|
|
|
The Fair and Accurate
Credit Transaction Act, H.R. 2622 (The FACT Act)
|
|
|
Background On Thursday December
4th the President signed into law the Fair and Accurate Credit Transaction
Act of 2003, Public Law 108-159 (FACT Act). The purpose of this
new law is to extend the provisions of the Fair Credit Reporting
Act which are intended to establish uniform national standards in
a number of key areas (thus preempting states from acting in these
areas). In addition the law is intended to provide consumers additional
tools to fight identity theft and to ensure the accuracy of their
credit reports. The Federal Reserve Board and the Federal Trade
Commission put out interim final rules and proposed rules to establish
effective dates for certain provisions (release date December 16,
2003). The rules establish December 31, 2003 as the effective date
for the preemption provisions which is intended to insure there
is no break in the preemptive provisions in the underlying act which
are set to expire on January 1st, 2004. The rule also establishes
March 31st, 2004 for the provisions of the FACT Act that do not
require significant changes to business procedures and December
1, 2004 for the provisions that would likely entail significant
changes to business procedures. Preemption Congress proved that when it wants to preempt state laws it can do so explicitly in legislation. The Fair Credit Reporting Act clearly states that except for the explicitly named provisions in the legislation, the FCRA is not intended to preempt state law except to the extent that state law is inconsistent with the provisions of the Act and then only to the extent of the inconsistency. In addition to extending the explicit preemptions contained in the 1996 amendments to the FCRA which were scheduled to expire at the end of this year, Congress added several new provisions to the list concerning the prevention or mitigation of identity theft. All of the provisions that explicitly preempt state law noted below are referenced to the specific provisions of the Fair Credit Reporting Act (not the sections of the Public Law). SUMMARY • Requires a credit reporting agency (CRA) to put a fraud alert or an active duty alert in a consumer’s file upon the request of a consumer under a three tiered system. Users of the credit report with a fraud/active duty alert then cannot provide credit to anyone other then the consumer unless it first attempts to comply with the fraud alert’s authorization procedure. [Preemption Explicitly Applies— Section 605A] • Prohibits companies from printing credit/debit card expiration dates or account numbers (other then the last 5 digits) on electronically printed customer receipts. Exemptions for imprinted receipts or handwritten receipts. Contains a 3 year phase in period for older cash registers/machines in use before Jan. 1, 2005. [Preemption Explicitly Applies—Section 605(g)] • Directs the Federal
banking regulators (includes the NCUA for the purposes of this summary)
to establish guidelines for financial institutions to identify and
“red-flag” suspicious activity or patterns that might indicate identity
theft. [Preemption Explicitly Applies—Section 615(e)] • Authorizes the Credit Reporting Agencies to truncate the first 5 digits of the social security number of a consumer at the request of that consumer in disclosures to that consumer. [Preemption Explicitly Applies—Section 609(a)(1)(A)] • Directs the FTC (in consultation with the Federal banking agencies) to prepare a model summary of rights for consumers who believe they may be victims of fraud or ID theft and requires CRAs to provide consumers with the model and information on contacting the FTC for more information. [Preemption Explicitly Applies—Section 609(d)] • Creates an obligation for a business entity to hand over records related to an identity theft incident (not to keep or create them) to the victim or the law enforcement agency of their choice within 30 days of the victim of the identity theft’s request. No civil liability applies to violations of this subsection. [Preemption Explicitly Applies—Section 609(e)] • Requires CRAs to block related fraudulent information on a consumer’s credit report when the consumer files a police report alleging fraud. Requires the CRA to notify the furnisher of the information that the information provided may be the result of identity theft. [Preemption Explicitly Applies—Section 605B] • Requires greater coordination between nationwide CRAs in sharing consumer complaints of identity theft and fraud alerts. Requires CRAs to provide the FTC with annual summary of the complaints. FTC is directed to develop model forms and model standards for identity theft victims to report fraud to creditors and CRAs. [Preemption Explicitly Applies—Section 621(f)] • Prevention of re-pollution of consumer reports. Furnishers that receive a police report from a consumer are prohibited from reporting information to CRAs that the consumer alleged in the report resulted from identity theft, unless the furnisher subsequently knows the information is correct. [Preemption Explicitly Applies— Section 623(a)(6)] • Prohibits the sale, transfer or the placement for collection a debt that has resulted from identity theft (some exceptions apply for repurchase; securitization; or sale of substantially all of the assets of an entity) [Preemption Explicitly Applies— Section 615(f)] • Debt collectors who learn that information in a consumer report is the result of identity theft or otherwise fraudulent must notify the relevant third party for whom they are collecting the debt, and provide information regarding disputing the debt to the victim of identity theft upon request. [Preemption Explicitly Applies—Section 615(g)] • Statute of limitations for violations of the FCRA is extended from 2 years from the violation to 2 years from discovery of the violation but no more then FIVE years. Title II—Improvements in the Use of and Consumer Access to Credit Information • Consumers may request a free credit report annually from consumer reporting agencies. If a reinvestigation is requested by a consumer after receiving a free credit report, the CRA shall complete the investigation not later then 45 days after the request is received (an additional 15 days over the time allowed if the request is received after a consumer gets a credit report for being turned down for credit). [Preemption Explicitly Applies—Section 612(a) Grandfather for specific laws in CO, GA, ME, MD, MA, NJ and VT] • Requires the Commission to come up with a model summary of the rights of consumers under this title. Requires CRAs to provide a consumer with the summary of rights, a toll-free number at which personnel are accessible to consumers during normal business hours, a list of Federal agencies responsible for enforcing this title, a statement that consumers may have additional rights under State law. [Preemption Explicitly Applies—Section 609(c)] • Requires CRAs to make available to consumers, at a reasonable fee, their most recently calculated credit score, the range of scores possible as well as the key negative factors used (up to four, but must include use of enquiries as a key factor if applicable). If the consumer only requests a credit report and not a credit score, the CRA is required to disclose that the consumer may request a credit score. [Preemption Explicitly Applies—Section 609(f) Grandfather for specific laws in CA, CO and laws in any state regulating the use in an insurance activity or of credit-based insurance scores used by any person engaged in the business of insurance] • Mortgage lenders are required to provide the consumer with a free copy of the consumer’s credit score, if it was used, along with the key factors involved and contact information for the credit bureaus. [Preemption Explicitly Applies— Section 609(g)] • Improves disclosures required to explain to consumers that they may opt-out of being included on prescreened lists generated by CRAs and extends the opt-out period from two to five years. [Preemption Explicitly Applies—Section 615(d)(2)] • Prohibits the use for marketing purposes of a consumer’s information received by an affiliate unless the consumer is provided an opportunity to opt-out of receiving such solicitations or there is a pre-existing business relationship with that consumer or the solicitation is in response to a request by the consumer. The optout remains in effect for 5 years and then the consumer must be given an opportunity to opt-out for an additional 5 years. This provision does not limit the ability to share information with an affiliate, it just limits the ability to use that information for marketing purposes. [Preemption Explicitly Applies—Section 624] • The Federal banking agencies and the FTC are required to conduct regular studies of consumer information sharing practices by financial institutions. The FTC and the Federal Reserve Board are required to study the use of credit scores on the availability and affordability of financial products and services. • The Federal banking agencies, the SEC and the FTC are supposed to issue regulations requiring the proper destruction of consumer information or consumer reports by any person that possesses or maintains them for a business purpose. • Financial companies have to notify a consumer prior to, or no later then 30 days after furnishing negative information on that consumer to a CRA. The FRB is directed to create a brief model disclosure. [Preemption Explicitly Applies— Section 623] Title III—Enhancing the Accuracy of Consumer Report Information • Requirement that creditors provide customers with new risk based pricing notices where the customer does not receive the best terms available based on information in a consumer report. The terms offered must be materially less favorable then the most favorable terms offered to a substantial portion of the users customers for this provision to apply. [Preemption Explicitly Applies—Section 615(h)] • The Federal banking agencies and the FTC are to establish guidelines for entities under their jurisdiction that furnish information to CRAs regarding the accuracy and integrity of the information furnished. [Preemption Explicitly Applies— Section 623] • Changes the standard for furnishers of information from “knows or consciously avoids knowing” the information is inaccurate to “knows or has reasonable cause to believe the information is inaccurate”…meaning having specific knowledge, other then solely allegations by the consumer, that would cause a reasonable person to have substantial doubts about the accuracy of the information” [Preemption Explicitly Applies—Section 623] • Allows the consumer to dispute the accuracy of the credit report directly with the furnisher of the disputed information and requires the furnisher to investigate in the same time frame that the CRA would have had (30 to 45 days) if the dispute was taken up directly with the CRA. (This section does not apply to consumers being assisted by credit repair organizations) [Preemption Explicitly Applies— Section 623] • Clarifies liability and enforcement under FCRA for furnishers of information limiting civil liability (other then the reinvestigation provision) and makes the new provisions only subject to administrative enforcement. [Preemption Explicitly Applies—Section 623] • The FTC must compile all complaints that it receives and transmit the complaints to each CRA involved. Each CRA involved must review each such complaint to determine if all legal obligations were followed and provide reports back to the FTC on a regular basis. The FTC is to submit an annual report to the House and Senate Banking Committees on this issue. • Upon finding that information furnished is incomplete or inaccurate a CRA is required to promptly delete the item of information from the file of the consumer (or modify it as appropriate) and promptly notify the furnisher of that information that the information has been modified or deleted. • Upon finding that information furnished is inaccurate or incomplete a furnisher must modify or delete that item of information and permanently block the reporting of that item of information (to avoid re-pollution of the consumer’s credit report) [Preemption Explicitly Applies—Section 623] • CRAs are required to notify a requester of a consumer report of any discrepancy between the address for the consumer in the request and the addresses in the file of the consumer. Requires the Federal banking agencies to come up with regulations on what a user of a consumer report should do when they have received notice of a discrepancy. [Preemption Explicitly Applies—Section 605] • Resellers (such as intermediaries who consolidate reports for mortgage lenders) upon notice by a consumer of a dispute, are required to determine if the information is inaccurate as a result of an act or omission by the reseller and fix any error they caused within 20 business days or if not through their own error, forward all information received on a consumer dispute to each CRA involved. Requires reinvestigations to be free of charge and reasonable. Title IV—Limiting the Use and Sharing of Medical Information • With some limited exceptions (needing specific affirmative consent of the consumer), CRAs are prohibited from providing credit reports that contain medical information. Medical information shared among affiliates will no longer be exempted from the definition of a consumer report. With limited exceptions, creditors are not allowed to use medical information for credit granting purposes. Companies that receive medical information in a consumer report or through affiliate sharing are prohibited from further disclosing the information. • Requires the use of codes for medical information and restricts the dissemination of medical contact information. . [Preemption Explicitly Applies—Section 605 and 623] Title V—Financial Literacy and Education Improvement • Establishes the Financial Literacy and Education Commission that has 18 months to develop and implement a national strategy to promote financial literacy and education among all Americans. Title VI—Protecting Employee Misconduct Investigations • Reports by outside third parties hired to investigate employee misconduct are excluded from the definition of consumer reports, but if any adverse action is taken based on the communication, the employer has to disclose to the consumer a summary of the nature and substance of the communication. Title VII—Relation to State Laws The Fair Credit Reporting Act clearly states that except for the explicitly named provisions in the legislation, the FCRA is not intended to preempt state law except to the extent that state law is inconsistent with the provisions of the Act and then only to the extent of the inconsistency. In addition to extending the explicit preemptions contained in the 1996 amendments to the FCRA which were scheduled to expire at the end of this year, Congress added several new provisions to the list concerning the prevention or mitigation of identity theft. Congress used the terms “with respect to the conduct required by the specific provisions of” which is definitely subject to interpretation and may result in the courts making the ultimate decision on how far the preemption goes.
|
