Proposed FCRA Amendments

The Fair Credit Reporting Act was initially enacted at a time when computers had only recently become commonplace in the credit reporting industry. But even in its infancy, the credit reporting industry already showed signs that the unregulated and unsupervised use of computers held the potential to wreck havoc on the lives of consumers. Some 30 years later, the credit reporting industry argued that the statute needed to be updated "to protect consumers" from the immanent sunset of this protective statute. In the wake of those updates, the Fair and Accurate Credit Transactions Act, provided some much needed protection from the new wave of identity thefts. But, many of those protections remain fire walled from use by the consumers who they were intended to protect.

The following is a listing of corrections needed to allow this statute to fulfill its mandate of protecting consumers. Chief among them is injunctive relief.

While consumers have found little help in Congress, representative Ayanna Pressley has introduced proposed legislature to address a number of the suggestions below. That act, the Comprehensive Credit Reporting Enhancement, Disclosure, Innovation, and Transparency Act of 2020, represents a significant step towards correcting the deficiencies in the current regulatory framework. We applaud representative Pressley's work and call on her peers in Congress to join in her efforts.

1. Injunctive Relief - Injunctive relief is the ability of a court to command that a party take some particular action. In the context of typical credit reporting case, this authority would allow the court to order that a credit bureau or creditor stop publishing false credit information or comply with the law.

   Currently, there is no provision of the Fair Credit Reporting Act that allows a consumer to sue to correct inaccurate data in their credit report. Let me say that again: Consumer have no statutory right to correct their credit reports! This is precisely the type of relief that most consumers want. Unfortunately, a majority of the courts that have been asked to provide this type of relief have held that it is not available.

   Instead, the only express remedy allowed under the FCRA is to seek damages. In practice, this means that consumers have use their claims for damages (which are authorized under the Fair Credit Reporting Act) to convince credit bureaus that continuing to publish false information is an costly practice, and hope that they will correct the inaccuracies.

   The addition of injunctive relief to the available remedies under the Fair Credit Reporting Act has been on advocates wish list for more than 20 years now. It is the remedy most consumers request and easiest for courts to grant if Congress chooses to allow the remedy. Congress should expressly provide this much-needed relief to the millions of victims of identity theft and credit reporting abuse and prescribe the necessary elements required for relief.

2. Records Retention - Currently, there is no requirement that the credit bureaus retain copies of the credit reports that they prepare. The absence of this requirement - which is generally applicable to creditors who use reports - has meant that it is impossible to obtain copies of old reports from the company that produced those reports. None of the major credit bureaus currently save those copies.

   The lack of a record retention requirement adds tens of thousands of dollars to credit reporting litigation. Given the radical drop in the cost of digital storage, Congress should require the credit bureaus to retain these documents for five years, which is the out limit of the time consumers may sue the credit bureaus. Insuring that this information is retained and available for consumers is of paramount importance to enforcement of the rights of consumers and the proper function of the Fair Credit Reporting Act.

   Retained records should include

   • Any data transmitted to a credit bureau.
   • Any data received by a credit bureau for reporting
   • Any record of disputes
   • Any investigatory work notes relating to a dispute
   • Account histories used to generate credit reporting data
   • Credit reports prepared by a credit bureau or received from a credit bureau.
   • Data reflecting the structure of the consumer's file, the manner of its preparation, or historic changes to the file.

3. Private Right of Action for Adverse Action Notices - One of the most important requirements of the FCRA is the provision requiring creditors to notify consumers when they take adverse action based on credit reports. That notice informs the consumer that a credit report was used, and gives them information about their right to obtain a free copy of the report used to deny credit.

   This provision was previously enforceable by consumers. At that time, many creditors complied with this provision.  But, in 2003, Congress revised the FCRA and removed the right of consumers to enforce this provision of the FCRA. Since then, creditors have increasingly ignored this provision, particularly when attempting to "pre-qualify" consumers. Creditors typically do this by looking at the consumer's credit before receiving a credit application and advise the consumer whether their application would be denied or granted.

   For purposes of federal law, this amounts to a straight-up denial or approval, and creditors should provide appropriate notices. But because the creditors make the application process itself contingent on a favorable report, many creditors do not provide appropriate notices and many consumers do not ever learn of their right to receive a free copy of their report.

   Congress should return this private right of action and allow consumers to sue if they do not receive the appropriate notice.

4. Revised Adverse Action Notices - The FCRA currently contains provisions for "adverse action notices" to consumers whose credit reports have been used to as a reason to deny them credit or other benefits. That notice currenty requires that the user of the reports certain information about the denial, including the credit score used and a notice of the consumer's rights.

   Unfortunately, this notice provides little useful information to the consumer.

   While the notice requires discloure of the score used to render the decision, scoring models vary in their available ranges, as well as the significance of the score. For example, FICO currently offers dozens of different scoring models. At the same time, the credit reporting agencies offer their own scoring models, and creditors often create private scoring models which are specific to their own needs. While these scoring models may assist creditors, the disclosure of a score alone - divorced from how the model works, the available range, and the impact of specific informatin used to create the score - provides consumers with virtually no useful information. For instance, the consumer who has been denied has no idea which items in the report may have caused a denial and would have no idea whether they were close to being approved.

   Congress should adopt a revised notice which provides useful information about the action that was taken, how the consumer was impacted by data in their report, and guidance on how the consumer could improve their report to obtain the credit. Specifically, a revised notice should provide for the following:

   • Copies of Reports . Consumers should be given the right to request a copy of the actual report that was used to render the credit decision. Current law allows the consumer to request a copy of their credit file from the credit bureaus. But, the credit bureaus do not retain copies of reports that they have sold, and the reports provided to consumers often differ materially from those provided to creditors. Consumers should be granted access to the reports used without having to file a lawsuit.
   • Score Ranges . Most credit applications today are initially reviewed by computers that apply simple algorithms called "auto approve" and "auto decline" logic to credit scores. That logic examines the consumers score and determines whether the score falls above or below certain ranges established by the creditor. If the score is above a certain number, the application is granted. If the score falls below a certain number, the application is denied. And even when there is no algorithm, humans often apply this same type of decision logic. Congress should require creditors to disclose the available range against which the consumer was measured and disclose the scoring ranges which were used for "auto approve" and "auto decline" logic. This allows consumers to learn whether their application was reviewed by a human and whether the score value was determinitive in the ultimate credit decision. This disclosure would assist consumers in knowing whether they were close or far from being approved.
   • Impactful Data . Many consumers look at credit denials and wonder what they can do differently to obtain credit. The current notices do not provide that information, but instead provide generalized information about the types of data that may have impacted the credit decision. Those notices were designed at a time before computers were able to provide robust data and were not as heaviliy relied upon to render credit decisions. Simply put, computers were not able to provide more detailed information, and so Congress did not require it.

   Currently, computers make the vast bulk of credit decisions, with humans providing fact checking after the fact. As such, the computers have or can quickly calculate information about the credit decision which the consumer can use to change their behavior and improve their credit. Revisions to the FCRA should require the creditor to identify any credit item on the consumers report which impacted the consumer's score enough to cause them to be denied credit. This information allows the consumer to identify highly impactful credit accounts which need to be improved in order for the consumer to obtain credit.

5. Revised Notices of Dispute Resolution - Currently the FCRA allows consumers whose disputes have been rejected by a credit bureau to ask for an explanation of the denial. While this provision sought to educate consumers about their credit, this provision has been twisted. Consumers who exerciese this right receive only form letter telling them that the the credit reporting agency has asked the furnisher of the data about the matter and it was verified. This explanation provides little guidance to the consumer on how move to the next step or take the matter up with the creditor.
   
   In order to perform their statutory purpose, this provision of the FCRA [15 USC 1681i(a)(6)(iii)] need strengthening to provide consumers with meaningful information that will help them either understand why the result of the investigation is correct, or else that the information was not properly investigated and should be challenged in court. In either event, consumers need more information about verifications of disputed information. 
   
   Revisions to the FCRA should provide consumers with right to ask for the actual response to the dispute provided by the verifying furnisher. This documents is most often a single page document which is transmitted via electronic exchange. The provision of this document would provide virtually no burden to the credit bureau that has this information easily at hand and could provide this information as easily as it currently provides its form-based response. At the same time, a copy of the actual response would serve the educational purpose of assisting the consumer to understand how and why the item was verified, and would also provide the necessary information to know whether further disputes are needed.

6. Private Right of Action for Direct Disputes - Prior to the 1996 amendments of the FCRA, data furnishers had no potential liability under the FCRA for providing false data to credit bureaus. With those amendments, Congress provided for liability if the the consumer disputed credit informationto the credit bureau and the credit bureau forwarded the dispute to the data furnisher. In those cases, Congress allowed consumers to sue the data furnisher if they were able to prove that their the furnisher failed to conduct a reasonable investigation of the credit information. Along with that liability came federal preemption of any state law claims against data furnishers for having provided false information to the credit bureaus.

   This provision has proven to be the source of more consumer and judicial confusion than any other provision of the FCRA. The core problem is that consumers who see false information on their credit report immediately assume that they should dispute to that company rather than the credit bureau. Even though the FCRA provides that consumers are allowed to make disptutes directly to creditors and other data furnishers, it does not allow them to sue unless they have sent the dispute to the credit bureau. And even if the consumer disputes directly to the creditor, they have no claim unless they have made that dispute to the credit bureau first.

   The law books are filled with cases of consumers who disputed false information directly to the creditor that was reporting that information, but still had their cases dismissed. This mistake is so common that even attorneys make it! Congress needs to put an an end to this and allow consumers to sue if they have disputed directly the creditor.

7. Private Right of Action for ID Theft Remedies (1681g and 1681m) - In 2003, Congress enacted FACTA, a revision to the Fair Credit Reporting Act that was intended to address the burgeoning crime of identity theft. As part of the new provisions, Congress put in place several provisions intended to empower victims of identity theft and provide them with information that would allow them to stop ID theft in real time, and to help undue the harmful consequences following an identity theft.

   Chief among those provisions were the provisions of 15 U.S.C. 1681g(e) and 1681m.

   Section 1681g(e) allows victims of identity theft to obtain copies of account documents and statements relating to accounts arising from identity theft. The purpose here is to allow consumers to have copies of these documents so that they can use them to dispute accounts that they did not open. This provision, however, has no private right of enforcement. Consequently, most businesses do no comply with this provision at all.

   One of the many problems facing victims of identity theft is the continuous transfer of identity theft accounts. Ordinarily, when debt collectors receive notice that an account is uncollectable, they will return the account to the company that transferred the account to them. Section 1681m(f) prohibits debt collectors from transferring an account relating to identity theft to a third party. Similarly, if the collector returns the account to the prior creditor, it must notify them of any identity theft that they have learned of.

   Both of these provisions are unenforceable by consumers. Congress should allow consumers to privately enforce these provisions.

8. Access to Records - As the some of the world's largest data providers, the major credit reporting agencies and their furnishers possess an enormous amount of data concerning the consumers that they deal with. This data sometimes reflects the consumer's credit history, but also includes whether the consumer has disputed an account, whether fraud is suspected, and data concerning the management of the consumer's records.

   In litigation, these companies regularly withhold this data concerning the consumer - citing the consumer's own privacy or their right to profit from the consumer - as a basis for withholding this data. Revisions to the FCRA should require these companies to turn over this data upon request, without limitation. The refuse to provide this data only increases the cost of lawsuits and lines the pockets of the attorneys who defend crooked companies.

9. Account Renumbering - During the life of a credit account, creditors use an "account number" to track the history of the account and the amounts owed by the consumer. One of the most frustrating events in dealing with credit comes when the creditor - or an assignee of the creditor - attributes a new account number to the account. These changing numbers make it difficult for the consumer to determine if the account belongs to them, and if so how much is owed. As a matter of industry practice, each creditor who receives a new account will assign an new account number. Likewise, major events that impact on the validity of an account (like identity theft) may cause a creditor to assign a new number. These industry practices render credit reporting difficult to track. Revisions to the FCRA should require creditors to provide all past account numbers when reporting credit account. These revisions should also require credit reporting agencies to publish this information.

10. Preemption - The Fair Credit Reporting Act currently preempts all state laws relating to suits against banks, finance companies, and debt collectors who report data to the credit bureaus (known as data "furnishers"). Because the FCRA does not allow consumers to sue before they have written dispute letters, most consumers are left without a remedy for harm that arises before they become aware that they credit has been harmed. Congress should allow consumers to use state law remedies to seek compensation for harm imposed by data furnishers, particularly when they act in willful violation of the law.

11. Subscriber Copies to Consumers - Consumer reporting agencies are required by the Fair Credit Reporting Act to disclose the contents of a consumer's file to that consumer upon request. This requirement is intended to assure that consumer can see exactly what a potential creditor would see. The reality is of what happens is far difference.

    Because the credit bureaus allow creditors to access consumer reports with varying amounts of information, the results can also vary. As a consequence, a consumer may never see exactly what has been given to the creditor. Credit bureaus place additional hurdles before consumers by requiring creditors to agree that they will not show consumers copies of their reports.

    Revisions to the FCRA should allow consumers to have access to the actual report given to a creditor so that consumers have access to the same information possessed by creditors.

12. Anti-Retaliation - In order to avoid the discrimination, federal law requires creditors to rely on objective information to evaluate credit applications.  Consequently, credit reports have become a fact of life for every American participating in the US economy. Unfortunately, credit bureaus make mistakes, and sometime refuse to correct them. When this happens, consumers are left with no choice but to sue to obtain correction of their credit report. In some instances, credit bureaus have responded to these legitimate grievances by retaliating and taking consumers' files "offline." This means that creditors have no ability to access that consumer's credit file.

    Under the federal consumer credit protection act, creditors are prohibited from retaliating against consumers who assert their right under that statute. Sadly the Fair Credit Reporting Act has no similar provisions. Congress should act to prohibit credit bureaus, resellers, and data furnishers from retaliating against consumers who assert their rights under the FCRA.

13. Central Report Requests - The CFPB maintains an informal list of consumer reporting agencies. That list now occupies a 40-page booklet. There are just too many companies selling data about consumers than most consumers can keep up with. Ordering, reviewing and disputing the data of over a 100 credit bureaus is simply unreasonable.

    To ease the burden on consumers, Congress should require credit bureaus to register with a central clearinghouse where consumers can requests and review their reports. That clearinghouse would effectively allow consumers to identify who is maintaining data about them. Allowing consumers to request all available reports from a centralized location would reduce the burden of drafting requests letters and waiting for responses. Congress has already provided for a form of this central registry in relation to the major nationwide consumer reporting agencies by allowing consumers to order reports from Equifax, Experian and Trans Union through the FreeAnualCreditReport.com web site.

    What is need here is for Congress to extend these protections and require all consumer reporting agencies so that consumers are not required to chase after the data of the remaining 100 or so credit bureaus who sell data about consumers.

14. Centralized Dispute Center - Congress has previously provided consumers with a centralized registry to provide notices to industry. The "Do No Call" registry has been one of the most successful efforts at reducing the amount of "robo-calls" and solicitations. That list is maintained on a nationwide basis and companies who engage in the regulated activity of making autodialed calls must check the "do not call registry" before placing any call in an autodialer.

    Congress should provide the same ability for consumers to identify issues with credit reports, dispute false credit and background information, and require credit bureaus to consult that list before issuing reports.  Consumers could use this list to provide information known problems, such as identity theft and mis-attributed data. Once implemented, that list would operate as a central clearinghouse for all disputes, placing credit bureaus on notice of potentially false data, and help eliminate rampant errors in the credit bureaus' data bases.

15. Address Discrepancies - One of the first signs of identity theft to show up in credit reports are discrepancies between established addresses and new incoming addresses. With the 2003 FACTA revisions to the Fair Credit Reporting Act, came requirements governing address discrepancies. Under those revisions, credit bureaus were required to notify users of credit reports when the address used to apply for credit differed from existing addresses within the credit bureaus data base. In turn, users were required to establish procedures for trapping and acting on these notifications from credit bureaus.

    These provisions recognize that changes in address represent the one of the earliest indicators that an identity theft is ongoing. What was missing from these provisions was any notice to consumers of these same problems. Because the accuracy provisions of the FCRA rely upon consumers to notify credit bureaus of inaccurate information, the failure to require notice to the consumer presents a crucial defect in the regulatory scheme. Consumers - who are in the best position to know whether an address is valid or fake - should be notified when a credit bureau receives a new address relating to that consumers so that the consumer can review and validate those changes.

16. Subscriber Copies on Adverse Action - The Fair Credit Reporting Act requires that users of credit reports must provide a notice of adverse action if they deny credit to a consumer based in whole or part on a credit report.  In turn, credit bureaus are required to provide the consumer with a copy of the consumer's report to the consumer upon request. That request can be made at any time within 60 days of the credit denial. The purpose of this provision is to allow the consumer to see what items may have impacted a credit decision and give them them information needed to improve their credit score.

    The problem with this provision has been that the versions of the reports given to creditors and consumers can differ greatly depending on the time elapsed and the search criteria used by the creditor. Specifically, if a creditor has provided only minimal information in its search request, the credit bureau's report may deliver more information than in appropriate. But the consumer's own request requires more information than is required of the creditor. Consequently, the report given to the consumer can differ greatly from than given to the creditor. In those cases, consumers may never learn that false or inaccurate information has been delivered to the creditors, effectively making it impossible for the consumer to ever seek correction.

    The CFPB previously considered a rule requiring credit bureaus to provide consumers with the exact same information provided to creditors, but the bureau bowed to industry pressure to keep this information from consumers. Congress should act to correct this and make this critical information available to consumers.

17. Definitions of Furnishers, Users, and Affiliates - Missing from the the text of the Fair Credit Reporting Act are definitions corresponding to the parties regulated by the act. Revisions to the statute should correct this technical flaw to provide clarity and bring other parties under the act. Specifically, parties acting as data processors for furnishers of credit reports and data brokers who combine regulated credit reporting information with unregulated information.

18. Failure to Report - One of the most prevalent problems faced by consumers is the absence of data in the consumer's report. This can happen because the creditor does not participate in the credit reporting system with any of the many credit bureaus. This can also happen when a credit bureau disassociates the consumer from their data.

    The absence of this data from the consumer's report can be problematic for consumers because the failure to properly associate and report data with the correct consumer can lead to the absence of data from the consumers credit file. Thus, in even though several creditors may have reported data about a specific consumer, the credit bureaus might fail to include that data in a report about that same consumer, leading to unjustified credit denials or approval.

    Currently, most courts treat the failure to report a consumer's credit data as not being regulated by the act. Instead, those courts hold that there is no liability under the act for failing to report data.

    Certainly, a credit bureau cannot report data that it does not possess. In those instances, the credit bureau should not be liable. But, if the credit bureau has received data about the consumer and fails or refuses to publish that data in response to a request, that failure inevitably leads to a less correct view of the consumer's credit history and the credit bureau should be responsible. In those instances, the credit bureau should be strictly liable if it possesses the requested information and has failed to associated that data with the correct consumer so that it is available for use.

19. Availability of Data to Consumers - Currently, the FCRA allows consumers to request copies of their consumer files. In principal, this provision gives access to the same data that credit bureaus may provide to their customers. While this information is important and allows the consumer to monitor changes to their report, when litigation arises, the credit bureaus refuse to provide data about their work that may have resulted in an error in a report. Consumer advocates spend most of their time trying to obtain this information. Amendments to the FCRA should make these documents available to the consumer upon request so that their attorneys can properly investigate matters before filing suit.
20. Complete Copies of Reports for Disclosures - The FCRA requires that when consumers dispute, the credit bureaus response must include a copy of a disclosure of the consumer's file. [15 USC 1681i(a)(6)(B)(ii)]. While the statute is clear that the credit bureau must disclose the consumer's "file," some courts have incorrectly held that disclosure of only of a portion of the file is sufficient. [Nunnally v. Equifax Information Services, LLC, 451 F.3d 768, 769 (11th Cir. 2006).] Congress needs to correct this error by the federal courts.
21. Claims for Misattributed Data and Reports
22. Claims for Fragmented Files and Missing File Data