
In addition, the statute preempts any state or local law purporting to impose duties on banks, card issuers, and others that furnish consumer information to credit bureaus (with the exception of certain provisions of California and Massachusetts law on this subject).
Furthermore, the federal law now preempts any state or local law regarding the responsibilities of banks that take adverse action in connection with consumer applications, including the new notice requirement described above.
The federal amendments also preempt state and local law in other areas, although the preemption provisions just described are undoubtedly the most important for banks. Under the revised law, a "sunset" date of Jan. 1, 2004, is set for all these preemptions.
Importantly, however, none of the preempted state laws will automatically be reinstated. Instead, a state must enact new legislation after the sunset date. This means that the inconsistent provisions of so- called "little reporting act" statutes that exist in many states today, including most of the California and New York provisions, are effectively preempted and would have to be reenacted in order to have effect after Jan. 1,2004.
This extensive federal preemption substantially addresses the operating problems faced by banks in trying to comply both with federal credit reporting law and the inconsistent requirements of state laws. As a result, the national lending programs of banks and their affiliates are facilitated.
Mr. Fischer, Mr. McEneney, and Mr. Camper are lawyers in the Washington office of Morrison & Foerster.
