FCRA: Congress Should Allow Preemption to Expire
Chris Hoofnagle
Deputy Counsel, Electronic Privacy Information Center
Submitted to the ABA US Banking 2003 Conference
March 2003

Introduction

The Fair Credit Reporting Act (FCRA) contains a loophole that immunizes credit bureaus,
furnishers of credit information, and users of credit reports from stronger state laws designed to
protect consumers. This loophole will expire on January 1, 2004. After that date, states can
enact laws in a number of FCRA areas to enhance privacy and the accuracy and fairness of credit
reporting. This paper gives an overview of the FCRA, the provisions that preempt state laws,
and suggestions for improving the effectiveness of the Act.

A Brief History of the FCRA

The FCRA, Public Law No. 91-508, was enacted in 1970 to promote accuracy, fairness, and the
privacy of personal information assembled by Credit Reporting Agencies (CRAs).[1] CRAs
assemble reports on individuals for businesses, including credit card companies, banks,
employers, landlords, and others. The FCRA provides important protections for credit reports,
consumer investigatory reports, and employment background checks.

The FCRA establishes rights and responsibilities for "consumers," "furnishers," and "users" of
credit reports. Consumers are individuals. Furnishers are entities that send information to CRAs
regarding creditworthiness in the normal course of business. Users of credit reports are entities
that request a report to evaluate a consumer for some purpose.

The FCRA is a complex statute that has been significantly altered since 1970 by Congress and
the courts. The Act's primary protection requires that CRAs follow "reasonable procedures" to
protect the confidentiality, accuracy, and relevance of credit information. To do so, the FCRA
establishes a framework of Fair Information Practices for personal information that include rights
of data quality (right to access and correct), data security, use limitations, requirements for data
destruction, notice, user participation (consent), and accountability.

The FCRA was passed to address a growing credit reporting industry in the United States that
compiled "consumer credit reports" and "investigative consumer reports" on individuals. The
FCRA was the first federal law to regulate the use of personal information by private businesses.

The first major credit reporting agency, Retail Credit Co, was started in 1899.[2] Over the years,
Retail Credit purchased smaller CRAs and expanded its business into selling reports to insurers
and employers. By the 1960s, significant controversy surrounded the CRAs because their
reports were sometimes used to deny services and opportunities, and individuals had no right to
see what was in their file.[3]

By the late 1960s, there was abuse in the industry, including requirements that investigators fill
quotas of negative information on data subjects. To do this, some investigators fabricated
negative information, others included incomplete information. Additionally, the investigators
were collecting "lifestyle" information on data subjects, including their sexual orientation,
marital situation, drinking habits, and cleanliness. The CRAs were maintaining outdated
information, and in some cases, providing the file to law enforcement and to unauthorized
persons. Public exposure of the industry resulted in Congressional inquiry and federal regulation
of CRAs.[4]

Years of legislative leadership by Representative Leonor Sullivan and Senator William Proxmire
resulted in the passage of the FCRA in 1970. After its passage, Senator Proxmire attempted to
broaden the FCRA's protections over the next ten years. Shortly the FCRA took effect on April
25, 1971, CRAs were pursued for violations of numerous provisions of the Act. Most recently, in
January 2000, the three CRAs paid $2.5 million in a case settlement brought by the FTC.

The most comprehensive amendments to the FCRA were contained in the Consumer Credit
Reporting Reform Act of 1996 (P.L. 104-208). The Amendments contained a number of
improvements to the FCRA, but it also included provisions that allow affiliate sharing of credit
reports, "prescreening" of credit reports (unsolicited offers of credit made to certain consumers),
and limited preemption of stronger state laws on credit.

The FCRA Contains an Industry Loophole—Limited Preemption That Immunizes Credit
Bureaus, furnishers, and users of credit reports from Stronger State Consumer Protection
Laws

The FCRA, like many other privacy statutes, provides a federal baseline of protections for
individuals. The FCRA is only partially preemptive, meaning that except in a few narrow
circumstances, state legislatures may pass laws to supplement the protections made by the
FCRA.[5] For instance, some states have passed laws requiring the CRAs to provide reduced cost,
or free credit reports.

In a number of important areas state legislation is preempted until January 1, 2004. After that
date, states may enact stronger laws on prescreening (what constitutes a "firm offer" of credit,
rules for opting out of receiving prescreened offers of credit), compliance duties (time in which a
CRA must respond to reports of inaccuracies), user duties (notice and other requirements when a
credit report is used for an adverse action), content of reports (length of time negative
information can appear on the report), the duties of furnishers (accuracy of information provided,
correction duties, notice of closed or disputed accounts), affiliate sharing, and the disclosures that
CRAs must make to consumers.

In 1996, when the most recent amendments to the FCRA passed, certain state laws were grand
fathered in, and not preempted by the federal law. Stricter laws exist on affiliate sharing
(Vermont) and on duties of furnishers (California and Massachusetts).

The Public Interest Would Best Served By Allowing This Loophole to Expire

Congress should not extend the preemption loophole into the future. Consumers will lose
important opportunities if preemption is extended—a continued federal ceiling will prevent
states from creating additional needed protections. In our system of government, preemption
should only be used in limited situations, and generally, preemption is not appropriate for
consumer protection legislation.

Preemption limits states in their traditional roles as "laboratories of Democracy." Justice
Brandeis once noted that, "It is one of the happy incidents of the federal system that a single
courageous State may, if its citizens choose, serve as a laboratory; and try novel social and
economic experiments without risk to the rest of the country."[6]

Most privacy legislation allows states to create stronger protections. In the areas of medical
privacy, wiretapping, cable records, video rental records, telemarketing, financial records, and
driver's records, states can create protections that exceed federal laws.

Related areas of law allow states to formulate stronger protections. In areas such as freedom of
information, civil rights law, environmental regulation, states generally have the power to craft
protections for their residents. Consumer protection, in general, is a state activity. Congress,
despite giving the Federal Trade Commission (FTC) a consumer protection role, encourages
states to create "mini-FTCs." As a result, all 50 states have consumer protection law on
deceptive practices.

State consumer protection laws are more consumer friendly. State laws are more accessible to
consumer litigants, and often offer longer statutes of limitations. State laws typically afford
individuals private rights of action, rather than remedies that require the action of a federal
agency. They also enable aggressive attorney general action.

State legislatures are also better suited to tailor laws to communities. State legislatures are closer
to their constituents, and are more likely to tailor a law to particular problems.

Additional Protections Are Necessary for Consumer Protection

Consumers are harmed by systemic deficiencies in the credit reporting system. This includes the
increase in identity theft from prescreened offers of credit and unauthorized access to reports,
problems with inadequate reinvestigation, the rise of the use of credit scores for both credit and
other purposes, duplicate entries, and general inaccuracies. In order to address these deficiencies
and to promote greater privacy, accuracy, and fairness in the credit reporting system, the
following changes should be made to the FCRA.

• Consumers should receive notice whenever negative information is furnished to the CRA.
  This will put consumers in a better position to challenge inaccurate information before
  applying for credit. It will also give consumers the opportunity to detect fraud before
  more extensive damage is done to their credit history.
• Consumers should have the right to receive a free credit report from each of the CRAs
  once a year. Currently, five states extend a right to a free annual report. One state,
  Georgia, allows residents to obtain a report twice a year.
• When an adverse action is taken based on information within a credit report, the
  consumer should automatically receive a copy of the credit report. Currently, the
  consumer will only receive notice of the adverse action and a contact address for the
  agency. It would be minimally burdensome for the user of the credit report to provide the
  actual report rather than the notice.
• As a basic fraud protection, consumers should receive notice whenever there is a change
  of an address or when inquiries are made based on an address that does not match the
  report.
• Consumers, at no cost, should have access to their credit score and to the underlying
  algorithm used to generate the score. Newly developed credit monitoring services should
  be provided at no charge to individuals. Credit scoring is becoming more heavily relied
  upon, and the practices surrounding its development and use violate the spirit of the
  FCRA.
• Congress should require CRAs to detail the purposes for which users obtain reports.
• There should be parity in obtaining access to a report: that is, businesses should have to
  provide the same amount and quality of information as consumers have to in order to
  obtain a report. Currently, in seeking a report, consumers must submit more personal
  information than businesses.
• Congress should eliminate the distinction between the "credit header" and the actual
  credit report. In effect, Congress should move the credit header "below the line," so that it
  can only be used for permissible purposes under the FCRA. Legislation was introduced
  in the 107th Congress to move the header below the line.
• There should be an opt-in standard for prescreening. Currently, consumers have to opt-
  out of this information exploitation. Prescreened offers of credit are one of the primary
  vehicles for identity theft. Consumers should not have to bear the burden of ending these
  solicitations.
• There should be an opt-in standard for affiliate use of credit reports. Currently, there is
  only weak notice and opt-out choice protections.
• Consumers should have access to their entire file, including the names of sources of
  negative information.
• Criminal conviction information should be purged from the report after a certain number
  of years.
• The Congress should limit the contexts in which a report can be obtained for employment
  purposes. These should be limited to jobs where employees handle large sums of money,
  or are genuinely security-sensitive.

1. 15 U.S.C. § 1681, available at http://www.ftc.gov/os/statutes/fcra.htm.
2. Alan F. Westin, PRIVACY AND FREEDOM (Athenum 1967). "...the largest
   American private investigative agency,
   the Retail Credit Company, which rates persons for a wide variety of
   purposes including industrial security, has
   7,000 investigators, maintains dossiers on forty-two million people, and
   grosses more than $100 million annually
   from its activities."
3. Robert Ellis Smith, BEN FRANKLIN'S WEB SITE, PRIVACY AND CURIOSITY FROM
   PLYMOUTH ROCK TO THE INTERNET (Privacy Journal, 2000).
4. Id.
5. 15 U.S.C. § 1681t.
6. New State Ice Co. v. Liebmann, 285 U.S. 262, 311 (Brandeis, J., Dissenting).