Sec. 1681g. Disclosures to consumers

(a) Information on file; sources; report recipients
Every consumer reporting agency shall, upon request, and subject
to section 1681h(a)(1) of this title, clearly and accurately
disclose to the consumer:
(1) All information in the consumer's file at the time of the
request, except that -
(A) if the consumer to whom the file relates requests that the
first 5 digits of the social security number (or similar
identification number) of the consumer not be included in the
disclosure and the consumer reporting agency has received
appropriate proof of the identity of the requester, the consumer
reporting agency shall so truncate such number in such
disclosure; and
(B) nothing in this paragraph shall be construed to require a
consumer reporting agency to disclose to a consumer any
information concerning credit scores or any other risk scores or
predictors relating to the consumer.
(2) The sources of the information; except that the sources of
information acquired solely for use in preparing an investigative
consumer report and actually used for no other purpose need not be
disclosed: Provided, That in the event an action is brought under
this subchapter, such sources shall be available to the plaintiff
under appropriate discovery procedures in the court in which the
action is brought.
(3)(A) Identification of each person (including each end-user
identified under section 1681e(e)(1) of this title) that procured a
consumer report -
(i) for employment purposes, during the 2-year period preceding
the date on which the request is made; or
(ii) for any other purpose, during the 1-year period preceding
the date on which the request is made.
(B) An identification of a person under subparagraph (A) shall
include -
(i) the name of the person or, if applicable, the trade name
(written in full) under which such person conducts business; and
(ii) upon request of the consumer, the address and telephone
number of the person.
(C) Subparagraph (A) does not apply if -
(i) the end user is an agency or department of the United
States Government that procures the report from the person for
purposes of determining the eligibility of the consumer to whom
the report relates to receive access or continued access to
classified information (as defined in section 1681b(b)(4)(E)(i)
(!1) of this title); and
(ii) the head of the agency or department makes a written
finding as prescribed under section 1681b(b)(4)(A) of this title.
(4) The dates, original payees, and amounts of any checks upon
which is based any adverse characterization of the consumer,
included in the file at the time of the disclosure.
(5) A record of all inquiries received by the agency during the
1-year period preceding the request that identified the consumer in
connection with a credit or insurance transaction that was not
initiated by the consumer.
(6) If the consumer requests the credit file and not the credit
score, a statement that the consumer may request and obtain a
credit score.
(b) Exempt information
The requirements of subsection (a) of this section respecting the
disclosure of sources of information and the recipients of consumer
reports do not apply to information received or consumer reports
furnished prior to the effective date of this subchapter except to
the extent that the matter involved is contained in the files of
the consumer reporting agency on that date.
(c) Summary of rights to obtain and dispute information in consumer
reports and to obtain credit scores
(1) Commission summary of rights required
(A) In general
The Commission shall prepare a model summary of the rights of
consumers under this subchapter.
(B) Content of summary
The summary of rights prepared under subparagraph (A) shall
include a description of -
(i) the right of a consumer to obtain a copy of a consumer
report under subsection (a) of this section from each
consumer reporting agency;
(ii) the frequency and circumstances under which a consumer
is entitled to receive a consumer report without charge under
section 1681j of this title;
(iii) the right of a consumer to dispute information in the
file of the consumer under section 1681i of this title;
(iv) the right of a consumer to obtain a credit score from
a consumer reporting agency, and a description of how to
obtain a credit score;
(v) the method by which a consumer can contact, and obtain
a consumer report from, a consumer reporting agency without
charge, as provided in the regulations of the Commission
prescribed under section 211(c) (!1) of the Fair and Accurate
Credit Transactions Act of 2003; and
(vi) the method by which a consumer can contact, and obtain
a consumer report from, a consumer reporting agency described
in section 1681a(w) of this title, as provided in the
regulations of the Commission prescribed under section
1681j(a)(1)(C) of this title.
(C) Availability of summary of rights
The Commission shall -
(i) actively publicize the availability of the summary of
rights prepared under this paragraph;
(ii) conspicuously post on its Internet website the
availability of such summary of rights; and
(iii) promptly make such summary of rights available to
consumers, on request.
(2) Summary of rights required to be included with agency
disclosures
A consumer reporting agency shall provide to a consumer, with
each written disclosure by the agency to the consumer under this
section -
(A) the summary of rights prepared by the Commission under
paragraph (1);
(B) in the case of a consumer reporting agency described in
section 1681a(p) of this title, a toll-free telephone number
established by the agency, at which personnel are accessible to
consumers during normal business hours;
(C) a list of all Federal agencies responsible for enforcing
any provision of this subchapter, and the address and any
appropriate phone number of each such agency, in a form that
will assist the consumer in selecting the appropriate agency;
(D) a statement that the consumer may have additional rights
under State law, and that the consumer may wish to contact a
State or local consumer protection agency or a State attorney
general (or the equivalent thereof) to learn of those rights;
and
(E) a statement that a consumer reporting agency is not
required to remove accurate derogatory information from the
file of a consumer, unless the information is outdated under
section 1681c of this title or cannot be verified.
(d) Summary of rights of identity theft victims
(1) In general
The Commission, in consultation with the Federal banking
agencies and the National Credit Union Administration, shall
prepare a model summary of the rights of consumers under this
subchapter with respect to the procedures for remedying the
effects of fraud or identity theft involving credit, an
electronic fund transfer, or an account or transaction at or with
a financial institution or other creditor.
(2) Summary of rights and contact information
Beginning 60 days after the date on which the model summary of
rights is prescribed in final form by the Commission pursuant to
paragraph (1), if any consumer contacts a consumer reporting
agency and expresses a belief that the consumer is a victim of
fraud or identity theft involving credit, an electronic fund
transfer, or an account or transaction at or with a financial
institution or other creditor, the consumer reporting agency
shall, in addition to any other action that the agency may take,
provide the consumer with a summary of rights that contains all
of the information required by the Commission under paragraph
(1), and information on how to contact the Commission to obtain
more detailed information.
(e) Information available to victims
(1) In general
For the purpose of documenting fraudulent transactions
resulting from identity theft, not later than 30 days after the
date of receipt of a request from a victim in accordance with
paragraph (3), and subject to verification of the identity of the
victim and the claim of identity theft in accordance with
paragraph (2), a business entity that has provided credit to,
provided for consideration products, goods, or services to,
accepted payment from, or otherwise entered into a commercial
transaction for consideration with, a person who has allegedly
made unauthorized use of the means of identification of the
victim, shall provide a copy of application and business
transaction records in the control of the business entity,
whether maintained by the business entity or by another person on
behalf of the business entity, evidencing any transaction alleged
to be a result of identity theft to -
(A) the victim;
(B) any Federal, State, or local government law enforcement
agency or officer specified by the victim in such a request; or
(C) any law enforcement agency investigating the identity
theft and authorized by the victim to take receipt of records
provided under this subsection.
(2) Verification of identity and claim
Before a business entity provides any information under
paragraph (1), unless the business entity, at its discretion,
otherwise has a high degree of confidence that it knows the
identity of the victim making a request under paragraph (1), the
victim shall provide to the business entity -
(A) as proof of positive identification of the victim, at the
election of the business entity -
(i) the presentation of a government-issued identification
card;
(ii) personally identifying information of the same type as
was provided to the business entity by the unauthorized
person; or
(iii) personally identifying information that the business
entity typically requests from new applicants or for new
transactions, at the time of the victim's request for
information, including any documentation described in clauses
(i) and (ii); and
(B) as proof of a claim of identity theft, at the election of
the business entity -
(i) a copy of a police report evidencing the claim of the
victim of identity theft; and
(ii) a properly completed -
(I) copy of a standardized affidavit of identity theft
developed and made available by the Commission; or
(II) an (!2) affidavit of fact that is acceptable to the
business entity for that purpose.
(3) Procedures
The request of a victim under paragraph (1) shall -
(A) be in writing;
(B) be mailed to an address specified by the business entity,
if any; and
(C) if asked by the business entity, include relevant
information about any transaction alleged to be a result of
identity theft to facilitate compliance with this section
including -
(i) if known by the victim (or if readily obtainable by the
victim), the date of the application or transaction; and
(ii) if known by the victim (or if readily obtainable by
the victim), any other identifying information such as an
account or transaction number.
(4) No charge to victim
Information required to be provided under paragraph (1) shall
be so provided without charge.
(5) Authority to decline to provide information
A business entity may decline to provide information under
paragraph (1) if, in the exercise of good faith, the business
entity determines that -
(A) this subsection does not require disclosure of the
information;
(B) after reviewing the information provided pursuant to
paragraph (2), the business entity does not have a high degree
of confidence in knowing the true identity of the individual
requesting the information;
(C) the request for the information is based on a
misrepresentation of fact by the individual requesting the
information relevant to the request for information; or
(D) the information requested is Internet navigational data
or similar information about a person's visit to a website or
online service.
(6) Limitation on liability
Except as provided in section 1681s of this title, sections
1681n and 1681o of this title do not apply to any violation of
this subsection.
(7) Limitation on civil liability
No business entity may be held civilly liable under any
provision of Federal, State, or other law for disclosure, made in
good faith pursuant to this subsection.
(8) No new recordkeeping obligation
Nothing in this subsection creates an obligation on the part of
a business entity to obtain, retain, or maintain information or
records that are not otherwise required to be obtained, retained,
or maintained in the ordinary course of its business or under
other applicable law.
(9) Rule of construction
(A) In general
No provision of subtitle A of title V of Public Law 106-102
[15 U.S.C. 6801 et seq.], prohibiting the disclosure of
financial information by a business entity to third parties
shall be used to deny disclosure of information to the victim
under this subsection.
(B) Limitation
Except as provided in subparagraph (A), nothing in this
subsection permits a business entity to disclose information,
including information to law enforcement under subparagraphs
(B) and (C) of paragraph (1), that the business entity is
otherwise prohibited from disclosing under any other applicable
provision of Federal or State law.
(10) Affirmative defense
In any civil action brought to enforce this subsection, it is
an affirmative defense (which the defendant must establish by a
preponderance of the evidence) for a business entity to file an
affidavit or answer stating that -
(A) the business entity has made a reasonably diligent search
of its available business records; and
(B) the records requested under this subsection do not exist
or are not reasonably available.
(11) Definition of victim
For purposes of this subsection, the term "victim" means a
consumer whose means of identification or financial information
has been used or transferred (or has been alleged to have been
used or transferred) without the authority of that consumer, with
the intent to commit, or to aid or abet, an identity theft or a
similar crime.
(12) Effective date
This subsection shall become effective 180 days after December
4, 2003.
(13) Effectiveness study
Not later than 18 months after December 4, 2003, the
Comptroller General of the United States shall submit a report to
Congress assessing the effectiveness of this provision.
(f) Disclosure of credit scores
(1) In general
Upon the request of a consumer for a credit score, a consumer
reporting agency shall supply to the consumer a statement
indicating that the information and credit scoring model may be
different than the credit score that may be used by the lender,
and a notice which shall include -
(A) the current credit score of the consumer or the most
recent credit score of the consumer that was previously
calculated by the credit reporting agency for a purpose related
to the extension of credit;
(B) the range of possible credit scores under the model used;
(C) all of the key factors that adversely affected the credit
score of the consumer in the model used, the total number of
which shall not exceed 4, subject to paragraph (9);
(D) the date on which the credit score was created; and
(E) the name of the person or entity that provided the credit
score or credit file upon which the credit score was created.
(2) Definitions
For purposes of this subsection, the following definitions
shall apply:
(A) Credit score
The term "credit score" -
(i) means a numerical value or a categorization derived
from a statistical tool or modeling system used by a person
who makes or arranges a loan to predict the likelihood of
certain credit behaviors, including default (and the
numerical value or the categorization derived from such
analysis may also be referred to as a "risk predictor" or
"risk score"); and
(ii) does not include -
(I) any mortgage score or rating of an automated
underwriting system that considers one or more factors in
addition to credit information, including the loan to value
ratio, the amount of down payment, or the financial assets
of a consumer; or
(II) any other elements of the underwriting process or
underwriting decision.
(B) Key factors
The term "key factors" means all relevant elements or reasons
adversely affecting the credit score for the particular
individual, listed in the order of their importance based on
their effect on the credit score.
(3) Timeframe and manner of disclosure
The information required by this subsection shall be provided
in the same timeframe and manner as the information described in
subsection (a) of this section.
(4) Applicability to certain uses
This subsection shall not be construed so as to compel a
consumer reporting agency to develop or disclose a score if the
agency does not -
(A) distribute scores that are used in connection with
residential real property loans; or
(B) develop scores that assist credit providers in
understanding the general credit behavior of a consumer and
predicting the future credit behavior of the consumer.
(5) Applicability to credit scores developed by another person
(A) In general
This subsection shall not be construed to require a consumer
reporting agency that distributes credit scores developed by
another person or entity to provide a further explanation of
them, or to process a dispute arising pursuant to section 1681i
of this title, except that the consumer reporting agency shall
provide the consumer with the name and address and website for
contacting the person or entity who developed the score or
developed the methodology of the score.
(B) Exception
This paragraph shall not apply to a consumer reporting agency
that develops or modifies scores that are developed by another
person or entity.
(6) Maintenance of credit scores not required
This subsection shall not be construed to require a consumer
reporting agency to maintain credit scores in its files.
(7) Compliance in certain cases
In complying with this subsection, a consumer reporting agency
shall -
(A) supply the consumer with a credit score that is derived
from a credit scoring model that is widely distributed to users
by that consumer reporting agency in connection with
residential real property loans or with a credit score that
assists the consumer in understanding the credit scoring
assessment of the credit behavior of the consumer and
predictions about the future credit behavior of the consumer;
and
(B) a statement indicating that the information and credit
scoring model may be different than that used by the lender.
(8) Fair and reasonable fee
A consumer reporting agency may charge a fair and reasonable
fee, as determined by the Commission, for providing the
information required under this subsection.
(9) Use of enquiries as a key factor
If a key factor that adversely affects the credit score of a
consumer consists of the number of enquiries made with respect to
a consumer report, that factor shall be included in the
disclosure pursuant to paragraph (1)(C) without regard to the
numerical limitation in such paragraph.
(g) Disclosure of credit scores by certain mortgage lenders
(1) In general
Any person who makes or arranges loans and who uses a consumer
credit score, as defined in subsection (f) of this section, in
connection with an application initiated or sought by a consumer
for a closed end loan or the establishment of an open end loan
for a consumer purpose that is secured by 1 to 4 units of
residential real property (hereafter in this subsection referred
to as the "lender") shall provide the following to the consumer
as soon as reasonably practicable:
(A) Information required under subsection (f)
(i) In general
A copy of the information identified in subsection (f) of
this section that was obtained from a consumer reporting
agency or was developed and used by the user of the
information.
(ii) Notice under subparagraph (D)
In addition to the information provided to it by a third
party that provided the credit score or scores, a lender is
only required to provide the notice contained in subparagraph
(D).
(B) Disclosures in case of automated underwriting system
(i) In general
If a person that is subject to this subsection uses an
automated underwriting system to underwrite a loan, that
person may satisfy the obligation to provide a credit score
by disclosing a credit score and associated key factors
supplied by a consumer reporting agency.
(ii) Numerical credit score
However, if a numerical credit score is generated by an
automated underwriting system used by an enterprise, and that
score is disclosed to the person, the score shall be
disclosed to the consumer consistent with subparagraph (C).
(iii) Enterprise defined
For purposes of this subparagraph, the term "enterprise"
has the same meaning as in paragraph (6) of section 4502 of
title 12.
(C) Disclosures of credit scores not obtained from a consumer
reporting agency
A person that is subject to the provisions of this subsection
and that uses a credit score, other than a credit score
provided by a consumer reporting agency, may satisfy the
obligation to provide a credit score by disclosing a credit
score and associated key factors supplied by a consumer
reporting agency.
(D) Notice to home loan applicants
A copy of the following notice, which shall include the name,
address, and telephone number of each consumer reporting agency
providing a credit score that was used:

"NOTICE TO THE HOME LOAN APPLICANT
"In connection with your application for a home loan, the lender
must disclose to you the score that a consumer reporting agency
distributed to users and the lender used in connection with your
home loan, and the key factors affecting your credit scores.
"The credit score is a computer generated summary calculated at
the time of the request and based on information that a consumer
reporting agency or lender has on file. The scores are based on
data about your credit history and payment patterns. Credit scores
are important because they are used to assist the lender in
determining whether you will obtain a loan. They may also be used
to determine what interest rate you may be offered on the mortgage.
Credit scores can change over time, depending on your conduct, how
your credit history and payment patterns change, and how credit
scoring technologies change.
"Because the score is based on information in your credit
history, it is very important that you review the credit-related
information that is being furnished to make sure it is accurate.
Credit records may vary from one company to another.
"If you have questions about your credit score or the credit
information that is furnished to you, contact the consumer
reporting agency at the address and telephone number provided with
this notice, or contact the lender, if the lender developed or
generated the credit score. The consumer reporting agency plays no
part in the decision to take any action on the loan application and
is unable to provide you with specific reasons for the decision on
a loan application.
"If you have questions concerning the terms of the loan, contact
the lender.".
(E) Actions not required under this subsection
This subsection shall not require any person to -
(i) explain the information provided pursuant to subsection
(f) of this section;
(ii) disclose any information other than a credit score or
key factors, as defined in subsection (f) of this section;
(iii) disclose any credit score or related information
obtained by the user after a loan has closed;
(iv) provide more than 1 disclosure per loan transaction;
or
(v) provide the disclosure required by this subsection when
another person has made the disclosure to the consumer for
that loan transaction.
(F) No obligation for content
(i) In general
The obligation of any person pursuant to this subsection
shall be limited solely to providing a copy of the
information that was received from the consumer reporting
agency.
(ii) Limit on liability
No person has liability under this subsection for the
content of that information or for the omission of any
information within the report provided by the consumer
reporting agency.
(G) Person defined as excluding enterprise
As used in this subsection, the term "person" does not
include an enterprise (as defined in paragraph (6) of section
4502 of title 12).
(2) Prohibition on disclosure clauses null and void
(A) In general
Any provision in a contract that prohibits the disclosure of
a credit score by a person who makes or arranges loans or a
consumer reporting agency is void.
(B) No liability for disclosure under this subsection
A lender shall not have liability under any contractual
provision for disclosure of a credit score pursuant to this
subsection.

AMENDMENTS
2003 - Subsec. (a)(1). Pub. L. 108-159, Sec. 115, substituted
"except that -
"(A) if the consumer to whom the file relates requests that the
first 5 digits of the social security number (or similar
identification number) of the consumer not be included in the
disclosure and the consumer reporting agency has received
appropriate proof of the identity of the requester, the consumer
reporting agency shall so truncate such number in such
disclosure; and
"(B) nothing"
for "except that nothing".
Subsec. (a)(2), (3)(C). Pub. L. 108-159, Sec. 811(d), realigned
margins.
Subsec. (a)(6). Pub. L. 108-159, Sec. 212(a), added par. (6).
Subsec. (c). Pub. L. 108-159, Sec. 211(c), amended subsec. (c)
generally. Prior to amendment, subsec. (c) related to the summary
of rights required to be included with disclosure to consumers by
consumer reporting agencies.
Subsecs. (d), (e). Pub. L. 108-159, Sec. 151(a)(1), added
subsecs. (d) and (e).
Subsec. (f). Pub. L. 108-159, Sec. 212(b), added subsec. (f).
Subsec. (g). Pub. L. 108-159, Sec. 212(c), added subsec. (g).
1998 - Subsec. (a)(3)(C). Pub. L. 105-347 added subpar. (C).
1996 - Subsec. (a). Pub. L. 104-208, Sec. 2408(e)(5)(A), in
introductory provisions substituted ", and subject to section
1681h(a)(1) of this title" for "and proper identification of any
consumer".
Subsec. (a)(1). Pub. L. 104-208, Sec. 2408(a), amended par. (1)
generally. Prior to amendment, par. (1) read as follows: "The
nature and substance of all information (except medical
information) in its files on the consumer at the time of the
request."
Subsec. (a)(3). Pub. L. 104-208, Sec. 2408(b), amended par. (3)
generally. Prior to amendment, par. (3) read as follows: "The
recipients of any consumer report on the consumer which it has
furnished -
"(A) for employment purposes within the two-year period
preceding the request, and
"(B) for any other purpose within the six-month period
preceding the request."
Subsec. (a)(5). Pub. L. 104-208, Sec. 2408(c), added par. (5).
Subsec. (c). Pub. L. 104-208, Sec. 2408(d)(1), added subsec. (c).
1994 - Subsec. (a)(4). Pub. L. 103-325 added par. (4).
EFFECTIVE DATE OF 2003 AMENDMENT
Amendment by Pub. L. 108-159 subject to joint regulations
establishing effective dates as prescribed by Federal Reserve Board
and Federal Trade Commission, except as otherwise provided, see
section 3 of Pub. L. 108-159, set out as a note under section 1681
of this title.
EFFECTIVE DATE OF 1998 AMENDMENT
Amendment by Pub. L. 105-347 deemed to have same effective date
as amendments made by section 2403 of Pub. L. 104-208, see section
7 of Pub. L. 105-347, set out as a note under section 1681a of this
title.
EFFECTIVE DATE OF 1996 AMENDMENT
Amendment by Pub. L. 104-208 effective 365 days after Sept. 30,
1996, with special rule for early compliance, see section 2420 of
Pub. L. 104-208, set out as a note under section 1681a of this
title.
SIMPLIFIED DISCLOSURE TO MAXIMIZE COMPREHENSIBILITY AND
STANDARDIZATION
Section 2408(e)(2), (3) of div. A of Pub. L. 104-208 provided
that:
"(2) Simplified disclosure. - Not later than 90 days after the
date of enactment of this Act [Sept. 30, 1996], each consumer
reporting agency shall develop a form on which such consumer
reporting agency shall make the disclosures required under section
609(a) of the Fair Credit Reporting Act [15 U.S.C. 1681g(a)], for
the purpose of maximizing the comprehensibility and standardization
of such disclosures.
"(3) Goals. - The Federal Trade Commission shall take appropriate
action to assure that the goals of comprehensibility and
standardization are achieved in accordance with paragraph (2)."