New Law Extends Fair Credit Reporting Act Preemption, ImposesNew Requirements on Credit Bureaus and Users

On December 4, 2003, President Bush signed into law the "Fair and Accurate Transactions Act of 2003" ("FACTA"). This article emphasizes the provisions of FACTA that most significantly affect lenders and other users of consumer reports. It should be noted that there are many other provisions that primarily affect consumer reporting agencies ("CRAs"), particularly with regard to consumers who assert that they are victims of identity theft.

The enactment of FACTA was motivated by the scheduled expiration at the end of 2003 of provisions of the Fair Credit Reporting Act ("FCRA") that preempt state laws involving the same subject matter. In particular, FACTA makes permanent an existing FCRA provision that prevents states from restricting the exchange of information among affiliates by giving consumers the right to "opt out" of such information sharing. FACTA also imposes new requirements on lenders and other users of information from CRAs and on the CRAs themselves, including a federal "opt-out" from a company's use of a consumer's financial information and a new notice that must be provided when a credit report influences the pricing or other terms of a loan. The effective date of most of the law's provisions will be determined in joint rules to be adopted by the FRB and Federal Trade Commission ("FTC"). The FRB/FTC rulemaking on the effective date must be completed within two months of enactment and must specify an effective date of no more than ten months later, resulting in an effective date for the FACTA provisions concerned of no later than twelve months after enactment.

Federal Preemption. The preemption in existing subject areas is made permanent. If FACTA had not been enacted, the states could have, beginning on January 1, 2004, enacted legislation restricting sharing of information among affiliates. The existing FCRA allows a company to share consumer report information with affiliates, subject to an opt-out right. Several states, most prominently California, had enacted or were in the process of enacting legislation that would have further restricted information-sharing. Many of those state provisions will now be permanently preempted by the amended FCRA.

FACTA also makes permanent the preemption of state laws in the other areas covered by the existing FCRA preemption provision: responsibilities of credit bureaus and users of credit reports; credit and insurance solicitations based on credit bureau prescreening; notices of adverse action; responsibilities of companies that furnish information to credit bureaus; timing requirements for CRAs investigating disputes; and prohibitions against CRAs reporting obsolete information. FACTA also generally preempts state legislation regarding the specific subject matter of the federal provision. But in contrast to the preemption of affiliate information-sharing, FACTA does not preempt other state laws that take different approaches to remedying the same problem. For example, in an effort to address identity theft, FACTA requires point-of-sale terminals to truncate credit and debit card numbers. State laws that require truncation would appear to be preempted to the extent that they differ from the federal law (for example, a state law with an earlier effective date). But state laws that address identity theft in other ways, such as by restricting the use of a social security number, do not appear to be preempted.

A new provision states specifically that nothing in FCRA is intended to preempt state laws regulating the use of credit-based insurance scores or disclosure of their use. Apparently, this provision would allow states to issue rules permitting the use of credit reports in setting insurance rates and would allow the states to determine the contents of any notice.

Risk -Based Pricing Notice. FACTA requires a person that uses a credit report in connection with an application for or grant or extension of credit on "material terms that are materially less favorable than the most favorable terms available" to a "substantial proportion" of that creditor's other customers to give the consumer a "risk-based pricing notice." The notice must identify the CRA that provided the information and explains that the information affected the terms of the offer. The notice may be provided orally, electronically (without regard to the consent provisions of the federal E-SIGN law) or in writing. If the lender provides a notice of adverse action, no risk-based pricing notice is required, but the risk-based pricing notice does not replace the adverse action notice.

The FRB and FTC are to issue joint rules that will define terms such as "materially less favorable" and specify the timing of the notice. The notice may generally be provided at application, communication of an offer of credit, or when the credit is granted (closing for real estate transactions), which would allow lenders to provide a generic notice to all applicants at the time of application. But the FRB/FTC rule may specify situations in which the notice may only be provided after a consumer report has been used to set the terms of a credit offer.

There is no private cause of action for violations of this provision.

Use of Information from Affiliates. As noted, FACTA makes permanent the existing FACTA provision that prevents states from going beyond the FCRA requirement to give the consumer the opportunity to opt out of the sharing of consumer report information with affiliates. (Consumer report information includes both information from CRAs and financial information about the consumer that does not reflect a company's own transactions and experiences with the consumer).

Another FACTA provision, however, restricts the use by a company of any information (including both transaction and experience and consumer report information) obtained from an affiliate for marketing solicitations to persons with which the company (not the affiliate) does not already have a business relationship. In order for a company to use such information, it must first give the consumer the right to opt out of information-sharing for marketing purposes. The federal banking agencies, the FTC, and the SEC are to issue rules implementing the opt-out requirement for companies under their respective jurisdictions, including a "simple" method to opt out. An opt-out will be effective for five years, and a company must give the consumer an opportunity to renew it before its affiliates may begin marketing solicitations based on the information.

The provision does not prohibit the sharing of information for other purposes. Financial services companies may continue to maintain common databases to provide services for an affiliate and use information in connection with employment services or employee benefits provided by the affiliate. The company that shares information about its customers, however, may not solicit its customers on behalf of an affiliate if the customers have opted out of use of the information by affiliates. States may not impose greater restrictions on affiliate-sharing for marketing purposes.

Other Provisions. Other provisions of FACTA that affect financial services firms include, among others:

  • CRAs that generate credit scores must provide a score upon the consumer's request, together with the key factors that contributed to the score. Mortgage lenders and brokers must provide the score soon after using it, together with the key factors and an explanation of the role of credit scores in lenders' decisions. A mortgage "risk score" that reflects factors other than credit history need not be provided.
  • Consumers may place a "fraud alert" in their file with the CRA. Users of credit reports must "utilize . . . reasonable policies and procedures to form a reasonable belief that the user knows the identity of the person making the request" before extending new closed-end credit or opening or increasing an open-end credit line.
  • Consumers may receive a free annual credit report, under FTC rules that may stagger the effective date of the free report to protect the CRAs from a surge in demand for free reports.
  • Expanded disclosures of the right to opt out of credit information sharing with affiliates.
  • A longer statute of limitations, allowing lawsuits within five years of the violation, together with a "discovery rule," also allowing actions within two years of discovery (the latter overruling a recent Supreme Court decision).
  • Consumers must be notified before, or within thirty days after, negative information about them is reported to CRAs. This notice may be provided with billing materials or collection letters.
  • Expanded responsibilities for furnishers of information to CRAs to avoid reporting inaccurate information.

*article courtesy of Goodwin Procter LLP