Fair Credit Reporting; File Disclosure (2024)

The Bureau is issuing this advisory opinion through the procedures for its Advisory Opinions Policy.^[1] Refer to those procedures for more information.

I. Advisory Opinion

A. Background

The FCRA regulates consumer reporting.^[2] Congress enacted the statute “to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy.” ^[3] One of the problems with the credit reporting industry that Congress recognized and sought to remedy with the FCRA was that a consumer “is not always given access to the information in [their] file.” ^[4] In light of its broad remedial and consumer protection purposes, courts have recognized that the FCRA “must be read in a liberal manner in order to effectuate the congressional intent underlying it.” ^[5]

The FCRA also promotes transparency of the credit reporting system to consumers in many ways, including by generally requiring that consumer reporting agencies disclose to consumers all information in their file upon request. Under section 609(a), a consumer reporting agency must, upon request, clearly and accurately disclose to the consumer “[a]ll information in the consumer's file at the time of the request” and “[t]he sources of the information.” ^[6] This requirement applies to all consumer reporting agencies.^[7] Consumers are entitled to free file disclosures in many circ*mstances. For example, each nationwide consumer reporting agency and nationwide specialty consumer reporting agency, including any nationwide tenant screening or employment background screening company, must provide at ( print page 4168) least one free file disclosure annually.^[8] Consumers also are entitled to free file disclosures in certain other circ*mstances, such as in connection with adverse action notices and fraud alerts.^[9]

The FCRA defines a consumer's “file” as “all of the information on that consumer that is recorded and retained by a consumer reporting agency, regardless of how the information is stored.” ^[10] Consumer reporting agencies possess files on hundreds of millions of Americans. These files typically include information about, among other things, a consumer's credit, criminal, employment, and rental histories. Consumer reporting agencies may obtain this information from multiple sources, including companies that provide information about their direct experiences with consumers and third parties who gather information from courts and other sources of public records.^[11] Errors by a furnisher or a third-party source can affect a consumer's file at many different consumer reporting agencies.^[12] Consumer reporting agencies use the information in consumer files to produce and sell consumer reports,^[13] which creditors, insurers, landlords, employers, and others who have a permissible purpose use to make eligibility and other decisions about consumers. The potential for the vast quantity of information contained in consumer files to include errors poses significant risks to accuracy, fairness, and consumer privacy in the consumer reporting system.

Section 609(a)'s file disclosure requirements are central to the statute's accuracy, fairness, and privacy purposes. Consumers have a right to see the information consumer reporting agencies keep about them in their files at any time. Absent file disclosure requirements, a consumer may not be able to review their file, determine whether it contains any incomplete or inaccurate information, and, if it does, file a dispute under FCRA sections 611 and 623, and have the information corrected or deleted.^[14] Disclosure of the information in a consumer's file upon request is a critical component of the FCRA's carefully calibrated dispute provisions.^[15] Moreover, file disclosure also promotes the FCRA's fairness purpose by enabling consumers to identify any negative information in their files that may be used to make credit and other eligibility determinations about them and take steps to improve their credit profiles.^[16]

Consumers may suffer significant harm when they are unable to obtain all information in their files upon request. Without access to all information in their file, a consumer often cannot even take the initial steps to dispute inaccurate information in their consumer reports or take well-informed action to improve their credit profile. Disputing inaccurate information on a consumer report and improving one's credit profile, often challenging and time-consuming processes for consumers, are made even more difficult when consumers do not have access to all of the information in their file. For example, if a consumer identifies an error in an item of information in their file, but the consumer reporting agency has only disclosed to the consumer the original source of the information and not also the vendor source that directly provided the information to the consumer reporting agency and from which the error arose, the consumer would not be able to identify the source of the erroneous information and may not be able to correct it.^[17]

The CFPB is issuing this advisory opinion to highlight certain file disclosure requirements imposed under FCRA section 609(a). First, this advisory opinion underscores that, to trigger a consumer reporting agency's file disclosure requirement under FCRA section 609(a), a consumer does not need to use specific language, such as “complete file” or “file.” Next, this advisory opinion highlights the requirements regarding the information that must be disclosed to a consumer under FCRA section 609(a). Finally, this advisory opinion affirms that consumer reporting agencies must disclose to a consumer both the original source and any intermediary or vendor source (or sources) that provide the item of information to the consumer reporting agency under FCRA section 609(a).

B. Coverage

This advisory opinion applies to all “consumer reporting agencies,” as that term is defined in FCRA section 603(f).

C. Legal Analysis

1. Requests Under FCRA Section 609(a)

Section 609(a) of the FCRA provides, with certain exceptions, that “[e]very consumer reporting agency shall, upon request . . . clearly and accurately disclose to the consumer, among other things: (1) All information in the consumer's file at the time of the request . . .; and (2) The sources of the information.” Section 610 in turn specifies the conditions and form of ( print page 4169) disclosures to consumers. The Bureau is aware that some industry stakeholders have taken the position that consumers must use specific language in order to request file disclosures under section 609(a), such as the term “complete file.” ^[18] As the Third Circuit recently held, such requirements contravene the FCRA.^[19] The CFPB interprets the FCRA to require consumer reporting agencies to provide a file disclosure upon receipt of a “request” from a consumer who provides proper identification even if the consumer does not use the specific term “request,” “file,” “complete file,” or any other specific words in making such a request.

To obtain a file disclosure, the FCRA does not require consumers to use any specific language. Instead, the statute requires consumers to do two things: make a “request” and provide proper identification.^[20] Once these conditions are satisfied, FCRA section 609(a) states that a consumer reporting agency “shall” provide the file disclosure. The statute's use of “shall” in this context makes clear that a consumer reporting agency may not add additional conditions as a prerequisite to complying with section 609(a).^[21]

The statute does not define the term “request” as used in section 609(a). In construing the term's meaning, the Bureau is guided by the statute's broad remedial purposes.^[22] As noted above, it is clear that one of Congress's goals in the FCRA was to facilitate consumers' access to their own information and, through such access, to promote the accuracy, privacy, and fairness of the consumer reporting system.^[23] These goals would be thwarted if a consumer's right to a file disclosure depended upon the use of specific words—particularly since no such requirement appears in the statute and because consumers are unlikely to know which words any particular consumer reporting agency expects to hear before honoring its file disclosure obligations. As the Third Circuit explained, if the FCRA were read otherwise:

[C]onsumers could only access their files pursuant to [section 609(a)] if they are familiar with the esoteric distinction between “files” and “consumer reports” in the Definitions section of the FCRA. Construing [section 609(a)] in this way would severely limit consumers' “access to . . . information in [their] file” and frustrate their ability to know when they are “being damaged by an adverse credit report,” or to “correct[] inaccurate information” in their report.^[24]

Thus, to obtain a file disclosure under section 609(a), a consumer need not specifically request “[a]ll information in the consumer's file” or request a “complete file” or even use the word “file.” For example, a consumer's request to a consumer reporting agency for a “report” or “credit report” or “consumer report” or “file” or “record,” along with proper identification, trigger a consumer reporting agency's obligation under section 609(a).

The CFPB's interpretation of section 609(a)—that consumers do not need to use the words “file” or “complete file” to invoke their right to a file disclosure—is consistent with the way Congress itself refers to section 609(a) requests in parts of the FCRA. Although section 609(a) requires disclosure of all information in the consumer's “file” (with only limited, specified exceptions), Congress used the term “consumer report” as a short-hand term for the disclosures required by section 609(a) in some sections that refer to consumer requests and consumer-facing materials.^[25] For example, FCRA section 609(c)(1)(B)(i) requires that the Summary of Rights provided to consumers include a description of “the right of the consumer to obtain a copy of a consumer report under [FCRA section 609(a)].” ^[26] Similarly, FCRA section 612(a)(1), which requires nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies to “make all disclosures pursuant to section [609(a)]” available for free annually, later refers to such file disclosures as “consumer reports” when it refers to a “streamlined process for consumers to request consumer reports under [FCRA section 612(a)(1)(A)].” ^[27]

2. Information Required To Be Disclosed Under FCRA Section 609(a)(1)

Section 609(a) of the FCRA generally requires consumer reporting agencies to, upon request, “clearly and accurately” disclose “all information in the consumer's file at the time of the request.” To meet this standard, a file disclosure must be understandable to the average consumer.^[28] It must assist a consumer in identifying inaccuracies in their file, exercising their rights to dispute any incomplete or inaccurate information, and knowing when they are being impacted by adverse information in their file.^[29]

Some consumers are experiencing difficulty in obtaining clear, accurate, and complete file disclosures, particularly from background screening companies. As discussed below, in this advisory opinion the Bureau is highlighting that (1) section 609(a)(1) of the FCRA requires that a consumer reporting agency clearly and accurately disclose to a consumer all information in the consumer's file at the time of the request, including, among other things, all information the consumer reporting agency provided or might provide to a user, and (2) when a consumer reporting agency provides only summarized information to a user, section 609(a)(1) of the FCRA requires that the consumer reporting agency provide the consumer with the information that formed the ( print page 4170) basis of the summarized information given to the user.

Section 609(a) generally requires a consumer reporting agency to provide a consumer with a file disclosure that, among other things, accurately reflects the information the consumer reporting agency provided or might provide to a user.^[30] For example, a consumer reporting agency must provide a file disclosure to the consumer that allows the consumer to see criminal history information in the format that users see or will see it, so that the consumer can check for any inaccuracies and exercise their rights to dispute any information that may be inaccurate as presented to users (such as duplicative listings for a single case).

Additionally, there are a number of situations under the FCRA where a consumer reporting agency must provide information that is not or would not be included in a user report when providing a file disclosure under FCRA section 609(a).^[31] One example of such a situation is when only summarized information, such as a credit or risk score, a tenant screening score, or a recommendation is provided to users. The CFPB interprets FCRA section 609(a)(1)'s requirement to disclose to the consumer “all information in the consumer's file at the time of the request” to include information that formed the basis of summarized information that a consumer reporting agency provided to a user. Providing only summarized information to users does not relieve a consumer reporting agency of its obligations under the plain language of section 609(a)(1) to provide to the consumer “all information in the consumer's file at the time of the request.”

If a consumer reporting agency disclosed nothing to a consumer when it only provided summarized information to a user, the consumer would be unaware of the records upon which the summarized information was based, undermining the consumer's ability to exercise their right to dispute any incomplete or inaccurate information contained in their file.^[32] This would also be the case if a consumer reporting agency disclosed to a consumer the summarized information it provided to a user without also disclosing the underlying information in the file.

The Bureau's interpretations regarding information required to be disclosed under section 609(a)(1) are consistent with the FCRA's purposes. When initially passing the FCRA, Congress stated that “under this bill credit reporting agencies are required to make full disclosure to the consumer of all of the information obtained. The consumer will then be given the opportunity to correct inaccurate or misleading data.” ^[33] The FCRA provides consumers the right to dispute any incomplete or inaccurate information contained in the consumer's file.^[34] A consumer's ability to exercise this right is damaged if consumer reporting agencies withhold information that they are required to disclose under section 609(a)(1), including information that reveals inaccuracies in reports provided to users or information that forms the basis of summarized information (such as tenant screening scores). Withholding such information would also damage a consumer's ability to know when they are being impacted by adverse information in their file.

3. Sources of Information Under FCRA Section 609(a)(2)

Section 609(a) of the FCRA generally requires consumer reporting agencies to, upon request, disclose all information in the consumer's file at the time of the request and the sources of the information.^[35] The CFPB is aware that, in response to these consumer requests, some consumer reporting agencies are not disclosing all sources of an item of information in the consumer's file and instead have disclosed only one source of the item of information. For example, some consumer reporting agencies that acquire public record information ( e.g., eviction proceeding records) from a vendor are only disclosing to consumers the jurisdiction that was the original source for these records ( e.g., the county court). The Bureau continues to interpret FCRA section 609(a)(2)'s requirement to disclose “the sources of the information” to include both the original source and any intermediary or vendor source (or sources) that provide the item of information from the original source to the consumer reporting agency.

The CFPB's interpretation is based on the plain language of FCRA section 609(a)(2) itself, which refers to “sources” in the plural. The statute does not limit this requirement to “a source” or “the original source” of the information.^[36] This interpretation is also consistent with the FTC's 40 Years Report, which states that “CRAs must disclose the sources of information in the consumer's file, except for sources of information acquired solely for use in preparing an investigative consumer report.” ^[37]

Additionally, and as described in part I.C.1, a consumer does not need to use specific language to trigger a consumer reporting agency's obligations under FCRA section 609(a)(2). As such, consumers do not need to specifically request that consumer reporting agencies identify all the sources of the information in their file in in order to be entitled to receive such information. This interpretation is consistent with the principle that the FCRA should be construed in light of its broad remedial purpose.^[38]

The Bureau's interpretation also is consistent with the FCRA's purposes. Congress passed the FCRA in part to “prevent consumers from being unjustly ( print page 4171) damaged because of inaccurate or arbitrary information in a credit report.” ^[39] The FCRA achieves this by, among other things, providing consumers the right to obtain, upon request, all information in their file and the sources of that information and the right to dispute any incomplete or inaccurate information. The statutory right provided by FCRA section 609(a)(2) enables consumers to understand the true sources of any incomplete or inaccurate information in their file and helps them to address such errors more effectively.^[40] For example, many consumer reporting agencies, including background screening companies, obtain public records information from vendors. Vendors often provide only distilled versions of these records that do not contain all the information housed by the jurisdiction from which the records originated and sometimes contain mistakes or fail to include the most up-to-date status of the public records. If a consumer reporting agency discloses to a consumer only the original jurisdiction as the source of the information and does not also disclose the vendor, or conversely, if the consumer reporting agency discloses to a consumer only the vendor and does not also disclose the original source of the information, the consumer may not be able to correct any erroneous public records information that could be included in their files at all of the consumer reporting agencies that receive data from the vendor.^[41] Interpreting FCRA section 609(a)(2) to allow a consumer reporting agency to disclose to a consumer only a single source of the information, and not all sources of the information, would undermine the FCRA's purposes by limiting consumers' ability to understand the sources of the often highly sensitive information in their file and to address and prevent further dissemination of incomplete or inaccurate data.

In addition to provisions authorizing Federal and State enforcement,^[42] the FCRA contains two provisions relating to civil liability to consumers for noncompliance. Section 617 provides that “any person who is negligent in failing to comply with any requirement imposed under this title with respect to any consumer is liable to that consumer in an amount equal to” the consumer's actual damages, and costs and reasonable attorney's fees.^[43] Section 616 provides that “any person who willfully fails to comply with any requirement imposed under this title with respect to any consumer is liable to that consumer in an amount equal to” actual or statutory damages of up to $1,000 per violation, such punitive damages as the court allows, and costs and reasonable attorney's fees.^[44] A violation is willful when it is inconsistent with “authoritative guidance” from a relevant agency.^[45] As with any guidance issued by the CFPB on the FCRA, or predecessor agencies that were responsible for administering the FCRA prior to the CFPB's creation, consumer reporting agencies risk liability under section 616 if they violate the FCRA in a manner described in this advisory opinion, regardless of whether the consumer reporting agencies were previously liable for willful violations prior to its issuance.

II. Regulatory Matters

This advisory opinion is an interpretive rule issued under the Bureau's authority to interpret the FCRA, including under section 1022(b)(1) of the Consumer Financial Protection Act of 2010,^[46] which authorizes guidance as may be necessary or appropriate to enable the Bureau to administer and carry out the purposes and objectives of Federal consumer financial laws.^[47]

The Bureau has determined that this advisory opinion does not impose any new or revise any existing recordkeeping, reporting, or disclosure requirements on covered entities or members of the public that would be collections of information requiring approval by the Office of Management and Budget under the Paperwork Reduction Act.^[48]

Pursuant to the Congressional Review Act,^[49] the Bureau will submit a report containing this interpretive rule and other required information to the United States Senate, the United States House of Representatives, and the Comptroller General of the United States prior to the rule's published effective date. The Office of Information and Regulatory Affairs has designated this interpretive rule as not a “major rule” as defined by 5 U.S.C. 804(2).