[Federal Register Volume 89, Number 15 (Tuesday, January 23, 2024)]
[Rules and Regulations]
[Pages 4167-4171]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-00786]


=======================================================================
-----------------------------------------------------------------------

CONSUMER FINANCIAL PROTECTION BUREAU

12 CFR Part 1022


Fair Credit Reporting; File Disclosure

AGENCY: Consumer Financial Protection Bureau.

ACTION: Advisory opinion.

-----------------------------------------------------------------------

SUMMARY: The Consumer Financial Protection Bureau (CFPB or Bureau) is 
issuing this advisory opinion to address certain obligations that 
consumer reporting agencies have under section 609(a) of the Fair 
Credit Reporting Act (FCRA). This advisory opinion underscores that, to 
trigger a consumer reporting agency's file disclosure requirement under 
FCRA section 609(a), a consumer does not need to use specific language, 
such as ``complete file'' or ``file.'' This advisory opinion also 
highlights the requirements regarding the information that must be 
disclosed to a consumer under FCRA section 609(a). In addition, this 
advisory opinion affirms that consumer reporting agencies must disclose 
to a consumer both the original source and any intermediary or vendor 
source (or sources) that provide the item of information to the 
consumer reporting agency under FCRA section 609(a).

DATES: This advisory opinion is effective on January 23, 2024.

FOR FURTHER INFORMATION CONTACT: Amanda Quester, Alexandra Reimelt, or 
Ruth Van Veldhuizen, Senior Counsels, Office of Regulations at (202) 
435-7700 or https://reginquiries.consumerfinance.gov/. If you require 
this document in an alternative electronic format, please contact 
<a href="/cdn-cgi/l/email-protection#a0e3e6f0e2ffe1c3c3c5d3d3c9c2c9ccc9d4d9e0c3c6d0c28ec7cfd6"><span class="__cf_email__" data-cfemail="d2919482908d93b1b1b7a1a1bbb0bbbebba6ab92b1b4a2b0fcb5bda4">[email protected]</span></a>.

SUPPLEMENTARY INFORMATION: The Bureau is issuing this advisory opinion 
through the procedures for its Advisory Opinions Policy.\1\ Refer to 
those procedures for more information.
---------------------------------------------------------------------------

    \1\ 85 FR 77987 (Dec. 3, 2020).
---------------------------------------------------------------------------

I. Advisory Opinion

A. Background

    The FCRA regulates consumer reporting.\2\ Congress enacted the 
statute ``to ensure fair and accurate credit reporting, promote 
efficiency in the banking system, and protect consumer privacy.'' \3\ 
One of the problems with the credit reporting industry that Congress 
recognized and sought to remedy with the FCRA was that a consumer ``is 
not always given access to the information in [their] file.'' \4\ In 
light of its broad remedial and consumer protection purposes, courts 
have recognized that the FCRA ``must be read in a liberal manner in 
order to effectuate the congressional intent underlying it.'' \5\
---------------------------------------------------------------------------

    \2\ See 15 U.S.C. 1681-1681x.
    \3\ Safeco Ins. Co. of Am. v. Barr, 551 U.S. 47, 52 (2007); see 
also 15 U.S.C. 1681 (recognizing ``a need to insure that consumer 
reporting agencies exercise their grave responsibilities with 
fairness, impartiality, and a respect for the consumer's right to 
privacy''); S. Rep. No. 91-517, at 1 (1969) (noting that purpose of 
the statute is, in part, to ``prevent consumers from being unjustly 
damaged because of inaccurate or arbitrary information in a credit 
report'' and to ``prevent an undue invasion of the individual's 
right of privacy in the collection and dissemination of credit 
information'').
    \4\ S. Rep. No. 91-517, at 3 (1969) (noting, as an example of 
this problem, that ``[i]nsurance reporting firms generally do not 
admit to making a report on an individual and ordinarily will not 
reveal the contents of their file to [them]. Credit bureaus 
sometimes build roadblocks in the path of the consumer.''). When 
introducing the bill that would become the FCRA, Senator Proxmire 
stated that ``[m]any credit reporting agencies refuse to show 
consumers their files possibly out of fear of litigation and partly 
to protect its information sources.'' 115 Cong. Rec. 2412 (1969).
    \5\ See, e.g., Fed. Trade Comm'n, 40 Years of Experience With 
the Fair Credit Reporting Act: An FTC Staff Report With Summary of 
Interpretations, at 32 (2011); Cortez v. Trans Union, LLC, 617 F.3d 
688, 706 (3rd Cir. 2010); Guimond v. Trans Union Credit Info. Co., 
45 F.3d 1329, 1333 (9th Cir. 1995) (``[The FCRA] was crafted to 
protect consumers from the transmission of inaccurate information 
about them, and to establish credit reporting practices that utilize 
accurate, relevant, and current information in a confidential and 
responsible manner. These consumer[-]oriented objectives support a 
liberal construction of the FCRA'' (citations omitted).).
---------------------------------------------------------------------------

    The FCRA also promotes transparency of the credit reporting system 
to consumers in many ways, including by generally requiring that 
consumer reporting agencies disclose to consumers all information in 
their file upon request. Under section 609(a), a consumer reporting 
agency must, upon request, clearly and accurately disclose to the 
consumer ``[a]ll information in the consumer's file at the time of the 
request'' and ``[t]he sources of the information.'' \6\ This 
requirement applies to all consumer reporting agencies.\7\ Consumers 
are entitled to free file disclosures in many circumstances. For 
example, each nationwide consumer reporting agency and nationwide 
specialty consumer reporting agency, including any nationwide tenant 
screening or employment background screening company, must provide at

[[Page 4168]]

least one free file disclosure annually.\8\ Consumers also are entitled 
to free file disclosures in certain other circumstances, such as in 
connection with adverse action notices and fraud alerts.\9\
---------------------------------------------------------------------------

    \6\ See 15 U.S.C. 1681g(a). This requirement is subject to 
several exceptions. For example, consumer reporting agencies are not 
required to disclose to a consumer any information concerning credit 
scores or any other risk scores or predictors relating to the 
consumer. See 15 U.S.C. 1681g(a)(1)(B). The Consumer Credit 
Reporting Reform Act of 1996 revised FCRA section 609(a) to require 
that consumers receive all information in the file rather than only 
the ``nature and substance'' of the information. Public Law 104-208, 
110 Stat. 3009 (1996).
    \7\ See 15 U.S.C. 1681a(f) (defining ``consumer reporting 
agency'').
    \8\ See 15 U.S.C. 1681j; 12 CFR 1022.136 (centralized source for 
requesting annual file disclosures from nationwide consumer 
reporting agencies); 12 CFR 1022.137 (streamlined process for 
requesting annual file disclosures from nationwide specialty 
consumer reporting agencies); CFPB, Bulletin 2012-09 (Nov. 29, 2012) 
(explaining FCRA's ``streamlined process'' requirement for consumers 
to obtain free annual reports from nationwide specialty consumer 
reporting agencies), https://www.consumerfinance.gov/compliance/supervisory-guidance/bulletin-fcra-process-requirement-consumers/.
    \9\ See 15 U.S.C. 1681j(b)-(d). In other instances, consumers 
may be required to pay for a file disclosure, with the fee capped by 
regulation. A list of consumer reporting companies is available at: 
https://www.consumerfinance.gov/consumer-tools/credit-reports-and-scores/consumer-reporting-companies/companies-list/.
---------------------------------------------------------------------------

    The FCRA defines a consumer's ``file'' as ``all of the information 
on that consumer that is recorded and retained by a consumer reporting 
agency, regardless of how the information is stored.'' \10\ Consumer 
reporting agencies possess files on hundreds of millions of Americans. 
These files typically include information about, among other things, a 
consumer's credit, criminal, employment, and rental histories. Consumer 
reporting agencies may obtain this information from multiple sources, 
including companies that provide information about their direct 
experiences with consumers and third parties who gather information 
from courts and other sources of public records.\11\ Errors by a 
furnisher or a third-party source can affect a consumer's file at many 
different consumer reporting agencies.\12\ Consumer reporting agencies 
use the information in consumer files to produce and sell consumer 
reports,\13\ which creditors, insurers, landlords, employers, and 
others who have a permissible purpose use to make eligibility and other 
decisions about consumers. The potential for the vast quantity of 
information contained in consumer files to include errors poses 
significant risks to accuracy, fairness, and consumer privacy in the 
consumer reporting system.
---------------------------------------------------------------------------

    \10\ See 15 U.S.C. 1681a(g) (defining ``file'').
    \11\ CFPB, Market Snapshot: Background Screening Reports: 
Criminal background checks in employment 5-6 (Oct. 2019), https://files.consumerfinance.gov/f/documents/201909_cfpb_market-snapshot-background-screening_report.pdf. See also Nat'l Consumer Law Ctr., 
Broken Records: How Errors by Criminal Background Checking Companies 
Harm Workers and Business 10-11 (2012), https://www.nclc.org/images/pdf/pr-reports/broken-records-report.pdf.
    \12\ See, e.g., Clark v. Trans Union LLC, No. 3:15cv391, 2016 WL 
7197391, at *11 (E.D. Va. Dec. 9, 2016) (stating that ``the failure 
to include LexisNexis in the report creates a material risk that 
LexisNexis could continue to report inaccurate information to others 
in the future'').
    \13\ See 15 U.S.C. 1681a(d) (defining ``consumer report'').
---------------------------------------------------------------------------

    Section 609(a)'s file disclosure requirements are central to the 
statute's accuracy, fairness, and privacy purposes. Consumers have a 
right to see the information consumer reporting agencies keep about 
them in their files at any time. Absent file disclosure requirements, a 
consumer may not be able to review their file, determine whether it 
contains any incomplete or inaccurate information, and, if it does, 
file a dispute under FCRA sections 611 and 623, and have the 
information corrected or deleted.\14\ Disclosure of the information in 
a consumer's file upon request is a critical component of the FCRA's 
carefully calibrated dispute provisions.\15\ Moreover, file disclosure 
also promotes the FCRA's fairness purpose by enabling consumers to 
identify any negative information in their files that may be used to 
make credit and other eligibility determinations about them and take 
steps to improve their credit profiles.\16\
---------------------------------------------------------------------------

    \14\ See 15 U.S.C. 1681i.
    \15\ See, e.g., Gillespie v. Equifax Info. Servs., LLC, 484 F.3d 
938, 941 (7th Cir. 2007) (stating that ``a primary purposes of the 
statutory scheme provided by the disclosure in Sec.  1681g(a)(1) is 
to allow consumers to identify inaccurate information in their 
credit files and correct this information via the grievance 
procedure established under Sec.  1681i''). In addition, the Bureau 
has previously emphasized the importance of consumer reporting 
agencies using disputes to assess furnisher data quality. For 
example, the Bureau has directed consumer reporting agencies to 
revise their accuracy procedures to identify and take corrective 
action regarding data from furnishers whose dispute response 
behavior indicates the furnisher is not a source of reliable, 
verifiable information about consumers. See CFPB, Supervisory 
Highlights: Issue 24, Summer 2021 (June 2021), https://files.consumerfinance.gov/f/documents/cfpb_supervisory-highlights_issue-24_2021-06.pdf.
    \16\ The FTC and the CFPB have brought several enforcement 
actions to address violations of the FCRA's file disclosure 
requirements. See, e.g., FTC v. TransUnion Rental Screening 
Solutions, Inc., No. 1:23-cv-2659 (D. Colo. 2023) (alleging that 
defendant violated FCRA section 609(a) by failing to disclose the 
sources of information contained in consumers' files in response to 
consumers' requests); United States v. HireRight Solutions, Inc., 
No. 112-cv-01313 (D.D.C. 2012) (alleging that defendant violated 
FCRA section 609(a)(1) by either failing to provide consumers with 
information in their files or failing to do so upon request); United 
States v. First Advantage SafeRent, Inc., No. 8:10-cv-0090-PJM (D. 
Md. 2010) (alleging that defendant violated FCRA section 609(a)(1) 
by rejecting requests for file disclosure submitted by facsimile and 
requiring consumers complete and submit a written file disclosure 
request form through the U.S. mail); In re MIB, Inc. (d/b/a Medical 
Information Bureau), 101 F.T.C. 415 (1983) (alleging that defendant 
violated FCRA section 609(a) when it required consumer to sign a 
release form as a prerequisite for obtaining their file disclosure).
---------------------------------------------------------------------------

    Consumers may suffer significant harm when they are unable to 
obtain all information in their files upon request. Without access to 
all information in their file, a consumer often cannot even take the 
initial steps to dispute inaccurate information in their consumer 
reports or take well-informed action to improve their credit profile. 
Disputing inaccurate information on a consumer report and improving 
one's credit profile, often challenging and time-consuming processes 
for consumers, are made even more difficult when consumers do not have 
access to all of the information in their file. For example, if a 
consumer identifies an error in an item of information in their file, 
but the consumer reporting agency has only disclosed to the consumer 
the original source of the information and not also the vendor source 
that directly provided the information to the consumer reporting agency 
and from which the error arose, the consumer would not be able to 
identify the source of the erroneous information and may not be able to 
correct it.\17\
---------------------------------------------------------------------------

    \17\ See Leo v. AppFolio, Inc., No. 17-5771 RJB, 2018 WL 623647, 
at *8 (W.D. Wash. Jan. 30, 2018).
---------------------------------------------------------------------------

    The CFPB is issuing this advisory opinion to highlight certain file 
disclosure requirements imposed under FCRA section 609(a). First, this 
advisory opinion underscores that, to trigger a consumer reporting 
agency's file disclosure requirement under FCRA section 609(a), a 
consumer does not need to use specific language, such as ``complete 
file'' or ``file.'' Next, this advisory opinion highlights the 
requirements regarding the information that must be disclosed to a 
consumer under FCRA section 609(a). Finally, this advisory opinion 
affirms that consumer reporting agencies must disclose to a consumer 
both the original source and any intermediary or vendor source (or 
sources) that provide the item of information to the consumer reporting 
agency under FCRA section 609(a).

B. Coverage

    This advisory opinion applies to all ``consumer reporting 
agencies,'' as that term is defined in FCRA section 603(f).

C. Legal Analysis

1. Requests Under FCRA Section 609(a)
    Section 609(a) of the FCRA provides, with certain exceptions, that 
``[e]very consumer reporting agency shall, upon request . . . clearly 
and accurately disclose to the consumer, among other things: (1) All 
information in the consumer's file at the time of the request . . .; 
and (2) The sources of the information.'' Section 610 in turn specifies 
the conditions and form of

[[Page 4169]]

disclosures to consumers. The Bureau is aware that some industry 
stakeholders have taken the position that consumers must use specific 
language in order to request file disclosures under section 609(a), 
such as the term ``complete file.'' \18\ As the Third Circuit recently 
held, such requirements contravene the FCRA.\19\ The CFPB interprets 
the FCRA to require consumer reporting agencies to provide a file 
disclosure upon receipt of a ``request'' from a consumer who provides 
proper identification even if the consumer does not use the specific 
term ``request,'' ``file,'' ``complete file,'' or any other specific 
words in making such a request.
---------------------------------------------------------------------------

    \18\ See, e.g., Brief of the Chamber of Commerce of the United 
States as Amicus Curiae in Support of Appellees, Kelly v. RealPage, 
Inc., No. 21-1672 (Aug. 5, 2021), https://www.chamberlitigation.com/cases/kelly-v-realpage-inc at 5, 28-29 (arguing that to trigger the 
requirements of FCRA section 609(a) ``the request must specifically 
be for `[a]ll information in the consumer's file,' meaning the 
complete file''); Brief of Amici Curiae Consumer Data Industry 
Association and Professional Background Screening Association in 
Support of Defendants-Appellees and Affirmance, Kelly v. RealPage, 
Inc., No. 21-1672 (Aug. 5, 2021), https://www.cdiaonline.org/wp-content/uploads/2021/08/2021-08-05-CDIA-Amicus.pdf at 7, 14-19. 
According to these stakeholders, a request for a ``report'' would 
not trigger section 609(a)'s disclosure obligations. These arguments 
were recently rejected by the Third Circuit. Kelly v. RealPage, 
Inc., 47 F.4th 202, 219-20 (3rd Cir. Aug. 24, 2022) (``Nothing in 
the statute's text, context, purpose, or history indicates that any 
magic words are required for a consumer to effect a `request' under 
Sec.  1681g(a) or that a consumer's request for `my consumer report' 
is any less effective at triggering the [consumer reporting 
agency]'s disclosure obligations than a request for `my file.' '').
    \19\ Kelly v. RealPage, Inc., 47 F.4th 202, 221 (3rd Cir. 2022) 
(``[W]hen read as a whole, the statute is unambiguous in providing 
that any generalized `request' by a consumer for the [consumer 
reporting agency]'s information about her triggers the CRA's 
disclose obligation under Sec.  1681g(a).'').
---------------------------------------------------------------------------

    To obtain a file disclosure, the FCRA does not require consumers to 
use any specific language. Instead, the statute requires consumers to 
do two things: make a ``request'' and provide proper 
identification.\20\ Once these conditions are satisfied, FCRA section 
609(a) states that a consumer reporting agency ``shall'' provide the 
file disclosure. The statute's use of ``shall'' in this context makes 
clear that a consumer reporting agency may not add additional 
conditions as a prerequisite to complying with section 609(a).\21\
---------------------------------------------------------------------------

    \20\ 15 U.S.C. 1681g(a), 1681h(a)(1).
    \21\ This is consistent with longstanding interpretations from 
FTC staff. See, e.g., Fed. Trade Comm'n, 40 Years of Experience With 
the Fair Credit Reporting Act: An FTC Staff Report With Summary of 
Interpretations, at 75 & n.248, citing 1990 comment 610-2 (2011).
---------------------------------------------------------------------------

    The statute does not define the term ``request'' as used in section 
609(a). In construing the term's meaning, the Bureau is guided by the 
statute's broad remedial purposes.\22\ As noted above, it is clear that 
one of Congress's goals in the FCRA was to facilitate consumers' access 
to their own information and, through such access, to promote the 
accuracy, privacy, and fairness of the consumer reporting system.\23\ 
These goals would be thwarted if a consumer's right to a file 
disclosure depended upon the use of specific words--particularly since 
no such requirement appears in the statute and because consumers are 
unlikely to know which words any particular consumer reporting agency 
expects to hear before honoring its file disclosure obligations. As the 
Third Circuit explained, if the FCRA were read otherwise:
---------------------------------------------------------------------------

    \22\ See supra note 5.
    \23\ See supra notes 3, 4.

    [C]onsumers could only access their files pursuant to [section 
609(a)] if they are familiar with the esoteric distinction between 
``files'' and ``consumer reports'' in the Definitions section of the 
FCRA. Construing [section 609(a)] in this way would severely limit 
consumers' ``access to . . . information in [their] file'' and 
frustrate their ability to know when they are ``being damaged by an 
adverse credit report,'' or to ``correct[] inaccurate information'' 
in their report.\24\
---------------------------------------------------------------------------

    \24\ Kelly v. RealPage, Inc., 47 F.4th 202, 221 (3rd Cir. Aug. 
24, 2022); see also Taylor v. Screening Reports, Inc., 294 FRD. 680, 
684 (N.D. Ga. 2013) (``[A] consumer who requests his `report,' 
without limitation, is entitled to his entire consumer file.'').

    Thus, to obtain a file disclosure under section 609(a), a consumer 
need not specifically request ``[a]ll information in the consumer's 
file'' or request a ``complete file'' or even use the word ``file.'' 
For example, a consumer's request to a consumer reporting agency for a 
``report'' or ``credit report'' or ``consumer report'' or ``file'' or 
``record,'' along with proper identification, trigger a consumer 
reporting agency's obligation under section 609(a).
    The CFPB's interpretation of section 609(a)--that consumers do not 
need to use the words ``file'' or ``complete file'' to invoke their 
right to a file disclosure--is consistent with the way Congress itself 
refers to section 609(a) requests in parts of the FCRA. Although 
section 609(a) requires disclosure of all information in the consumer's 
``file'' (with only limited, specified exceptions), Congress used the 
term ``consumer report'' as a short-hand term for the disclosures 
required by section 609(a) in some sections that refer to consumer 
requests and consumer-facing materials.\25\ For example, FCRA section 
609(c)(1)(B)(i) requires that the Summary of Rights provided to 
consumers include a description of ``the right of the consumer to 
obtain a copy of a consumer report under [FCRA section 609(a)].'' \26\ 
Similarly, FCRA section 612(a)(1), which requires nationwide consumer 
reporting agencies and nationwide specialty consumer reporting agencies 
to ``make all disclosures pursuant to section [609(a)]'' available for 
free annually, later refers to such file disclosures as ``consumer 
reports'' when it refers to a ``streamlined process for consumers to 
request consumer reports under [FCRA section 612(a)(1)(A)].'' \27\
---------------------------------------------------------------------------

    \25\ Presumably Congress appreciated that ``consumer report'' is 
an easy-to-understand term for consumers even if it is somewhat 
imprecise in describing what must be disclosed under section 609(a).
    \26\ 15 U.S.C. 1681g(c)(1)(B)(i).
    \27\ 15 U.S.C. 1681j(a)(1). The implementation of free file 
disclosure requirement for nationwide consumer reporting agencies 
also makes it clear that consumers do not need use the term ``file'' 
or ``complete file'' to invoke their rights under FCRA section 
609(a). FCRA section 612(a)(1)(B) requires the nationwide consumer 
reporting agencies to make free annual section 609(a) disclosures 
via a ``centralized source.'' The nationwide consumer reporting 
agencies do so through the website annualcreditreport.com, which is 
the only authorized website for obtaining such disclosures and which 
refers to those disclosures as ``credit reports.'' 12 CFR 1022.136.
---------------------------------------------------------------------------

2. Information Required To Be Disclosed Under FCRA Section 609(a)(1)
    Section 609(a) of the FCRA generally requires consumer reporting 
agencies to, upon request, ``clearly and accurately'' disclose ``all 
information in the consumer's file at the time of the request.'' To 
meet this standard, a file disclosure must be understandable to the 
average consumer.\28\ It must assist a consumer in identifying 
inaccuracies in their file, exercising their rights to dispute any 
incomplete or inaccurate information, and knowing when they are being 
impacted by adverse information in their file.\29\
---------------------------------------------------------------------------

    \28\ See, e.g., Shaw v. Experian Info. Sols., Inc., 891 F.3d 
749, 759 (9th Cir. 2018).
    \29\ 15 U.S.C. 1681i(a); 1681s-2.
---------------------------------------------------------------------------

    Some consumers are experiencing difficulty in obtaining clear, 
accurate, and complete file disclosures, particularly from background 
screening companies. As discussed below, in this advisory opinion the 
Bureau is highlighting that (1) section 609(a)(1) of the FCRA requires 
that a consumer reporting agency clearly and accurately disclose to a 
consumer all information in the consumer's file at the time of the 
request, including, among other things, all information the consumer 
reporting agency provided or might provide to a user, and (2) when a 
consumer reporting agency provides only summarized information to a 
user, section 609(a)(1) of the FCRA requires that the consumer 
reporting agency provide the consumer with the information that formed 
the

[[Page 4170]]

basis of the summarized information given to the user.
    Section 609(a) generally requires a consumer reporting agency to 
provide a consumer with a file disclosure that, among other things, 
accurately reflects the information the consumer reporting agency 
provided or might provide to a user.\30\ For example, a consumer 
reporting agency must provide a file disclosure to the consumer that 
allows the consumer to see criminal history information in the format 
that users see or will see it, so that the consumer can check for any 
inaccuracies and exercise their rights to dispute any information that 
may be inaccurate as presented to users (such as duplicative listings 
for a single case).
---------------------------------------------------------------------------

    \30\ Note that the requirement in FCRA section 609(a)(1) that 
consumer reporting agencies disclose ``[a]ll information in the 
consumer's file at the time of the request'' is subject to 
exceptions. For example, section 609(a)(1)(B) does not require 
consumer reporting agencies to disclose to a consumer any 
information concerning credit scores or any other risk scores or 
predictors relating to the consumer. See 15 U.S.C. 1681g(a)(1)(B).
---------------------------------------------------------------------------

    Additionally, there are a number of situations under the FCRA where 
a consumer reporting agency must provide information that is not or 
would not be included in a user report when providing a file disclosure 
under FCRA section 609(a).\31\ One example of such a situation is when 
only summarized information, such as a credit or risk score, a tenant 
screening score, or a recommendation is provided to users. The CFPB 
interprets FCRA section 609(a)(1)'s requirement to disclose to the 
consumer ``all information in the consumer's file at the time of the 
request'' to include information that formed the basis of summarized 
information that a consumer reporting agency provided to a user. 
Providing only summarized information to users does not relieve a 
consumer reporting agency of its obligations under the plain language 
of section 609(a)(1) to provide to the consumer ``all information in 
the consumer's file at the time of the request.''
---------------------------------------------------------------------------

    \31\ See, e.g., 15 U.S.C. 1681g(a)(2) (requiring disclosure of 
the sources of the information).
---------------------------------------------------------------------------

    If a consumer reporting agency disclosed nothing to a consumer when 
it only provided summarized information to a user, the consumer would 
be unaware of the records upon which the summarized information was 
based, undermining the consumer's ability to exercise their right to 
dispute any incomplete or inaccurate information contained in their 
file.\32\ This would also be the case if a consumer reporting agency 
disclosed to a consumer the summarized information it provided to a 
user without also disclosing the underlying information in the file.
---------------------------------------------------------------------------

    \32\ 15 U.S.C. 1681i(a).
---------------------------------------------------------------------------

    The Bureau's interpretations regarding information required to be 
disclosed under section 609(a)(1) are consistent with the FCRA's 
purposes. When initially passing the FCRA, Congress stated that ``under 
this bill credit reporting agencies are required to make full 
disclosure to the consumer of all of the information obtained. The 
consumer will then be given the opportunity to correct inaccurate or 
misleading data.'' \33\ The FCRA provides consumers the right to 
dispute any incomplete or inaccurate information contained in the 
consumer's file.\34\ A consumer's ability to exercise this right is 
damaged if consumer reporting agencies withhold information that they 
are required to disclose under section 609(a)(1), including information 
that reveals inaccuracies in reports provided to users or information 
that forms the basis of summarized information (such as tenant 
screening scores). Withholding such information would also damage a 
consumer's ability to know when they are being impacted by adverse 
information in their file.
---------------------------------------------------------------------------

    \33\ 115 Cong. Rec. 33408, 33412 (1969). See also Selvam v. 
Experian Info. Sols., Inc., 651 F. App'x 29, 33 (2d Cir. 2016) 
(``The purpose of Sec.  1681g . . . is to enable consumers to obtain 
information in order to dispute any potential inaccuracies in the 
file so that inaccurate information is not sent to third 
parties.'').
    \34\ 15 U.S.C. 1681i(a).
---------------------------------------------------------------------------

3. Sources of Information Under FCRA Section 609(a)(2)
    Section 609(a) of the FCRA generally requires consumer reporting 
agencies to, upon request, disclose all information in the consumer's 
file at the time of the request and the sources of the information.\35\ 
The CFPB is aware that, in response to these consumer requests, some 
consumer reporting agencies are not disclosing all sources of an item 
of information in the consumer's file and instead have disclosed only 
one source of the item of information. For example, some consumer 
reporting agencies that acquire public record information (e.g., 
eviction proceeding records) from a vendor are only disclosing to 
consumers the jurisdiction that was the original source for these 
records (e.g., the county court). The Bureau continues to interpret 
FCRA section 609(a)(2)'s requirement to disclose ``the sources of the 
information'' to include both the original source and any intermediary 
or vendor source (or sources) that provide the item of information from 
the original source to the consumer reporting agency.
---------------------------------------------------------------------------

    \35\ 15 U.S.C. 1681g(a). FCRA section 609(a)(2) requires 
disclosure of ``[t]he sources of the information'' but provides that 
``the sources of information acquired solely for use in preparing an 
investigative consumer report and actually used for no other purpose 
need not be disclosed: Provided, That in the event an action is 
brought under this title, such sources shall be available to the 
plaintiff under appropriate discovery procedures in the court in 
which the action is brought.'' 15 U.S.C. 1681g(a)(2).
---------------------------------------------------------------------------

    The CFPB's interpretation is based on the plain language of FCRA 
section 609(a)(2) itself, which refers to ``sources'' in the plural. 
The statute does not limit this requirement to ``a source'' or ``the 
original source'' of the information.\36\ This interpretation is also 
consistent with the FTC's 40 Years Report, which states that ``CRAs 
must disclose the sources of information in the consumer's file, except 
for sources of information acquired solely for use in preparing an 
investigative consumer report.'' \37\
---------------------------------------------------------------------------

    \36\ Courts have found that all sources of the information must 
be disclosed to consumers. See, e.g., Clark v. Trans Union LLC, No. 
3:15cv391, 2016 WL 7197391, at *11 (E.D. Va. Dec. 9, 2016) (stating 
that ``TransUnion's argument that it properly disclosed the 
`ultimate sources' of information, but not the supposedly less 
pertinent LexisNexis disclosure as to how the data was collected, or 
by whom, does not persuade''); Dennis v. Trans Union, LLC, 2014 WL 
5325231, at *7 (E.D. Pa. Oct. 20, 2014) (stating that ``[a]s the 
plain language of Section 1681g(a)(2) does not limit `sources' in 
any way, the Court will not impose a limitation on the number of 
sources a CRA could have, and therefore be required to disclose, for 
a particular piece of information''). But see Shimon v. Equifax 
Info. Servs. LLC, 994 F.3d 88, 93 (2d Cir. 2021) (granting summary 
judgment to consumer reporting agency because not ``objectively 
unreasonable'' to fail to disclose third-party vendor as the source 
of information).
    \37\ Fed. Trade Comm'n, 40 Years of Experience With the Fair 
Credit Reporting Act: An FTC Staff Report With Summary of 
Interpretations, at 71 (2011). FTC staff published the 40 Years 
Report, an updated compilation of past FTC interpretations of the 
FCRA, to coincide with the transfer of authority to the Bureau. 
Effective July 21, 2011, the Dodd-Frank Act transferred rulemaking 
authority related to most of the FCRA to the Bureau, giving the 
Bureau the primary regulatory and interpretive roles under the FCRA.
---------------------------------------------------------------------------

    Additionally, and as described in part I.C.1, a consumer does not 
need to use specific language to trigger a consumer reporting agency's 
obligations under FCRA section 609(a)(2). As such, consumers do not 
need to specifically request that consumer reporting agencies identify 
all the sources of the information in their file in in order to be 
entitled to receive such information. This interpretation is consistent 
with the principle that the FCRA should be construed in light of its 
broad remedial purpose.\38\
---------------------------------------------------------------------------

    \38\ See supra note 5.
---------------------------------------------------------------------------

    The Bureau's interpretation also is consistent with the FCRA's 
purposes. Congress passed the FCRA in part to ``prevent consumers from 
being unjustly

[[Page 4171]]

damaged because of inaccurate or arbitrary information in a credit 
report.'' \39\ The FCRA achieves this by, among other things, providing 
consumers the right to obtain, upon request, all information in their 
file and the sources of that information and the right to dispute any 
incomplete or inaccurate information. The statutory right provided by 
FCRA section 609(a)(2) enables consumers to understand the true sources 
of any incomplete or inaccurate information in their file and helps 
them to address such errors more effectively.\40\ For example, many 
consumer reporting agencies, including background screening companies, 
obtain public records information from vendors. Vendors often provide 
only distilled versions of these records that do not contain all the 
information housed by the jurisdiction from which the records 
originated and sometimes contain mistakes or fail to include the most 
up-to-date status of the public records. If a consumer reporting agency 
discloses to a consumer only the original jurisdiction as the source of 
the information and does not also disclose the vendor, or conversely, 
if the consumer reporting agency discloses to a consumer only the 
vendor and does not also disclose the original source of the 
information, the consumer may not be able to correct any erroneous 
public records information that could be included in their files at all 
of the consumer reporting agencies that receive data from the 
vendor.\41\ Interpreting FCRA section 609(a)(2) to allow a consumer 
reporting agency to disclose to a consumer only a single source of the 
information, and not all sources of the information, would undermine 
the FCRA's purposes by limiting consumers' ability to understand the 
sources of the often highly sensitive information in their file and to 
address and prevent further dissemination of incomplete or inaccurate 
data.
---------------------------------------------------------------------------

    \39\ S. Rep. No. 91-517, at 1 (1969).
    \40\ Courts have recognized the importance of the disclosure of 
all sources for consumers to dispute inaccuracies and prevent the 
reoccurrence of inaccuracies. See, e.g., Clark v. Trans Union LLC, 
No. 3:15cv391, 2016 WL 7197391, at *11 (E.D. Va. Dec. 9, 2016) 
(stating that ``the omission of LexisNexis as a source deprived 
Clark of her congressionally-mandated right to correct the mistake 
with LexisNexis, or with anyone else to whom LexisNexis also may 
have disclosed the inaccurate information. Moreover, the failure to 
include LexisNexis in the report creates a material risk that 
LexisNexis could continue to report inaccurate information to others 
in the future.''); Leo v. AppFolio, Inc., No. 17-5771 RJB, 2018 WL 
623647, at *8 (W.D. Wash. Jan. 30, 2018) (noting that AppFolio's 
failure to properly identify the vendor who provided the data would 
make it harder for the plaintiff to correct the misreporting).
    \41\ See, e.g., Clark v. Trans Union LLC, No. 3:15cv391, 2016 WL 
7197391, at *11 (E.D. Va. Dec. 9, 2016); Leo v. AppFolio, Inc., No. 
17-5771 RJB, 2018 WL 623647, at *8 (W.D. Wash. Jan. 30, 2018).
---------------------------------------------------------------------------

    In addition to provisions authorizing Federal and State 
enforcement,\42\ the FCRA contains two provisions relating to civil 
liability to consumers for noncompliance. Section 617 provides that 
``any person who is negligent in failing to comply with any requirement 
imposed under this title with respect to any consumer is liable to that 
consumer in an amount equal to'' the consumer's actual damages, and 
costs and reasonable attorney's fees.\43\ Section 616 provides that 
``any person who willfully fails to comply with any requirement imposed 
under this title with respect to any consumer is liable to that 
consumer in an amount equal to'' actual or statutory damages of up to 
$1,000 per violation, such punitive damages as the court allows, and 
costs and reasonable attorney's fees.\44\ A violation is willful when 
it is inconsistent with ``authoritative guidance'' from a relevant 
agency.\45\ As with any guidance issued by the CFPB on the FCRA, or 
predecessor agencies that were responsible for administering the FCRA 
prior to the CFPB's creation, consumer reporting agencies risk 
liability under section 616 if they violate the FCRA in a manner 
described in this advisory opinion, regardless of whether the consumer 
reporting agencies were previously liable for willful violations prior 
to its issuance.
---------------------------------------------------------------------------

    \42\ 15 U.S.C. 1681s.
    \43\ 15 U.S.C. 1681o (emphasis added).
    \44\ 15 U.S.C. 1681n (emphasis added); Safeco Ins. Co. of Am. v. 
Burr, 551 U.S. 47, 57-58 (2007) (construing meaning of ``willful'').
    \45\ Safeco Ins. Co. of Am. v. Burr, 551 U.S. 47, 70 (2007); 
Fuges v. Sw. Fin. Servs., Ltd., 707 F.3d 241, 253 (3d Cir. 2012).
---------------------------------------------------------------------------

II. Regulatory Matters

    This advisory opinion is an interpretive rule issued under the 
Bureau's authority to interpret the FCRA, including under section 
1022(b)(1) of the Consumer Financial Protection Act of 2010,\46\ which 
authorizes guidance as may be necessary or appropriate to enable the 
Bureau to administer and carry out the purposes and objectives of 
Federal consumer financial laws.\47\
---------------------------------------------------------------------------

    \46\ Pub. L. 111-203, 124 Stat. 1376 (2010).
    \47\ 12 U.S.C. 5512(b)(1).
---------------------------------------------------------------------------

    The Bureau has determined that this advisory opinion does not 
impose any new or revise any existing recordkeeping, reporting, or 
disclosure requirements on covered entities or members of the public 
that would be collections of information requiring approval by the 
Office of Management and Budget under the Paperwork Reduction Act.\48\
---------------------------------------------------------------------------

    \48\ 44 U.S.C. 3501-3521.
---------------------------------------------------------------------------

    Pursuant to the Congressional Review Act,\49\ the Bureau will 
submit a report containing this interpretive rule and other required 
information to the United States Senate, the United States House of 
Representatives, and the Comptroller General of the United States prior 
to the rule's published effective date. The Office of Information and 
Regulatory Affairs has designated this interpretive rule as not a 
``major rule'' as defined by 5 U.S.C. 804(2).
---------------------------------------------------------------------------

    \49\ 5 U.S.C. 801 et seq.

Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2024-00786 Filed 1-22-24; 8:45 am]
BILLING CODE 4810-AM-P


</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>