President Bush Signs Identity Theft Legislation
"The Fair and Accurate Credit Transactions Act"
Analysis and Discussion

The Fair and Accurate Credit Transactions Act was signed into law by President Bush December 4, 2003. The following is a discussion of the legislation as it came out of the Senate and House Conference Committee as it relates to consumer reporting agencies performing background screening under the FCRA. Much of the legislation deals strictly with credit transactions and procedures to be followed by the large credit bureaus such as Trans Union, Equifax, Experian, etc. These portions of the Act are discussed to put the impact in proper perspective.

Generally, the various provisions will become effective in six to twelve months although no specific dates are indicated. The FTC and other appropriate agencies are required to issue regulations in regard to the matters covered by the Act as well as a general study of the consumer reporting business. One can assume that further changes will be coming in about one year after the enactment.

InfoLink Screening Services, Inc. strongly recommends that client’s check the effective dates of various provisions and seek legal counsel before making procedural changes (especially regarding disclosure and adverse action relating to consumer reports) as several states have enacted their own laws relating to background screening.

Disclosure and Adverse Action when conducting Employee Investigations. Title VI amends §611 of the federal Fair Credit Reporting Act by adding subsection (x) after subsection (o). When the law takes effect, with some exceptions, an authorized written disclosure would no longer be required prior to conducting an investigation of an employee suspected for misconduct relating to employment; or to determine if they are in compliance with Federal, State, or local laws and regulations, the rules of a self-regulatory organization; or to determine if they violated any preexisting written policies of the employer. Note however that this change doesn’t alter the requirement that disclosure and authorization would still be required for the purpose of investigating a consumer’s credit worthiness, credit standing, or credit capacity. Finally, the consumer report may not be provided to any person except to the employer or the agent of the employer; any Federal or State officer, agency, or department, or any officer, agency, or department of a unit of general local government; to any self-regulatory organization with regulatory authority over the activities of the employer or employee; or as otherwise required by law; or pursuant to §608.

In addition, should such an employee investigation take place, the law would require a subsequent disclosure. Specifically, after taking any adverse action based in whole or in part on a consumer report from such employee investigation, the employer shall disclosure to the consumer a summary containing the nature and substance of the communication upon which the adverse action is based. Sources of the information acquired solely for use in preparing what would be but for §603(d)(2)(D) an investigative consumer report, need not be disclosed.

Title VI does not completely address issues raised by the Federal Trade Commission in the “Vail” letter sent to Judi A. Vail on April 5, 1999, when she inquired whether disclosure and authorization was required prior to a sexual harassment investigation by an outside organization who assist employers for a fee. Please review the summary from the U.S. Chamber of Commerce.

Finally, since Title VI itself does not contain an effective date, this will be determined by the Federal Trade Commission when they promulgate regulations, though not later than sixty days following the date of enactment, or February 3, 2004.

Identity Theft. This subject takes up a large part of the new legislation. These provisions will have little impact on the consumer reporting agency that performs background screening. The principal obligations of this portion of the Act fall upon the large national credit bureaus under §112(f). A reseller of their credit reports is required simply to keep the fraud alert, block, etc. in the report as they resell it under §112(g). .

If a consumer reporting agency is contacted by a consumer regarding identity theft, the obligation of consumer reporting agencies that perform background screening is limited to informing a consumer how to contact the FTC and providing the contact number for the big three credit bureaus who must maintain a joint number for reporting identity theft.

There are three types of identity theft alerts:

(1) Initial Alert. §112(a). A national consumer reporting agency, Experian, etc., if contacted by the consumer or his/her representative, and the consumer advises them that he/she has been or has a good faith suspicion that the consumer is about to be a victim of identity theft, that agency must place an alert in the consumer’s file. This type of alert lasts up to ninety (90) days. There are no proof requirements placed upon consumers to obtain this alert in their file.

(2) Extended Alert. §112(b). This alert can last up to seven (7) years. This type of alert requires the consumer provide an "identity theft report" as defined in §111(q)(4). This report by the consumer includes, at a minimum:

(a) a report that alleges an identity theft (note that suspected or potential theft is not covered in the extended alert);
(b) a copy of an official report of identity theft to local, state or federal law enforcement; and
(c) such filed report subjects to consumer to criminal penalties for a false report.

(3) Blocking. §152. This is an additional alert and actually causes the consumer reporting agency to block, i.e. not report, information from a particular furnisher. In addition to providing identity theft report, the consumer must provide his/her proper identifying information and a statement to the consumer reporting agency that this particular information does not relate to any transaction the consumer had with this source. The consumer reporting agency may decline to block any particular entry (this is the only discretionary reporting provision regarding identity theft) if the item is blocked in error, or the consumer provided a material misrepresentation to the agency, or the consumer has obtained money, goods or service as a result of the block. One must assume in this last category that the consumer has improperly used the blockage mechanism to obtain credit, goods or services not that they simply subsequently obtained such. Note that obtaining employment as a result of a block is not included as a disqualifying event. A reseller has limited obligations in regard to blocking. §152(d). If contacted by the consumer, it is to refer the consumer to the FTC to report identity theft. If the reseller keeps the file that it resells, it too will have the obligation to block reporting of information stored by it. Otherwise, as stated above, its obligation is to merely keep the alerts and blockages in place as it resells the report.

Another alert is also provided for in the Act, which is for Active Military Duty. There is no need for identity theft to have taken place or to be threatened in regard to these consumers. This is a provision to protect military personnel. It is evident that their occupations make it easier to be targeted for identity theft since they may be gone for an extended time and have limited ability to monitor their civilian affairs. This will alert a user that the consumer is on active duty and care should be taken in granting credit.

Truncation of Social Security Number. §115. This section allows a consumer to request that the first five (5) digits of his/her social security number to be deleted from any disclosure to the consumer. Since most employment reports contain social security numbers, these will be in the files of those agencies providing background screening. However, the number need only be truncated in disclosures sent to the consumer, not to the customer/user. Since most identity theft still occurs at the consumer’s mailbox, one must assume that Congress hopes to avoid identity theft at this point. InfoLink Screening Services, Inc. has already programmed it’s system to truncate the social security number in consumer reports for clients and consumers as California already has a similar provision on information going to the consumer.

Statute of limitations . §156. The statute of limitations has been extended from two years from the date of violation to two years from the date of the discovery of the violation by the consumer up to five years from the date of the actual violation. This change behooves each consumer reporting agency to keep records for at least six years. This will allow records to be maintained for the statutory period plus the normal delay time experienced in receiving notice of a lawsuit. As InfoLink Screening Services, Inc. maintains reports within its system indefinitely, this requirement won’t affect our business.

Free Consumer Report. §211. Originally, the legislation proposed a free report be given by the large national credit bureaus. However, a new term appears in §111(w), which is: "National Specialty Consumer Reporting Agency." This category of consumer reporting agency is the type of agency that compiles and maintains files on a nationwide basis relating to, among other things, employment histories. Thus, a specialty agency will also be required to provide free reports once every twelve months to the consumer. These agencies must also provide a toll-free telephone number for consumers to make request for their file. Since many background screening organizations fall within this definition of a specialty consumer reporting agency, new procedures will have to be set up for many agencies. InfoLink’s practice has always been to supply a copy of the report to the consumer at no charge when requested. The law does not define "nationwide basis," but this term seems to imply that if the consumer reporting agency maintains files from around the country on a regular basis, then it fits this definition. Further, it would be doubtful that an agency would need to keep files from all fifty/forty-eight states to qualify.

Reinvestigations. §211. This section also contains a reference to reinvestigations, which allow them to be extended in time up to forty-five (45) days if the reinvestigation is made after the consumer reporting agency furnishes a free report to the consumer. This provision applies to the large credit bureaus as well as specialty consumer reporting agencies.

Sharing of Information. §214. A new section has been added to the FCRA to prevent a customer who receives information from a consumer reporting agency from sharing that with any affiliated entity for marketing purposes unless that customer obtains permission from the consumer. InfoLink’s disclosure form contains a provision that allows the sharing of the consumer report where there is a "need to know".

Disposal of Consumer Information. §216. This new section is added requiring a study by the FTC on how users are to dispose of information they receive from consumer reporting agencies. Attention should be paid to any rule-making in this area to ensure that users are not required to dispose of information prior to or inconsistent with their legal obligations to maintain this information.

Disclosure of Adverse Information. §217. If a source furnishes adverse credit information to one of the three large national credit bureaus, then the furnisher must give notice to the consumer, within thirty (30) days, of reporting that negative information. Those companies merely performing background screening will be exempted from this requirement.

Duty to Furnish Accurate Information. §312. This provision states that the FTC shall study and provide regulations on the standards that a furnisher of information to a consumer reporting agency must follow to ensure accuracy. This will be a developing area. In subsection (c), a consumer may now dispute information directly with the furnisher of the information rather than going to the consumer reporting agency. In disputing information, the consumer must supply three things to the furnisher:

(a) identification of the item disputed;
(b) the consumer must explain the basis of the dispute; and
(c) the consumer must provide all supporting information requested by the furnisher to substantiate the dispute.

A furnisher of information need not investigate a dispute that has been previously reinvestigated by the consumer reporting agency to which the information was reported, and that the furnisher has previously verified that information during that reinvestigation. This will prevent harassment by a difficult consumer after being unhappy with their reinvestigation at the agency who then takes the dispute to the furnisher. Some education of furnishers will be needed to advise them of their duties. Again, this will be an ongoing process for the next year. Once this has settled out, these duties will be advisable to be included as part of the contract of service.

Resellers’ Role in Dispute Resolution. §316. If a consumer reporting agency is a reseller, its role in receiving a dispute of a resold report is first to determine within five (5) business days, if the error resulted in its handling of the report and correct it within twenty (20) days with notice to the consumer. However, if the error is within the resold report itself, then the reseller’s obligation (no specific time limit stated) is to notify the consumer reporting agency that originated the report, of the consumer dispute. However, that consumer reporting agency, which originated the report, will not communicate the results of the investigation directly with the consumer, but back through the reseller, who must "immediately" notify the consumer of the results of the reinvestigation. Thus, the consumer is not handed off to the original seller of the consumer report, but the point of contact remains with the reseller if that is whom the consumer contacted. This is contrary to the typical arrangement between the major credit bureaus and resellers. This suggests that a letter explaining procedures regarding his/her dispute will be necessary for the reseller to send to the consumer in order to avoid misunderstandings.

Preemption of State Law. §711. The legislation generally preempts any state law regarding the contents of a consumer report enacted after September 30, 1996, the "Window" closing in 2004 no longer exists. The preemption will continue. Since most state statutes existing prior to September 30, 1996, contain low dollar amounts, current consumer reports are relatively unaffected by these older laws. Section 711 has several provisions incorporating many new portions of the Act and how they will preempt or interact with state law.

This analysis is provided as a service by InfoLink Screening Services, Inc. with information provided by Larry Henry of Boone, Smith, Davis, Hurst and Dickman based in Tulsa, OK. It is not intended to provide legal advice. Employers should check with legal counsel prior to making any changes in policies and procedures. Please also review the actual text of The Fair and Accurate Credit Transactions Act along with the U.S. Chamber of Commerce Report "Congress Fixes The Vail Letter: The Good, Bad and the Ugly."