WikiLeaks Document Release http://wikileaks.org/wiki/CRS-RS21449 February 2, 2009 Congressional Research Service Report RS21449 Fair Credit Reporting Act: Preemption of State Law Angie A. Welborn, American Law Division Updated December 8, 2003 Abstract. Generally, the Fair Credit Reporting Act (FCRA) only preempts state laws that are inconsistent with the federal law. However, there are a number of specific provisions of the Fair Credit Reporting Act under which states may not enact laws that impose additional requirements or prohibitions. The original preemption provisions were set to expire at the end of 2003. After January 1, 2004, states would have been able to enact laws relating to the areas currently addressed only under federal law. However, the recently enacted Fair and Accurate Credit Transactions Act of 2003 (P.L. 108-159) makes permanent the current expiring preemptions and preempts certain state laws related to identity theft. This report provides an overview of the Fair Credit Reporting Acts original preemption provisions and discusses recently enacted legislation (P.L. 108-159) making those preemptions permanent and creating new preemptions. Order Code RS21449 Updated December 8, 2003 Fair Credit Reporting Act: Preemption of State Law Margaret Mikyung Lee Legislative Attorney American Law Division Summary Generally, the Fair Credit Reporting Act (FCRA) only preempts state laws that are http://wikileaks.org/wiki/CRS-RS21449 inconsistent with the federal law. However, there are a number of specific provisions of the Fair Credit Reporting Act under which states may not enact laws that impose additional requirements or prohibitions. The original preemption provisions were set to expire at the end of 2003. After January 1, 2004, states would have been able to enact laws relating to the areas currently addressed only under federal law. However, the recently enacted Fair and Accurate Credit Transactions Act of 2003 (P.L. 108-159) makes permanent the current expiring preemptions and preempts certain state laws related to identity theft. This report provides an overview of the Fair Credit Reporting Act's original preemption provisions and discusses recently enacted legislation (P.L. 108-159) making those preemptions permanent and creating new preemptions. This report (originally written by Angie A. Welborn, Legislative Attorney) will not be updated. Preemption Provisions Generally, the FCRA "does not annul, alter, affect, or exempt any person subject to the provisions of [the Act] from complying with the laws of any State with respect to the collection, distribution, or use of any information on consumers, except to the extent that those laws are inconsistent with any provision of [the Act], and then only to the extent of the inconsistency."1 Despite the general nonpreemption of similar laws, the original Act set forth a number of specific provisions under which states are prohibited from enacting similar laws. The Act's original preemption provisions, which were made permanent by P.L. 108-159, are discussed below. 1 15 U.S.C. 1681t(a). CRS-2 Under the original preemptions, states are prohibited from enacting laws related to certain provisions of the Fair Credit Reporting Act regarding the prescreening of consumer reports.2 The FCRA provides that a credit report may be furnished through a prescreening process so long as the consumer has authorized the reporting agency to provide such a report, and has not elected to be excluded from lists provided to creditor or insurers through the prescreening process.3 The FCRA also places limitations on the type of information that can be released through the prescreening process and establishes procedures that consumer reporting agencies must follow with respect to excluding consumers from prescreening lists upon request. States are not allowed to impose additional requirements or prohibitions with respect to these procedures. States are also prohibited from imposing requirements regarding the time by which a consumer reporting agency must take action with respect to the procedures required in cases of the disputed accuracy of any information in a consumer's report.4 Under the FCRA, a consumer reporting agency must reinvestigate and update or delete the information in a consumer's file within 30 days of receiving notice of the dispute from the consumer.5 The reinvestigation period may be extended for up to 15 additional days if the consumer reporting agency receives additional information from the consumer http://wikileaks.org/wiki/CRS-RS21449 during the initial 30-day period.6 Consumer reporting agencies are also required to notify the furnisher of the disputed information of the dispute within 5 days of receiving notice of the dispute from the consumer.7 Federal law also preempts any state requirements with respect to certain duties imposed on persons who take any adverse action with respect to a consumer based upon information in the consumer's credit report.8 The FCRA requires persons who take adverse action with respect to a consumer to provide the consumer with notice of the action and information about the consumer reporting agency that furnished the report upon which the adverse action was based, as well as information about the consumer's right to obtain a free copy of his or her credit report and to dispute the accuracy of the information contained in his or her report.9 The Act places additional requirements on 2 15 U.S.C. 1681t(b)(1)(A). Prescreening is the process "whereby a consumer reporting agency compiles or edits a list of consumers who meet specific criteria and provides this list to the client or third party on behalf of the client for use in soliciting these consumers for the client's products or services." This process is permissible under the Fair Credit Reporting Act if the client agrees in advance that each consumer on the list will receive an offer of credit. CCH Consumer Credit Guide, ¶ 25,050. 3 15 U.S.C. 1681b(c) and (e). 4 The preemption of these provisions in state law does not apply to any state law in effect on the date of enactment of the Consumer Credit Reporting Reform Act of 1996. 15 U.S.C. 1681t(b)(1)(B). 5 15 U.S.C. 1681i(a)(1)(A). 6 15 U.S.C. 1681i(a)(1)(B). 7 15 U.S.C. 1681i(a)(2)(A). 8 15 U.S.C. 1681t(b)(1)(C) 9 15 U.S.C. 1681m(a). CRS-3 persons who take adverse action based upon information obtained from third parties or affiliates.10 Provisions of the Fair Credit Reporting Act regarding the duties of persons who use a consumer report in connection with a credit or insurance transaction that is not initiated by the consumer also preempt state law.11 Under the FCRA, persons who use reports in connection with a transaction not initiated by the consumer must provide the consumer with certain information, including a statement that information from the consumer's credit report was used in connection with the transaction, and that the consumer received the offer of credit or insurance because he or she satisfied the institution's specified criteria for creditworthiness or insurability.12 The statement must also include a notice that the consumer may not be extended credit pursuant to the offer if, after responding, the consumer fails to meet the criteria specified. The consumer must also be notified of his or her right to prohibit the release of credit information in connection with transactions not initiated by the consumer. The Fair Credit Reporting Act sets forth specific requirements regarding information to be included in a consumer's credit report, including the length of time that certain http://wikileaks.org/wiki/CRS-RS21449 information may be reported.13 States are prohibited from enacting laws related to the requirements imposed under the FCRA.14 In addition to the duties imposed on the users of consumer reports, the Fair Credit Reporting Act imposes certain duties on persons who furnish information to consumer reporting agencies. These include a duty to report accurate information, a duty to correct and update information, a duty to provide notice of the disputed accuracy of information reported, a duty to provide notice of accounts closed by the consumer, and a duty to provide notice of delinquency of accounts.15 State law is preempted with respect to these requirements.16 State laws relating to the exchange of information among persons affiliated by common ownership or common corporate control are also preempted,17 as are those 10 15 U.S.C. 1681m(b). 11 15 U.S.C. 1681t(b)(1)(D). 12 15 U.S.C. 1681m(d). 13 15 U.S.C. 1681c. 14 The preemption of these provisions in state law do not apply to any state law in effect on the date of enactment of the Consumer Credit Reporting Reform Act of 1996. 15 U.S.C. 1681t(b)(1)(E). 15 15 U.S.C. 1681s-2. 16 The preemption does not apply with respect to section 54A(a) of chapter 93 of the Massachusetts Annotated Laws (as in effect on the date of enactment of the Consumer Credit Reporting Reform Act of 1996); or with respect to section 1785.25(a) of the California Civil Code (as in effect on the date of enactment of the Consumer Credit Reporting Reform Act of 1996). 15 U.S.C. 1681t(b)(1)(F). 17 The preemption does not apply with respect to subsection (a) or (c)(1) of section 2480e of title (continued...) CRS-4 relating to the form and content of the disclosure of a consumer's rights under the FCRA.18 Expiration of Preemption Provisions The specific preemption provisions of the Fair Credit Reporting Act discussed above were set to expire at the end of 2003. If unchanged, the preemptions would have been inapplicable to any provision of state law enacted after January 1, 2004, so long as the new law stated explicitly that it was intended to supplement the federal law, and it gave greater protection to consumers than is provided by the Fair Credit Reporting Act.19 However, Congress recently enacted legislation making the current preemptions permanent, thus preventing states from enacting similar laws.20 This legislation is discussed in detail below. Legislative Response P.L. 108-159, the Fair and Accurate Credit Transactions Act of 2003, inter alia, http://wikileaks.org/wiki/CRS-RS21449 makes the FCRA's current preemptions, set to expire at the end of 2003, permanent. By making these preemptions permanent, states are prohibited from enacting laws relating the issues discussed above. Due to additional amendments made by the Act, a number of state statutes not preempted under the current FCRA, are preempted under the Act, as amended. The Act also specifically provides for the preemption of a number of state laws related to identity theft. Under the FCRA, as amended by P.L. 108-159, state laws related to information provided to victims of identity theft are preempted. Under the FCRA, as amended, the Federal Trade Commission, in consultation with the federal banking agencies and the National Credit Union Administration, is required to prepare a model summary of the rights of consumers under the Act with respect to the procedures for remedying the effects of fraud or identity theft.21 Consumer reporting agencies are then required to provide consumers who believe that they have been a victim of fraud or identity theft with a copy of this summary and information on how to contact the FTC for more information.22 17 (...continued) 9, Vermont Statutes Annotated (as in effect on the date of enactment of the Consumer Credit Reporting Reform Act of 1996). 15 U.S.C. 1681t(b)(2). The provisions of the recently enacted California financial privacy law relating to the sharing of information among affiliates would presumably be preempted pursuant to this provision. For more information on the sharing of information among affiliates see CRS Report RS21427, State Financial Privacy Laws Affecting Sharing of Customer Information Among Affiliated Financial Institutions. 18 15 U.S.C. 1681t(b)(3). Requirements regarding the form and content of the disclosure of a consumer's rights under the FCRA are codified at 15 U.S.C. 1681g(c). 19 15 U.S.C. 1681t(d)(2). 20 P.L. 108-159. 21 Id. at Sec. 151(a). 22 Id. CRS-5 P.L. 108-159 amends the FCRA to add a new section related to the exchange and use of information among affiliated institutions to make a solicitation for marketing purposes.23 Under this new section, subject to certain exemptions, information shared among affiliates may not be used to make a solicitation for marketing purposes, unless it is clearly and conspicuously disclosed to the consumer that the information may be exchanged for such purposes, and the consumer is provided an opportunity and a simple method to prohibit the making of such solicitations.24 The original preemption provisions of the FCRA preempted state laws related to the sharing of information among affiliated institutions.25 P.L. 108-159 amended the Act's preemptions provisions to also explicitly preempt state laws related to the exchange of information to make a solicitation for marketing purposes.26 Under the FCRA, as amended by P.L. 108-159, state laws related to the duties of users of consumer reports to provide notice with respect to terms in certain credit transactions are preempted.27 The Act, as amended, requires users who grant, extend, or otherwise provide credit on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that user, to provide a special notice to the consumer.28 The notice provided must include (1) http://wikileaks.org/wiki/CRS-RS21449 a statement informing the consumer that the terms offered were set based on information from a consumer report; (2) identification of the consumer reporting agency that furnished the report; (3) a statement informing the consumer that the consumer may obtain a copy of the report from that agency free of charge; and (4) the contact information specified by the agency for obtaining such reports. These requirements preempt any similar requirements that may be imposed under any state laws. In addition to the new preemptions discussed above, P.L. 108-159 amends the FCRA's preemption provision to provide for the preemption of a number of state laws related to identity theft.29 The FCRA, as amended, includes several provisions aimed at preventing identity theft or assisting victims. Subject to certain exceptions, these new provisions preempt similar state laws. Newly preempted state laws include those related to the truncation of credit card account numbers on electronically printed receipts; the placement of fraud alerts in consumer credit reports; the blocking of information in a consumer's credit report resulting from identity theft; the free annual disclosure of consumer credit reports; the development of red flag guidelines to prevent identity theft; and the disposal of certain records containing information obtained from consumer reports. 23 P.L. 108-159, Sec. 214. 24 Id. 25 15 U.S.C. 1681t(b)(2). 26 P.L. 108-159, Sec. 214. 27 Id. at Sec. 311(b). 28 Id. at Sec. 311(a). 29 Id. at Sec. 711.