Skip to main content

Search

Fair Credit Reporting: 9.2.2.2 Initial Fraud Alerts

With respect to the first type of alert, the FCRA allows consumers who believe that they are or might be victimized by identity theft fraud or any other sort of fraud to require all nationwide CRAs to add a fraud alert to their files simply by calling one such CRA.56 Note that the FCRA provides consumers may seek an initial fraud alert merely upon a “good faith suspicion” that they are about to be victimized by identity theft or other fraud;57 consumers do not need to know definitively that they act

Fair Credit Reporting: 13.4.3.4 Claims Against Users for Impermissible Purpose Under § 1681b

The CFPB took action against a mortgage lender that misused its access to consumer credit reports to unlawfully obtain reports in order to market student loan debt-relief services.183 It also took action against another mortgage servicer and lender who ordered consumer reports to market to existing customers without making a firm offer of credit, which is not a permissible purpose under the FCRA.184

Fair Credit Reporting: 13.4.3.5 Claims Against Users for Failing to Send Adverse Action Notices Under § 1681m

The CFPB has brought actions against users of consumer reports for failing to provide adverse action notices or otherwise comply with section 1681m.191 In one instance, the CFPB alleged that, as a matter of company policy, 1st Alliance denied credit to thousands of consumers based on information in a consumer report or in response to an application, but did not give the consumers an adverse action notice as required under FCRA and ECOA.192 In another case, the CFPB found that between October 201

Fair Credit Reporting: 13.7.3 State Enforcement Powers Against Information Furnishers Are Limited

As mentioned earlier,246 private citizens may not sue furnishers of information for damages resulting from a failure to provide accurate or complete information to CRAs as required by the Act.247 Instead, only public officials or federal or state agencies are permitted to enforce these and other furnisher requirements.248 State officials have authority to seek damages on behalf of state residents for violations of paragraphs (1) through (3) of sect

Fair Credit Reporting: 13.7.5 State Investigatory Powers

Nothing in the FCRA’s provision on state enforcement shall prevent the chief law enforcement officer of a state from exercising the powers to conduct investigations or to administer oaths or affirmations or to compel the attendance of witnesses or the production of documentary and other evidence in connection with any FCRA enforcement action brought by the state.260

Fair Credit Reporting: 13.7.6 Examples of State Enforcement Actions

States have worked together to obtain significant reforms in credit reporting practices on a few occasions. In the early 1990s, following widespread dissatisfaction with the accuracy of information in credit reports and apparent systematic FCRA compliance difficulties, several state attorneys general brought enforcement actions against Equifax, TRW Inc.

Fair Credit Reporting: 18.3.4 Tort of Intrusion

Like the tort of public disclosure of private facts, the tort of intrusion can also apply to the discovery of financial information.62 The tort, also sometimes called “intrusion into seclusion” or “unreasonable intrusion,” creates liability for the intentional intrusion upon another person’s solitude, seclusion, or private affairs in a manner that would be highly offensive to a reasonable person.63 Generally, the intrusion need not be physical; this tort can lead to liability for the unauthorized pr

Fair Credit Reporting: 18.4.1.1 Generally

Title V of the Gramm-Leach-Bliley Act (the GLBA)89 addresses financial institutions’ use of consumers’ “nonpublic personal information.”90 That term is defined to mean any personally identifiable financial information that is provided by the consumer to the financial institution;91 results from any transaction with the consumer or service performed for the consumer; or is otherwise obtained by the financial institution, but which is not “publicly availab

Fair Credit Reporting: 18.4.1.2 Implementation and Enforcement of the Gramm-Leach-Bliley Act: Changes from the Dodd-Frank Act

Prior to the Dodd-Frank Act amendments, the FTC and banking regulators had all issued GLBA regulations that were substantially similar to one another.95 The FTC’s authority to issue the regulations survived a challenge brought by TransUnion, one of the three major CRAs.96 As for agency enforcement actions, the FTC has publicly taken enforcement action under the GLBA,97 and the FRB has taken “formal” enforcement action.

Fair Credit Reporting: 18.4.1.3 “Financial Institutions”—Entities That Must Comply with the Gramm-Leach-Bliley Act

The GLBA applies to “financial institutions.” Whether an entity is a “financial institution” is determined by whether it engages in “financial activities” as that term is defined by the Bank Company Holding Act of 1956.112 That Act describes five different categories of financial activities that cover lending, insuring, financial advising, issuing or selling asset pool instruments, and underwriting securities.113 Under Regulation P, a more restricted definition applies to those entities subject

Fair Credit Reporting: 18.4.1.4 “Customers” and “Consumers”—Those Protected by the Gramm-Leach-Bliley Act

The GLBA protects both “customers” and “consumers.” All customers are consumers, but not all consumers are customers. Customers and consumers are equally protected by the opt-out and nondisclosure provisions of the GLBA and Regulation P.119 The difference is only relevant to whether the institution must provide an initial privacy notice and annual privacy notices to the individual, and turns on the individual’s particular relationship with the financial institution.

Fair Credit Reporting: 18.4.1.5 “Nonpublic Personal Information”—Information Covered by the Gramm-Leach-Bliley Act

The GLBA does not prevent financial institutions from revealing any information that they get from consumers; the only information restricted by the Act is “nonpublic personal information.” Nonpublic personal information is deemed to be personally identifiable financial information that is not publicly available.126 The Act does not define “personally identifiable financial information”; nonetheless, the FTC’s authority to define the term, and to define the term broadly, has been upheld.127 Pres

Fair Credit Reporting: 18.4.1.6.2 Disclosures to affiliates

Though not expressly labeled as an exception, a key feature of the GLBA is that disclosures to an institution’s own affiliate are completely unrestricted by the Act and Regulation P.141 An affiliate is “any company that controls, is controlled by, or is under common control with another company.”142 Thus, private consumer information may flow freely throughout a company’s extended family.

Fair Credit Reporting: 18.4.1.9 Limits on Sharing Account Number Information for Marketing Purposes

The only category of information that the GLBA protects from disclosure outright, without any action on the consumer’s part, is the highly potent information of account numbers and similar forms of access codes. Financial institutions are prohibited from disclosing these numbers or codes to any nonaffiliated third party for marketing use other than to a consumer reporting agency, even if the financial institution has given the consumer a conforming opt-out notice.218

Fair Credit Reporting: 18.4.1.10 The Gramm-Leach-Bliley Act’s Data Safeguard Requirements

The GLBA requires agencies subject to the Act to establish standards “relating to administrative, technical, and physical safeguards” to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to those records, and protect against unauthorized access to those records.224 The banking regulators have issued Interagency Guidelines Establishing Information Security Standards.225

Fair Credit Reporting: 18.4.1.11 Impact on Fair Credit Reporting Act

The GLBA specifically provides that it does not “modify, limit, or supersede the operation of the Fair Credit Reporting Act.”230 The CFPB has issued regulations that recognize that financial institutions will design information-sharing policies to simultaneously comply with the GLBA and the FCRA.231 As is discussed above,232 the GLBA specifically exempts disclosures made to a CRA in accordance with the FCRA, and from a consumer report issued by a C

Fair Credit Reporting: 18.4.1.13 Limited Preemption of State Law

The GLBA expressly preserves the right of states to protect the privacy of consumers’ financial information. The Act provides that it supersedes state laws only to the extent that such laws are inconsistent with the Act,242 and specifically grants states permission to enact greater protections.243

Fair Credit Reporting: 18.4.1.14 Weaknesses of the Gramm-Leach-Bliley Act

While any privacy protection is welcome, the GLBA blocks only a very few of the many channels through which financial institutions distribute consumers’ financial information. This becomes apparent if the focus shifts from what the GLBA prohibits to what it permits. A financial institution can always disclose any consumer financial information to any of its affiliates.