Key Takeaways

  • The Fair Credit Reporting Act (FCRA) governs how consumer information is collected, used, and disclosed by credit reporting agencies.
  • Consumers have rights to access, dispute, and correct their credit information.
  • Employers must obtain written consent before accessing credit reports for employment purposes.
  • Furnishers of information (like banks and lenders) have obligations to report accurate data.
  • Users of credit reports must have a legally permissible purpose and follow specific adverse action procedures.
  • Violations of FCRA requirements can result in statutory, actual, and punitive damages.
  • State laws may provide additional protections beyond the FCRA.

FCRA Requirements

FCRA requirements are related to the Fair Credit Reporting Act (FCRA), which is the primary law regulating how consumer reporting agencies are able to use the personal information of consumers. The FCRA is a federal law first enacted in the 1970s. The current version of the FCRA was passed in 2003.

Who Must Comply with the FCRA?

The FCRA applies to three primary groups:

  1. Consumer Reporting Agencies (CRAs): These include credit bureaus like Experian, Equifax, and TransUnion. CRAs are responsible for collecting and disclosing consumer credit information.
  2. Furnishers of Information: Entities like banks, credit card companies, and landlords that supply data to CRAs must ensure accuracy and respond to disputes.
  3. Users of Consumer Reports: Employers, lenders, insurers, and landlords who use credit reports must have a legitimate purpose and comply with notice and consent requirements.

Failure to meet FCRA requirements can result in regulatory action and civil liability.

FCRA Summary Rights

Under the FCRA, consumer reporting agencies are required to provide consumers with the information in their own file upon request, and consumer reporting agencies are not allowed to share information with third parties unless there is a permissible purpose.

There are several permissible purposes outlined by the FCRA. These include:

  • Disclosure of information to help a lender qualify a consumer for a loan or other credit service
  • Disclosure to employers or potential employers
  • When disclosure is legally required

But a consumer reporting agency cannot give your personal information to a potential or current employer unless you first give consent.

Consumers have a right to access their credit report information for free once per year. Further disclosures cost less than $10. Consumers have a right under the FCRA to challenge information in their file that they believe is incorrect. Consumer reporting agencies are required to investigate claims that there is inaccurate information, and when information is proven to be inaccurate, agencies must correct the mistake. When fraud or identity theft has occurred, consumer reporting agencies must take steps to rectify the situation and ensure that information is accurate.

Consumer reporting agencies often provide consumer names and addresses to marketers. Under the FCRA, consumers can opt-out of this information sharing and have their names removed from these marketing lists. Consumers can opt-out by calling 1-888-5-OPT OUT.

FCRA Requirements for Employers

When using credit reports for employment purposes, employers must:

  • Obtain written authorization from the job applicant or employee.
  • Provide a clear and conspicuous disclosure that a credit report may be used.
  • Supply a pre-adverse action notice if the report might negatively impact the employment decision, including a copy of the report and a summary of rights.
  • Issue a final adverse action notice after taking the negative action.

These steps allow the individual to review and respond to the credit report before an employment decision is finalized.

Consumer Rights Under the FCRA

When information has been used against a consumer, such as being used as a basis to deny employment or loan acceptance, the consumer must be notified. The party using the information against the consumer must tell the consumer which agency gave them the information.

As mentioned, a consumer has a right to obtain all of the information in their own file. Consumers have a right to contest inaccurate information. Consumers also have a right to contest their credit score. When information is shown to be inaccurate, consumer reporting agencies generally only have 30 days to correct or delete the inaccuracies.

The FCRA provides basic consumer rights in the United States; however, each individual state also has certain consumer protection laws. In some of these states, such as in California, these laws expand upon the FCRA and provide significant additional protections.

Additional State Law Protections

While the FCRA provides baseline consumer protections, many states have enacted laws that expand on those rights. For example:

  • California requires additional disclosures and offers free credit freezes.
  • Vermont mandates express consent before prescreened offers.
  • New York limits the length of time certain information can remain on a credit report.

Consumers and businesses alike should be aware of both federal and state FCRA requirements when accessing or sharing credit-related data.

Enforcement and Penalties for Noncompliance

FCRA enforcement is handled by the Federal Trade Commission (FTC), Consumer Financial Protection Bureau (CFPB), and state attorneys general. Potential penalties include:

  • Statutory damages of $100 to $1,000 per violation
  • Actual damages for financial harm caused
  • Punitive damages for willful noncompliance
  • Attorney's fees and court costs for successful consumer lawsuits

Businesses and individuals should maintain policies and training programs to ensure FCRA compliance and reduce liability risks.

Permissible Purposes for Credit Report Access

Access to a consumer’s credit report is strictly regulated under the FCRA. Permissible purposes include:

  • Credit applications (e.g., loans, credit cards)
  • Employment (with written consent)
  • Insurance Underwriting
  • Tenant screening
  • Court orders or subpoenas
  • Review or collection of an existing account

Accessing a credit report without a permissible purpose is a violation of FCRA requirements and may lead to legal consequences.

Responsibilities of Information Furnishers

Businesses that furnish information to CRAs must comply with the following FCRA requirements:

  • Report only accurate and complete information.
  • Investigate disputes from consumers within 30 days and notify CRAs of any inaccuracies.
  • Update or correct any previously reported information found to be inaccurate or incomplete.
  • Not report accounts that have been discharged in bankruptcy as active debts.

These obligations help maintain the integrity of credit information used in lending, insurance, and employment decisions.

Frequently Asked Questions

  1. What does it mean to meet FCRA requirements?
    Meeting FCRA requirements means following federal rules for the collection, use, and disclosure of consumer credit information, including accurate reporting, permissible access, and consumer rights.
  2. Can employers run a credit check without notifying me?
    No. Employers must provide written notice and obtain your written consent before running a credit check.
  3. How can I dispute an error on my credit report?
    You can file a dispute with the credit bureau that issued the report. The agency must investigate and resolve the dispute, usually within 30 days.
  4. Who enforces FCRA compliance?
    The FTC, CFPB, and state attorneys general enforce the FCRA. Consumers can also file private lawsuits for violations.
  5. Are there any risks for businesses that don’t follow FCRA rules?
    Yes. Noncompliance can lead to civil lawsuits, fines, and reputational harm. Businesses should implement FCRA training and compliance systems.

If you need help with creating contract, you can post your legal need on UpCounsel’s marketplace. UpCounsel accepts only the top 5 percent of lawyers to its site. Lawyers on UpCounsel come from law schools such as Harvard Law and Yale Law and average 14 years of legal experience, including work with or on behalf of companies like Google, Menlo Ventures, and Airbnb