Control Your Personal Credit Information Act of 2018

Summary: Control Your Personal Credit Information Act of 2018  This bill amends the Fair Credit Reporting Act to require a consumer's affirmative written consent before a consumer reporting agency may share that consumer's report with third parties for specified purposes. A consumer must provide proper identification when giving this consent. (Currently, this sharing is generally allowed unless a consumer opts out.)  If the consumer provides consent, a consumer reporting agency may share information with a third party for:   an extension of credit, or  the underwriting of insurance.   A consumer reporting agency may provide a consumer report in connection with transactions not initiated by the consumer only if:   the consumer provides affirmative consent, and  the transaction consists of a firm offer of credit or insurance.   The Government Accountability Office must report on how best to protect information collected in consumer files.  Consumer reporting agencies may not charge consumers fees in connection with furnishing consumer reports.  The bill requires consumer reporting agencies to use reasonable efforts to prevent data breaches of consumer reports. 

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Control Your Personal Credit 
Information Act of 2018''.

SEC. 2. PERMISSIBLE PURPOSES OF REPORTS.

    (a) In General.--The Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.) is amended--
            (1) in section 604 (15 U.S.C. 1681b)--
                    (A) by striking subsections (c) through (e) and 
                inserting the following:
    ``(c) Conditions for Furnishing Certain Consumer Reports.--
            ``(1) In general.--A consumer reporting agency may furnish 
        a consumer report for the following purposes only if the 
        consumer provides the consumer reporting agency with 
        affirmative written consent to furnish the consumer report, 
        after furnishing proper identification under section 610:
                    ``(A) An extension of credit pursuant to subsection 
                (a)(3)(A).
                    ``(B) The underwriting of insurance pursuant to 
                subsection (a)(3)(C).
            ``(2) Additional reports; election.--After a consumer has 
        provided affirmative written consent and furnished proper 
        identification under paragraph (1) to a consumer reporting 
        agency, the consumer reporting agency may continue to furnish 
        consumer reports solely for the purposes of reviewing or 
        collecting on an account described in subparagraphs (A) and (C) 
        of subsection (a)(3).
            ``(3) Furnishing reports in connection with credit or 
        insurance transactions that are not initiated by consumer.--
                    ``(A) In general.--A consumer reporting agency may 
                furnish a consumer report to a person in connection 
                with any credit or insurance transaction under 
                subparagraph (A) or (C) of subsection (a)(3) that is 
                not initiated by the consumer only if--
                            ``(i) the consumer provides the consumer 
                        reporting agency affirmative written consent to 
                        furnish the consumer report, after furnishing 
                        proper identification under section 610; and
                            ``(ii) the transaction consists of a firm 
                        offer of credit or insurance.
                    ``(B) Election.--The consumer may elect to--
                            ``(i) have the consumer's name and 
                        addresses included in lists of names and 
                        addresses provided by the consumer reporting 
                        agency pursuant to subparagraphs (A) and (C) of 
                        subsection (a)(3) in connection with any credit 
                        or insurance transaction that is not initiated 
                        by the consumer only if--
                                    ``(I) the consumer provides the 
                                consumer reporting agency affirmative 
                                written consent to furnish the consumer 
                                report, after furnishing proper 
                                identification under section 610; and
                                    ``(II) the transaction consists of 
                                a firm offer of credit or insurance; 
                                and
                            ``(ii) revoke at any time the election 
                        pursuant to clause (i) to have the consumer's 
                        name and address included in lists provided by 
                        a consumer reporting agency.
                    ``(C) Information regarding inquiries.--Except as 
                provided in section 609(a)(5), a consumer reporting 
                agency shall not furnish to any person a record of 
                inquiries in connection with a credit or insurance 
                transaction that is not initiated by a consumer.
            ``(4) Disclosures.--
                    ``(A) In general.--A person may not procure a 
                consumer report for any purpose pursuant to 
                subparagraphs (D), (F), and (G) of subsection (a)(3) 
                unless--
                            ``(i) a clear and conspicuous disclosure 
                        has been made in writing to the consumer at any 
                        time before the report is procured or caused to 
                        be procured, in a document that consists solely 
                        of the disclosure, that a consumer report may 
                        be obtained for such purposes; and
                            ``(ii) the consumer has authorized in 
                        writing the procurement of the consumer report 
                        by that person.
                    ``(B) Authorizations.--The authorization described 
                in subparagraph (A)(ii) may be made on the disclosure 
                document provided under subparagraph (A)(i).
            ``(5) Rule making.--Not later than 180 days after the date 
        of enactment of the Control Your Personal Credit Information 
        Act of 2018, the Director of the Bureau shall promulgate 
        regulations that--
                    ``(A) implement this subsection;
                    ``(B) establish a model form for the disclosure 
                document pursuant to paragraph (4) and define the term 
                clear and conspicuous disclosure;
                    ``(C) establish guidelines that permit consumers to 
                provide a single written authorization as required by 
                paragraph (1) for a specific time period for multiple 
                users for the specified purpose during that time 
                period;
                    ``(D) require a consumer reporting agency to 
                provide to each consumer a secure, convenient, 
                accessible, and cost-free method by which a consumer 
                may allow or disallow the furnishing of consumer 
                reports pursuant to this subsection; and
                    ``(E) require a consumer reporting agency not later 
                than 2 business days after the date on which a consumer 
                makes an election to revoke the consumer's inclusion of 
                the consumer's name and address in lists provided by a 
                consumer reporting agency pursuant to paragraph (3)(B) 
                to implement that election.
            ``(6) Prohibitions.--
                    ``(A) In general.--The method described in 
                paragraph (5)(D) shall not be used to--
                            ``(i) collect any information on a consumer 
                        that is not necessary for the purpose of the 
                        consumer to allow or disallow the furnishing of 
                        consumer reports; or
                            ``(ii) advertise any product or service.
                    ``(B) No waiver.--In the offering of a method 
                described in paragraph (5)(D), a consumer reporting 
                agency shall not require a consumer to waive any rights 
                nor indemnify the consumer reporting agency from any 
                liabilities arising from the offering of such method.
            ``(7) Reports.--
                    ``(A) CFPB.--
                            ``(i) Recommendation.--Not later than 180 
                        days after the date of enactment of the Control 
                        Your Personal Credit Information Act of 2018, 
                        the Director of the Bureau shall, after 
                        consultation with the Federal Deposit Insurance 
                        Corporation, the National Credit Union 
                        Administration, and other Federal and State 
                        regulators as the Director of the Bureau 
                        determines are appropriate, submit to the 
                        Committee on Banking, Housing, and Urban 
                        Affairs of the Senate and the Committee on 
                        Financial Services of the House of 
                        Representatives recommendations on how to 
                        provide consumers greater transparency and 
                        personal control over their consumer reports 
                        furnished for permissible purposes under 
                        subsections (a)(3)(E) and (a)(6).
                            ``(ii) Report.--The Director of the Bureau 
                        shall submit to the Committee on Banking, 
                        Housing, and Urban Affairs of the Senate and 
                        the Committee on Financial Services of the 
                        House of Representatives an annual report that 
                        includes recommendations on how this subsection 
                        may be improved, a description of enforcement 
                        actions taken to demonstrate compliance with 
                        this subsection, recommendations on how to 
                        improve oversight of consumer reporting 
                        agencies and users of consumer reports, and any 
                        other recommendations concerning how consumers 
                        may be provided greater transparency and 
                        control over their personal information.
                    ``(B) GAO.--
                            ``(i) Study.--The Comptroller General of 
                        the United States shall conduct a study on what 
                        additional protections or restrictions may be 
                        needed to ensure that the information collected 
                        in consumer files is secure and does not 
                        adversely impact consumers.
                            ``(ii) Report.--Not later than 1 year after 
                        the date of enactment of the Control Your 
                        Personal Credit Information Act of 2018, the 
                        Comptroller General of the United States shall 
                        submit to the Committee on Banking, Housing, 
                        and Urban Affairs of the Senate and the 
                        Committee on Financial Services of the House of 
                        Representatives a report on the results of the 
                        study under clause (i), which shall include--
                                    ``(I) to the greatest extent 
                                possible, the presentation of 
                                unambiguous conclusions and specific 
                                recommendations for further legislative 
                                changes needed to ensure that the 
                                information collected in consumer files 
                                is secure and does not adversely impact 
                                consumers; and
                                    ``(II) if no recommendations for 
                                further legislative changes are 
                                presented, a detailed explanation of 
                                why no such changes are recommended.'';
                    (B) by redesignating subsections (f) and (g) as 
                subsections (d) and (e), respectively; and
                    (C) by adding at the end the following:
    ``(f) No Fees.--No consumer reporting agency may charge a consumer 
any fee for any activity pursuant to this section.'';
            (2) in section 607(a) (15 U.S.C. 1681e(a)), by inserting 
        ``Every consumer reporting agency shall use commercially 
        reasonable efforts to avoid unauthorized access to consumer 
        reports and information in the file of a consumer maintained by 
        the consumer reporting agency, including complying with any 
        appropriate standards established under section 501(b) of the 
        Gramm-Leach-Bliley Act (15 U.S.C. 6801(b)).'' after the end of 
        the third sentence;
            (3) in section 609 (15 U.S.C. 1681g), by striking 
        subsection (b) and inserting the following:
    ``(b) Scope of Disclosure.--The Director of the Bureau shall 
promulgate regulations to clarify that any information held by a 
consumer reporting agency about a consumer shall be disclosed to the 
consumer when a consumer makes a written request, irrespective of 
whether the information is held by the parent, subsidiary, or affiliate 
of a consumer reporting agency.''; and
            (4) in section 610(a)(1) (15 U.S.C. 1681h(a)(1)), by 
        striking ``section 609'' and inserting ``sections 604 and 
        609''.
    (b) Technical and Conforming Amendments.--The Fair Credit Reporting 
Act (15 U.S.C. 1681 et seq.) is amended--
            (1) in section 603(d)(3) (15 U.S.C. 1681a(d)(3)), in the 
        matter preceding subparagraph (A), by striking ``604(g)(3)'' 
        and inserting ``604(e)(3)'';
            (2) in section 615(d) (15 U.S.C. 1681m(d))--
                    (A) in paragraph (1)--
                            (i) in the matter preceding subparagraph 
                        (A), by striking ``604(c)(1)(B)'' and inserting 
                        ``604(c)(3)(A)(ii)''; and
                            (ii) in subparagraph (E), by striking 
                        ``604(e)'' and inserting ``604(c)(5)(D)''; and
                    (B) in paragraph (2)(A), by striking ``604(e)'' and 
                inserting ``604(c)(5)(D)''; and
            (3) in section 625(b)(1)(A) (15 U.S.C. 1681t(b)(1)(A)), by 
        striking ``subsection (c) or (e) of section 604'' and inserting 
        ``604(c)''.