The FCRA: It’s Not Just For Credit Bureaus

1. The FCRA:It’s Not Just For Credit Bureaus Privacy Academy 2008 Orlando, Florida

2. Rebecca E. KUEHNAssistant DirectorFederal Trade Commission

3. Jennifer R. Rossiconsumer financial services LitigatorRobinson & Cole LLP

4. Overview Regardless of how you describe your business, it’s likely you use and access consumer reports. The FCRA and FACT Act cover a wide range of activities related to accessing, collecting and using consumer information. We will discuss what business practices are regulated by these statutes and recent FTC rules concerning identity theft. The overall goal of this presentation is heightened appreciation for the effects of noncompliance. We will end with a question andanswer session.

5. Disclaimer • The remarks in this presentation do not necessarily reflect the views of the Federal Trade Commission or of any Commissioner, nor are they intended to be legal advice. • Anyone with specific questions about a matter should consult legal counsel.

6. Broad Scope of FCRA An adventure in definitions

7. Federal Trade Commission • Nation’s only general jurisdiction consumer protection agency • Enforcement through federal district court and administrative litigation

8. The FCRA • Passed in 1970; significant amendments in 1996 and 2003 • “[T]o insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy”

9. FCRA Guiding Principles • Privacy • Limited access to consumer reports • Same limits on government access, withcertain exceptions • Accuracy • Responsibilities of consumer reporting agenciesand information furnishers • Consumer dispute process • Fairness • Adverse action notices • Obsolete information deleted

10. Who Is Covered by FCRA • Consumer Reporting Agencies • Furnishers – information sources • Users of consumer reports • And more (merchants using debit/credit cards; “financial institutions” and “creditors”)

11. FCRA Enforcement • Civil enforcement by many agencies: • FTC and federal banking agencies • State attorneys general • Consumers: private right of action in some cases • Criminal enforcement: federal or state prosecutors (e.g., information obtained under false pretenses, unauthorized disclosure by credit bureau employees)

12. Consumer Report Defined • “any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for -- (A) credit or insurance to be used primarily for personal, family, or household purposes; (B) employment purposes; or (C) any other purpose authorized under section 604.”

13. Definition Dissected • Two basic elements: • Information in report has a “bearing on” one or more specified consumer characteristics (e.g., credit standing) • Report is “used or expected to be used (by the user) ... for the purpose of ... establishing the consumer’s eligibility (for purposes allowed bythe FCRA)...”

14. Some Important Points • Has to be about a consumer – if doesn’t identify specific consumer, not a consumer report • Ex. Flagging a specific internet transaction as potentially fraudulent based on comparison to aggregate data about internet transactions (e.g., time-of-day activity, geographic location, amount of the transaction, etc.), without reference to an individual consumer, is not a consumer report

15. Includes Summaries and Evaluations of Reports • Includes numerical or other evaluation of file data by a CRA, such as a credit score that bears on a consumer’s creditworthiness • Includes a list of the names of people meeting certain characteristics – such as a list of creditworthy individuals, or individuals on whom CRAs have derogatory information

16. Examples of Consumer Reports • Credit report • Rental history • Check writing history/“bad check” lists • Employment history • Medical history • Insurance claims history

17. Consumer Reporting Agency Defined • “any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports”

18. Mutually Dependent Definitions • Consumer report = report provided by consumer reporting agency • Consumer reporting agency = an entity that provides consumer reports

19. Some Important Points • Entities that work together for a common purpose without monetary compensation may form a CRA • Exchange or data pool • Entities that repackage and/or resell consumer report information may be CRAs

20. The non-traditional cra Evolution of the information industry: A case study

21. Case Study • In the Matter of Ingenix, Inc. • In the Matter of Milliman, Inc. • Consent Decisions and Orders issued February 12, 2008

22. Where Industry Was • Life insurance companies used service providers to get medical records • Service providers requested records from health care providers, put in envelope, and mailed to insurer

23. Record Retrieval Companies Are Not CRAs • An entity that performs only mechanical tasks in connection with transmitting consumer information is not a CRA because it does not assemble or evaluate information. A business that delivers records, without knowing their content or retaining any information from them, is not acting as a CRA even if the recipient uses the records to evaluate the consumer’s eligibility for insurance or another permissible purpose.

24. Ingenix and Milliman • Provide reports on prescription drugpurchase histories of insurance policy applicants, to insurance companies for underwriting decisions • Obtain prescription drug histories from Pharmacy Benefit Managers and create prescription medical profiles

25. Why CRA – “Assemble” or “Evaluate” • “Assembled” -- Compiled informationinto single report • “Evaluated” -- Analyzed information toreport potential medical conditions thatmay be present

26. Administrative Enforcement Action • Complaints charged Ingenix and Milliman with violating FCRA by failing to provide Notice to Users • Notice to Users describes FCRA responsibilities and obligations of recipients of reports, including notifying consumers if adverse action is taken, based in whole or in part, on information contained in the consumer report

27. Consent Order • 5 year record keeping obligation • 20 year injunction to comply with CRA duties: • Notice to Users • Only furnish reports to those with permissible purpose • Reasonable procedures to assure maximum possible accuracy of information • Reasonable procedures to handle consumer disputes • Conduct reasonable reinvestigations • Comply with the Disposal Rule

28. Background screening reports Special Reports: Special Rules

29. Background Reports Are Consumer Reports • The definition of a “consumer report” includes more than just consumer credit information • Criminal background checks, educational background checks, and license checks are consumer reports because involve the individual consumer's “character, general reputation, personal characteristics, or mode of living”

30. Background Screening Companies Are CRAs • Company that provides oral/written reports to employers about the prior work experience of applicants • Company that regularly researches criminal records of job applicants and reports them to its clients

31. Special Rules in Employment • Written notice and authorization before getting report • Pre-adverse action disclosure – copy of report and Summary of Rights • Adverse Action Notice • Using Consumer Reports: What Employers Need to Know

32. Red-flag rules What they are and what they’re not.

33. What They Are • “Red Flag” means: • a pattern, practice, or specific activity that indicates the possible existence of identity theft

34. “Red Flag Guidelines and Rules” • Where do they come from? • Fair and Accurate Credit Transactions (“FACT”)Act of 2003 • Amended FCRA • Passed in response to concerns about misuse of personal information of consumers, including identity theft • Instructed FTC and agencies to establish guidelines and rules

35. Red Flag Guidelines • 15 U.S.C. § 1681m(e)(1)(A): “The federal banking agencies, the National Credit Union Administration, and the [Federal Trade] Commission shall jointly . . . • establish and maintain guidelines . . . regarding identity theft with respect to account holders at, or customers of, such entities, and update such guidelines as often as necessary . . . .”

36. Joint Rulemaking • Final rules published November 9, 2007. (Press Release) • Effective on January 1, 2008 • Full compliance required by November 1, 2008

37. Identity Theft Prevention Programs • The rules require “financial institutions” and “creditors” with “covered accounts” to implement a written Identity Theft Prevention Program to detect, prevent, and mitigate identity theft in connection with: • The opening of a covered account or • The existence of a covered account

38. “Creditors” with “Covered Accounts” • “Anyone who arranges for the extension, renewal or continuation of credit or any assignee of an original creditor who participates in the decision to extend, renew or continue credit.”

39. “Creditors” with “Covered Accounts” • A consumer account that “involves or is designed to permit multiple payments or transactions, such as a credit card account, mortgage loan, automobile loan, margin account, cell phone account, utility account, checking account, or savings account and • “Any other account that the financial institutionor creditor offers or maintains for which there isa reasonably foreseeable risk to customers or tothe safety and soundness of the financialinstitution or creditor from identity theft, including financial, operational, compliance, reputation, or litigation risks.”

40. The Guidelines • Intended to assist financial institutions and creditors in the formulation and maintenance of a Program that satisfies the requirements of the Red Flag Rules • Topics include • The Identity Theft Program • Identifying Relevant Red Flags • Detecting Red Flags • Preventing and Mitigating Identity Theft • Updating the Program • Methods for Administering the Program • Other Applicable Legal Requirements

41. Guideline Highlights • Identifying Red Flags • Categories of Red Flags • Alerts, notifications, or other warnings from consumer reporting agencies or service providers, such as fraud detection services • The presentation of suspicious documents • The presentation of suspicious personal identifying information, such as a suspicious address change • The unusual use of, or other suspicious activity related to, a covered account • Notice from customers, victims of identity theft, law enforcement or others regarding possible identity theft • Appendix to Rule has 26 examples for the foregoing categories.

42. Guideline Highlights (cont’d) • Procedures to detect Red Flags • Verify identity • Authenticate customers • Monitor transactions • Verify validity of address changes

43. Guideline Highlights (cont’d) • Appropriate Responses to Red Flags • Monitor accounts • Contact customer • Change passwords • Close and reopen account • Refuse to open account • Do not collect on or sell account • Notify law enforcement • No response

44. Guideline Highlights (cont’d) • Administering the Program • Oversight involves • Assigning specific responsibility • Reviewing reports • Approving material changes to Program

45. What They’re Not • Red Flags compliance v. data security • Definition of “financial institution” is not same under Red Flags and Gramm Leach Bliley Act • Compliance with HIPAA does not equal compliance with Red Flags

46. FTC Activity • June 2008 “FTC Business Alert” • FTC set-up email for questions: RedFlags@ftc.gov

47. Identity theft prevention Are you a financial institution or creditor?

48. Mandatory Compliance • By November 1, 2008 for: • “Financial Institutions” • “Creditors” that hold any consumer account or other account for which there is a reasonably foreseeable risk of identity theft

49. Are you a “Financial Institution”? • A “financial institution” is: • A State or National bank • A State or Federal savings and loan association • A mutual savings bank • A State or Federal credit union • “Any other person that, directly or indirectly, holds a transaction account belonging to a consumer” 15 U.S.C. § 1681a(t) (emphasis added)

50. Transaction Account • “The term ‘transaction account’ means a deposit or account on which the depositor or account holder is permitted to make withdrawals by negotiable or transferable instrument, payment orders of withdrawal, telephone transfers, or other similar items for the purpose of making payments or transfers to third persons or others. Such term includes demand deposits, negotiable order of withdrawal accounts, savings deposits subject to automatic transfers, and share draft accounts.” 12 USCS § 461(b)(1)(C) (also known as section 19(b) of the Federal Reserve Act)