Free Annual File Disclosures

Federal RegisterJun 24, 2004

Ask Donna

What actually matters in this document.

Text

FEDERAL TRADE COMMISSION

16 CFR Parts 610 and 698

RIN 3084-AA94

Free Annual File Disclosures

AGENCY:

Federal Trade Commission (FTC or Commission).

ACTION:

Final Rule.

SUMMARY:

The Fair and Accurate Credit Transactions Act of 2003 (FACT Act or the Act) requires the FTC to adopt regulations to require the establishment of a centralized source through which consumers may request a free annual file disclosure from each nationwide consumer reporting agency; a standardized form for such requests; and a streamlined process for consumers to request free annual file disclosures from nationwide specialty consumer reporting agencies. This final rule implements these requirements.

EFFECTIVE DATE:

This rule is effective on December 1, 2004.

FOR FURTHER INFORMATION CONTACT:

Helen Goff Foster or Sandra Farrington, Attorneys, Division of Financial Practices, Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580, (202) 326-3224.

SUPPLEMENTARY INFORMATION:

The final rule retains all of the requirements of the proposed rule, without major substantive changes, and adds a requirement relating to the use and disclosure of personally identifiable information collected through the centralized source.

Statement of Basis and Purpose

I. Background

The Fair and Accurate Credit Transactions Act of 2003, Pub. L. 108-159, 117 Stat. 1952 (FACT Act or the Act) was signed into law on December 4, 2003. In part, the Act amends the Fair Credit Reporting Act (FCRA), 15 U.S.C. 1681 et seq., by imposing new requirements on consumer reporting agencies that compile and maintain files on consumers on a nationwide basis (nationwide consumer reporting agencies), and nationwide specialty consumer reporting agencies, as defined by §§ 603(p) and 603(w) of the FCRA, 15 U.S.C. 1681a(p) and (w), respectively. These additional requirements include the obligation to provide, upon request, one free file disclosure—commonly called a credit report—to the consumer once in a 12-month period.

Section 609 of the FCRA requires disclosure of “[a]ll information in the consumer’s file at the time of the request.” 15 U.S.C. 1681g(a)(1). The FACT Act refers to the requirement to make “all disclosures pursuant to [FCRA] section 609 once during any 12-month period” without charge as providing free “consumer reports.” FACT Act 211(d). To avoid confusion, the rule refers to disclosures made pursuant to FCRA § 609 as “file disclosures” and to the free annual disclosures required under the FACT Act as “annual file disclosures.”

The FACT Act directs the Commission to consider the concerns of both consumers and industry in prescribing these rules. Specifically, the Act directs the Commission to consider “the significant demand that may be placed on consumer reporting agencies in providing such [annual file disclosures]; appropriate means to ensure that consumer reporting agencies can satisfactorily meet those demands, including the efficacy of a system of staggering the availability to consumers of such [file disclosures]; and the ease by which consumers should be able to contact consumer reporting agencies with respect to access to such [annual file disclosures].” FACT Act § 211(d)(2). In addition to these considerations, the FACT Act also requires the Commission to provide for an orderly transition for the centralized source in a manner that does not temporarily overwhelm the nationwide consumer reporting agencies with requests for annual file disclosures and does not deny creditors and other users access to consumer reports. FACT Act § 211(d)(2). Finally, the FACT Act directs the Commission to consider, when setting the effective date for rule provisions applicable to the nationwide specialty consumer reporting agencies, the ability of each nationwide specialty consumer reporting agency to comply with the annual file disclosure requirements. FACT Act § 211 (a), codified at FCRA § 612 (a), 15 U.S.C. §1681j (a).

The Commission has carefully weighed all of these considerations as required by the FACT Act. On March 16, 2004, the Commission issued, and sought comment on, a proposed rule implementing the requirements of the FACT Act (the proposed rule).

The Commission has reviewed the detailed comments received, which represented all points of view. In crafting both the proposed rule and the final rule, the Commission has strived to strike the balance that the FACT Act seeks between the availability of free annual file disclosures to consumers and the legitimate concerns of the consumer reporting agencies that are required to provide them. In issuing this final rule (the rule or the final rule), the Commission adopts the proposed rule with some modifications.

The notice of proposed rulemaking (hereinafter, the NPR) and proposed rule were published in the Federal Register on March 19, 2004. 69 FR 13192.

Like the proposed rule, the final rule requires nationwide consumer reporting agencies to establish a centralized source to enable consumers, with a single request, to obtain annual file disclosures from all nationwide consumer reporting agencies, in accordance with the FACT Act, § 211(d)(1)(A). The centralized source required by the final rule will provide consumers with the ability to request their free annual file disclosures from each of the nationwide consumer reporting agencies through a centralized Internet website, toll-free telephone number, and postal address. The rule also includes a standardized form for such requests, as specified in the FACT Act, § 211(d)(1)(B). Further, the rule requires nationwide specialty consumer reporting agencies to establish a streamlined process for consumer requests for annual file disclosures, as provided in the FACT Act, § 211(a)(2).

The final rule limits the obligations of nationwide consumer reporting agencies when the volume of consumer requests for annual file disclosures is excessive. It permits nationwide consumer reporting agencies to queue requests for annual file disclosures during times of “high request volume”-i.e., volume that exceeds 125% of the rolling daily average volume. It also allows nationwide consumer reporting agencies to decline to accept requests during times of “extraordinary request volume”-i.e., volume that exceeds 175% of the rolling daily average volume.

The final rule maintains the gradual roll-out of the centralized source contained in the proposed rule. In order to ensure a smooth transition, and in response to concerns regarding the volume of consumers who may request annual file disclosures when the rule first becomes effective, the centralized source will become available to consumers in four cumulative stages that roll out from west to east. See discussion under § 610.2(i) of this notice, infra. This transition will start on December 1, 2004, and will be completed within nine months, by September 1, 2005. Final rule § 610.2 (i)(1). The final rule also provides for a lower threshold for “high request volume” during this transition period.

In addition, the final rule retains, with some modifications, the proposed rule#x2019;s requirements relating to nationwide specialty consumer reporting agencies. These agencies are required to establish a streamlined process for consumers to request annual file disclosures, final rule § 610.3 (a),

including a toll-free telephone number for consumers to make such requests. The rule also requires nationwide specialty consumer reporting agencies to make their toll-free telephone numbers available to consumers in specific ways. Final rule § 610.3 (a)(1). See discussion under §610.3 (a) of this notice, infra.

II. Overview of Comments Received.

The Commission received more than 2,300 comments on the proposed rule.

The vast majority of these comments were from consumers. Consumer advocacy groups,

members of Congress, industry trade organizations,

and various representatives of the consumer reporting industry — including the three nationwide consumer reporting agencies,

other consumer reporting agencies,

and a variety of other interested organizations

—also submitted comments on the proposed rule.

The public comments relating to this rulemaking may be viewed at www.ftc.gov/os/comments/factafcr. The Commission considered all comments timely filed, i.e.-those received on or before the close of the comment period on April 16, 2004. As a matter of discretion, the Commission also considered comments that were filed after the close of the comment period. The total number of comments stated here includes more than 2,000 consumer comments collected through U.S. Public Interest Research Group, which are posted, in batch form, at U.S. Public Interest Research Group #EREG000604. Citations to comments filed in this proceeding are made to the name of the organization (if any) or the last name of the commenter, and the comment number of record. Comment number may appear as all numeric characters-e.g., #000031 (indicating a comment received by paper or electronic mail), or as numeric characters preceded by “EREG”-e.g., “EREG000031” (indicating a comment received through www.regulations.gov).

These include AARP, Asociac íon Campesino Lazaro Cardenas Inc., CEIBA, Consumer Federation of America, Consumers Union, Del Norte Neighborhood Development Corporation, Electronic Privacy Information Center, Housing and Economic Development Asociac íon De Puertorriquenos, Latino Leadership, Inc., Midland Community Development Corporation, National Association of Consumer Advocates, National Consumer Law Center, National Consumers League, National Council of La Raza, NEWSED C.D.C., Privacy Rights Clearinghouse, Privacy Times, Self-Help Enterprises, Spanish Action League, Spanish Coalition for Housing, Tejano Center for Community Concerns, U.S. Public Interest Research Group (US-PIRG), and Watts/Century Latino Organization.

In addition to Consumer Data Industry Association (CDIA)-the trade association that represents the nationwide consumer reporting agencies and a variety of other consumer reporting agencies-the Commission received comment on the proposed rule on behalf of a number of trade organizations representing a variety of industries and concerns. These include ACA International (representing debt collection agencies and other accounts receivable professionals), America’s Community Bankers, National Association of Realtors, Credit Union National Association (CUNA), Consumer Credit Counselors of Los Angeles, National Association of Mortgage Brokers, Mortgage Bankers Association, and Coalition to Implement the FACT Act (representing trade associations and companies that furnish, use, collect, and disclose consumer information).

The Commission is aware of three entities that meet the FCRA § 603(p) definition of nationwide consumer reporting agency. These entities are Equifax Information Services LLC, Experian Information Solutions, Inc., and Trans Union LLC.

These include ChoicePoint, Inc., Computer Sciences Corporation (CSC), Evergreen Credit Reporting Inc., and MIB Group, Inc. (MIB).

These include Aegon Direct Marketing Services, Inc., Cendant Corporation, Chartered Marketing Services, Deluxe Corporation, Fair Isaac and Company, Inc., Intersections Inc., ReferencePro, and Schwartz & Ballen LLP.

The Commission received comments relating to nearly every provision contained in the proposed rule. Most commenters — consumer and industry representatives alike — express general support for the concept of free annual file disclosures. Many consumers and consumer advocates note that free annual file disclosures will enhance consumer report accuracy, save consumers money, foster greater financial literacy, and prevent or mitigate the effects of identity theft. Some consumers urge the Commission to adopt provisions that extend beyond what the FACT Act provides: for example, requiring free file disclosures more often, requiring disclosure of free credit scores, or requiring free file disclosures from all consumer reporting agencies, regardless of nationwide or nationwide specialty consumer reporting agency status under the FCRA.

The overwhelming majority of comments focus on one or more aspects of the proposed requirement for nationwide consumer reporting agencies to provide annual file disclosures through a “centralized source.” Proposed rule § 610.2. Consumer commenters express concern about a variety of issues related to the centralized source. Many consumers and consumer advocates suggest that the final rule should include a limitation on the use and disclosure of information collected by nationwide consumer reporting agencies through the centralized source. Consumers also suggest that the regional roll-out of the centralized source, proposed rule § 610.2 (i), was too long, and that it placed unfair burden on consumers residing in eastern states. Consumer advocates, on the other hand, express doubt as to the need for any type of gradual transition, but generally support a regional approach if such a transition were to be retained in the final rule. Many consumer advocacy groups also express concern that the proposed rule contained no requirement to provide file disclosures and centralized source information and instructions in Spanish.

In addition, many consumers and consumer advocates urge the Commission to consider further restricting, or banning, advertising and marketing of other products through the centralized source. Many competitors of the nationwide consumer reporting agencies—including both other consumer reporting agencies

as well as non-consumer reporting agencies

— similarly advocate a final rule that would ban advertising and marketing through the centralized source.

For example, Evergreen Credit Reporting Inc. See Comment, Evergreen Credit Reporting Inc. # 000031.

For example, Fair, Isaac and Company, Inc. See Comment, Fair, Isaac and Company, Inc. #000011.

The Commission also received comments relating to the centralized source from both federal and state elected officials. One U.S. Senator

and a group of members of the U.S. House of Representatives Committee on Financial Services

express concern that the structured roll-out of the centralized source required by the proposed rule was too slow, and discriminated against consumers who reside in eastern states. A group of United States Senators

and a different group of members of the U.S. House of Representatives Committee on Financial Services

comment that the proposed rule did not provide the nationwide consumer reporting agencies with sufficient guidance, and that the safe harbor contained in the proposed rule was inadequate to protect these agencies from overwhelming consumer demand for annual file disclosures. A New York State Senator also expresses concern that the proposed rule did not specify how annual file disclosures should be delivered, contained inadequate provisions to protect consumers from unwanted solicitations and other uses of their personally identifiable information, and did not contain requirements that file disclosures and other information be provided to

consumers in languages other than English.

Senator Charles E. Schumer (D-NY). See Comment, U.S. Senate #000022.

These Representatives included Julia Carson, Joseph Crowley, Harold E. Ford, Jr., Barney Frank, Luis V. Gutierrez, Barbara Lee, Stephen Lynch, Brad Sherman, and Maxine Waters. See Comment, U.S. House of Representatives #000134.

These Senators included Robert F. Bennett, Elizabeth Dole, Tim Johnson, and Thomas R. Carper. Comment, United States Senate #000137.

These Representatives included Spencer Bachus, Judy Biggert, Rahm Emanuel, Jeb Hensarling, Ruben Hinojosa, Darlene Hooley, Steve Israel, Sue W. Kelly, Steven LaTourette, Dennis Moore, Robert W. Ney, Michael G. Oxley, Edward R. Royce, and David Scott. See Comment, U.S. House of Representatives #000136.

CDIA and the nationwide consumer reporting agencies also comment at length on a variety of issues relating to the centralized source. They uniformly express concern that both the proposed rule transition and the provisions relating to the “extraordinary request volume” safe harbor were inadequate and, if adopted, would have subjected the industry to dangerous uncertainties, increased liability from private actions, and wasted resources. They urge the Commission to lengthen the transition period; convert the cumulative regional roll-out approach of the proposed rule to a permanent staggering of availability of free reports by birth month or quarter; and provide additional and lower safe harbor thresholds. In addition, the nationwide consumer reporting agencies and CDIA object to the proposed rule’s requirement that nationwide consumer reporting agencies provide free annual file disclosures for consumers whose files are owned by, or maintained on the nationwide consumer reporting agency’s system by, an associated consumer reporting agency.

The Commission also received a number of comments relating to the proposed rule’s requirement that nationwide specialty consumer reporting agencies implement a “streamlined process” for accepting and processing consumer requests for free annual file disclosures. Proposed rule § 610.3. Consumer and consumer advocate comments on the “streamlined process” focus mainly on the visibility of nationwide specialty consumer reporting agencies and the convenience with which consumers should be able to contact them. A number of consumers comment that nationwide specialty consumer reporting agencies should be required to participate in the centralized source for nationwide consumer reporting agencies required under proposed rule § 610.2, or that nationwide specialty consumer reporting agencies should also develop a joint centralized source.

Representatives of nationwide specialty consumer reporting agencies

express concern over the definition of that term found in the FACT Act. In addition, they object to the fact that the proposed rule did not provide nationwide speciality consumer reporting agencies with a structured roll-out for the required streamlined process. Finally, these entities urge the Commission to provide additional, and lower threshold safe harbors from both private and regulatory liability arising from unforeseen circumstances and overwhelming request volume.

The Commission notes that some commenters identify themselves as “nationwide specialty consumer reporting agencies.” Others, however, decline to use this term, although their services focus on one or more of the five categories of nationwide specialty consumer reporting agencies. By referring to both types of commenters as “nationwide specialty consumer reporting agencies” here, the Commission is not making a legal determination or factual finding that such entities meet the statutory definition of that term.

III. Section-By-Section Analysis

Section 610.1—Definitions and rule of construction

Section 610.1 (a) of the final rule explains that the definitions and the rule of construction provided in § 610.1 (b) and (c) of the rule apply throughout Part 610. Terms not otherwise defined in § 610.1 of the rule have the meaning provided under the Fair Credit Reporting Act, 15 U.S.C. 1681a. See also 69 FR 29061.

Definitions.

Section 610.1 (b) of the final rule sets forth definitions for a number of terms used throughout the rule.

Annual file disclosure.

The proposed rule defined “annual file disclosure” as a file disclosure that is provided to a consumer upon consumer request and without charge, once in any 12-month period, in compliance with § 612(a) of the Fair Credit Reporting Act, 15 U.S.C. 1681j(a). Proposed rule § 610.1(b)(1). A consumer advocacy group suggests that this definition be revised to provide for free file disclosures “once in a calendar year.”

Such a definition, however, conflicts with the language of the FACT Act, which states free file disclosures should be provided “once during any 12-month period.” FACT Act § 211 (a)(2), codified at FCRA § 612 (a)(1), 15 U.S.C. 1691j (a)(1) (emphasis supplied). The Commission therefore has adopted the proposed rule definition of annual file disclosure in the final rule.

Comment, Electronic Privacy Information Center #EREG000594.

Associated consumer reporting agency.

Section 610.1(b)(2) of the proposed rule defined an “associated consumer reporting agency” as a consumer reporting agency that maintains consumer reports within systems operated by a nationwide consumer reporting agency. In the NPR, the Commission noted that nationwide consumer reporting agencies have contractual relationships with a number of regional or local consumer reporting agencies. 69 FR at 13197. These regional or local consumer reporting agencies, traditionally called “service bureaus” or “affiliates,” generally are independently owned and operated entities—they are not corporate affiliates of a nationwide consumer reporting agency.

Rather, typically, they have a right to house some or all of the consumer data that they own on the systems of one or more nationwide consumer reporting agencies. The nationwide consumer reporting agency with whom such an entity is associated, in turn, has the right to sell that consumer data to its customers.

The final rule, like the proposed rule, addresses these consumer reporting agencies as “associated consumer reporting agencies.”

That is to say, associated consumer reporting agencies generally are not under common ownership or control with a nationwide consumer reporting agency. See FACT Act § 2 (4).

The associated consumer reporting agency may also have the right to sell consumer information owned by the nationwide consumer reporting agency.

One associated consumer reporting agency comments that this description of associated consumer reporting agencies appropriately describes the relationship between these agencies and nationwide consumer reporting agencies. Both the associated consumer reporting agency commenter and a nationwide consumer reporting agency, however, suggest that the proposed rule definition of “associated consumer reporting agency” should be altered slightly. These commenters both note that many, if not all, associated consumer reporting agencies own — rather than merely maintain — the files that they house in nationwide consumer reporting agency systems. Accordingly, the final rule definition of associated consumer reporting agency is “a consumer reporting agency that owns or maintains consumer files housed within systems operated by one or more nationwide consumer reporting agencies.” Final rule § 610.1(b)(2) (emphasis supplied).

Consumer.

The proposed rule adopted the definition of “consumer” that is found in § 603 (c) of the FCRA, 15 U.S.C. 1681a (c). The Commission received no comments suggesting changes to this definition, and it is adopted as proposed. Final rule § 610.1(b)(3).

Consumer report.

The proposed rule adopted the definition of “consumer report” that is found in § 603(d) of the FCRA, 15 U.S.C. 1681a(d). The Commission received no comments suggesting changes to this definition, and it is adopted as proposed. Final rule § 610.1(b)(4).

Consumer reporting agency.

The proposed rule adopted the definition of “consumer reporting agency” that is found in § 603 (f) of the FCRA, 15 U.S.C.

1681a (f). The Commission received no comments suggesting changes to this definition, and it is adopted as proposed. Final rule § 610.1(b)(5).

Extraordinary request volume.

Under the proposed rule, “extraordinary request volume” occurred (except as provided in § 610.2 (i)(2)) “when the number of consumers requesting file disclosures during any 24-hour period is more than twice the daily rolling 90-day average of consumers requesting file disclosures.” For reasons discussed under § 610.2 (e) of this notice, infra, the Commission modifies the proposed rule definition of extraordinary request volume to volume that “is more than 175% of the rolling 90-day daily average of consumers requesting or attempting to request file disclosures.” Final rule § 610.1(b)(6).

File disclosure.

The proposed rule, § 610.1(b)(7), defined a “file disclosure” as any disclosure made pursuant to § 609 of the FCRA.

Section 612(a) of the FCRA, 15 U.S.C. 1681j(a), as amended by the FACT Act, provides that nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies must provide “all disclosures pursuant to [FCRA] section 609 once during any 12-month period upon request of the consumer and without charge to the consumer.” Accordingly, under proposed rule § 610.1(b)(1), the term “annual file disclosure” was a file disclosure made upon request, free of charge, in compliance with § 612(a) of the FCRA, 15 U.S.C. 1681j(a), as amended. Although FCRA §§ 612(b)-(e) provide for other types of free file disclosures, the term “annual file disclosure,” as defined in the proposed rule, referred only to free file disclosures made pursuant to FCRA § 612(a).

Section 609 of the FCRA, 15 U.S.C. 1681g, requires every consumer reporting agency, upon request of the consumer, to disclose to the consumer, among other things, “all information in the consumer’s file at the time of the request.”

It should be noted that the FCRA, as amended by the FACT Act, requires consumer reporting agencies to provide a free file disclosure to consumers under a number of different circumstances. In addition, under FCRA § 612(f), 15 U.S.C. 1681j(f), a consumer reporting agency must provide file disclosures to consumers for a fee, upon request. The requirement for nationwide consumer reporting agencies to provide annual file disclosures supplements, but does not replace, these other provisions. In other words, a consumer is entitled to obtain a free annual file disclosure through the centralized source, once in any 12-month period, even if that consumer has obtained other free or paid file disclosures in that time period. See FCRA § 612, 15 U.S.C. 1681j.

One nationwide specialty consumer reporting agency requests that the Commission consider limiting the definition of file disclosure, as it applies to nationwide specialty consumer reporting agencies, to require only the disclosure of specific types of information. This commenter notes that the FACT Act specifically limits the types of nationwide specialty consumer reporting agencies that must provide annual file disclosures to only those that compile or maintain information on medical records or payments; residential or tenant history; check writing history; employment history; or insurance claims. See FCRA § 603(w), 15 U.S.C. 1681a(w). Thus, the commenter posits, Congress must also have intended to circumscribe the content of such file disclosures to only the types of information listed in the definition of nationwide specialty consumer reporting agency.

While the FACT Act limits “nationwide specialty consumer reporting agencies” to specific types of entities — i.e., those that compile and maintain medical records or payments, residential or tenant history, check writing history, employment history, or insurance claims — the plain language of the Act is broader in describing what information those entities must provide to consumers. The FACT Act specifically requires nationwide consumer reporting agencies to make all disclosures required by § 609 of the FCRA, which, by the terms of that section, must include “all information in the consumer’s file at the time of the request.”

The Commission therefore declines to limit the scope of the required disclosures as the commenter suggests. The final rule adopts the proposed rule definition of file disclosure without modification. Final rule § 610.1(b)(7).

FCRA § 609(a), 15 U.S.C. 1681g(a).

High request volume.

A definition of “high request volume” was used in the transition section—§ 610.2(i)(3)— of the proposed rule. Under that section, during the transition period, “high request volume” occurred when the number of consumers who contact or attempt to contact the centralized source, a particular request method, or a nationwide consumer reporting agency, in a 24-hour period, is more than 115% of the rolling 7-day average number of consumers who contacted or attempted to contact the centralized source, a particular request method, or a nationwide consumer reporting agency, to request file disclosures. Proposed rule § 610.2(i)(3). For reasons discussed under §§ 610.2(e) and 610.3(c) of this notice, infra, the final rule broadens the concept of high request volume to apply both during and after the defined transition periods. The final rule defines high request volume as occurring when the number of consumers requesting or attempting to request file disclosures during any 24-hour period is more than 125% of the daily rolling 90-day average of consumers requesting or attempting to request file disclosures. As with extraordinary request volume, high request volume is defined differently during the transition period. See discussion under §§ 610.2(i) and 610.3(g) of this notice, infra.

Nationwide consumer reporting agency.

Under proposed rule § 610.1(b)(8), the term “nationwide consumer reporting agency” meant a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, as defined in FCRA § 603(p), 15 U.S.C. 1681a(p). The Commission received no comments suggesting changes to this definition, and it is adopted as proposed. Final rule § 610.1(b)(9).

Nationwide specialty consumer reporting agency.

The term “nationwide specialty consumer reporting agency” was defined under § 610.1(b)(9) of the proposed rule, in accordance with FCRA § 603(w), 15 U.S.C. 1681a(w), as a consumer reporting agency that compiles and maintains files on consumers relating to medical records or payments, residential or tenant history, check writing history, employment history, or insurance claims, on a nationwide basis. One nationwide specialty consumer reporting agency urges the Commission to expand on the statutory definition of this term. The commenter argues that because the FACT Act added this definition to the FCRA, and because there is little or no legislative history to guide companies in the interpretation of this new definition, the Commission should further delineate the meaning of the term. Specifically, the commenter urges the Commission to adopt specific, limited meanings for the categories of information described in the definition of nationwide specialty consumer reporting agency. This same commenter similarly urges the Commission to define two other terms found within the definition of nationwide specialty consumer reporting agency: “compiles and maintains” and “nationwide.”

Comment, Choicepoint #000039.

The Commission notes that the definition of the term nationwide specialty consumer reporting agency is set out in the FACT Act with some specificity. By the terms of the Act, its application is limited to a consumer reporting agency. Further, such consumer reporting agency must

compile and maintain files on consumers, on a nationwide basis, relating to at least one of five specific categories of information. The record as developed through this rulemaking provides insufficient information to justify altering the definition used by Congress in the FACT Act. Accordingly, the Commission declines to do so. Nor does the Commission find it appropriate, in this rulemaking, to define terms — such as “nationwide” and “compiles and maintains”— that appeared in the FCRA prior to the FACT Act. The definition of nationwide specialty consumer reporting agency is adopted in the final rule as proposed. Final rule § 610.1(b)(10).

Request method.

Proposed rule § 610.1(b)(10) defined “request method” as the method by which a consumer chooses to communicate a request for an annual file disclosure. The FACT Act requires nationwide consumer reporting agencies, subject to regulations to be promulgated by the Commission, to establish a centralized source that will permit consumers to make such requests by three specific request methods: Internet website, toll-free telephone number, and mail. The Commission received no comments suggesting changes to this definition, and it is adopted as proposed. Final rule § 610.1(b)(11).

Rule of construction.

Section 610.1(c) of the proposed rule sets out a rule of construction to clarify the effect of the examples used in the proposed rule. Given the complexity of the rule and its potential impact on a variety of entities, the Commission has elected, in some instances, to provide examples of conduct that would, and would not, comply with the proposed rule. This section of the proposed rule provided that these examples are not intended to be exhaustive; they are intended to illustrate how the proposed rule would apply in specific circumstances. Representatives of the nationwide consumer reporting agencies comment that the examples in the proposed rule, coupled with this rule of construction, provide useful guidance for complying with the rule. The Commission received no comments suggesting changes to this provision, and it is adopted as proposed. Final rule § 610.1(c).

Section 610.2(a)—Centralized source for requesting annual file disclosures - purpose

Under § 610.2(a) of the proposed rule, the purpose of the centralized source, consistent with § 211(d) of the FACT Act, was to enable consumers to make a single request to obtain annual file disclosures from all nationwide consumer reporting agencies, as required under § 612(a) of the Fair Credit Reporting Act, 15 U.S.C. 1681j(a). Some commenters suggest that the rule should be crafted to fulfill other purposes as well. For example, several consumer comments suggest that the rule require that credit scores be made available to consumers without charge, free file disclosures be made available more than once a year, and all consumer reporting agencies, not just nationwide consumer reporting agencies, be required to participate in the centralized source. These proposals are all inconsistent with the plain language of the FACT Act. Under § 212 of the FACT Act, codified at FCRA § 609(a)(6) and (f), 15 U.S.C. 1681g(a)(6) and (f), information about credit scores must be provided to consumers requesting file disclosures, and the scores themselves, together with additional information about them, must be provided, upon request, for a “fair and reasonable fee.” The statute also specifically limits the free annual file disclosure requirement to nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies. Furthermore, it limits the operation of the centralized source to the nationwide consumer reporting agencies. FACT Act § 211(a)(2), codified at FCRA § 612(a)(1), 15 U.S.C. 1681j(a)(1). Accordingly, § 610.2(a) has been adopted as proposed.

Section 610.2(b)—Establishment and operation

Under § 610.2(b) of the proposed rule, the nationwide consumer reporting agencies were required to jointly design, fund, implement, maintain, and operate the centralized source for the purpose stated in § 610.2(a). In addition, the centralized source was required to be designed, funded, implemented, maintained, and operated to meet specific requirements.

Joint establishment and operations.

Representatives of nationwide consumer reporting agencies object to the proposed rule requirement that the centralized source be “jointly” designed, funded, implemented, maintained, and operated. They argue that the FACT Act does not require such joint establishment and operation. The FACT Act, however, does require the Commission to “prescribe regulations applicable to consumer reporting agencies described in section 603(p) [of FCRA], to require the establishment of a centralized source through which consumers may obtain [annual file disclosures].” FACT Act § 211(d)(1). Such a “centralized source” — if it is to function as the Act contemplates — must be a joint effort of the nationwide consumer reporting agencies. Thus, the Commission believes it is appropriate to require that the centralized source be jointly designed, funded, implemented, maintained, and operated by nationwide consumer reporting agencies, and the final rule adopts this provision without modification. Final rule § 610.2(b).

Potential competitive concerns among existing nationwide consumer reporting agencies.

CDIA comments that it is unaware of any anticompetitive concerns that are raised by the proposed rule’s implementation of the statutory requirement that the nationwide consumer reporting agencies jointly design, fund, implement, maintain, and operate the centralized source through which consumers may request their free file disclosures. The commenter points out that the nationwide consumer reporting agencies have operated the automated dispute resolution system required by FCRA § 611(a)(5)(D) without any competitive problems.

Further, although the final rule, like the proposed rule, requires nationwide consumer reporting agencies, which presumably are competitors, to jointly design, fund, implement, maintain, and operate the centralized source required under the FACT Act, nothing in the rule would permit any activity that is otherwise prohibited by applicable United States antitrust laws. One nationwide consumer reporting agency comments that this analysis interjects uncertainty into the ability of nationwide consumer reporting agencies to comply with existing antitrust law and the FACT Act simultaneously. As a result, the nationwide consumer reporting agencies urge the Commission to make clear that the coordination required by the statute and the rule is not subject to antitrust enforcement as it relates to the operation of the centralized source. As stated above, participation in the centralized source as required by the FACT Act and the final rule is not a violation of U.S. antitrust laws, which allow collaboration as long as it is not anticompetitive. The converse, however, is also true: Neither the FACT Act nor the final rule would permit nationwide consumer reporting agencies to engage in anticompetitive activities that would otherwise violate applicable antitrust laws.

New entrants and barriers to entry.

The Commission is aware of three entities that meet the FCRA § 603(p) definition of nationwide consumer

reporting agency.

It is possible, however, that additional nationwide consumer reporting agencies may exist, or be created, in the future. Any entity that meets the definition of nationwide consumer reporting agency in FCRA § 603(p), 15 U.S.C. 1681a(p), cannot be excluded by the currently identified nationwide consumer reporting agencies from participating jointly in the centralized source.

These entities are Equifax Information Services LLC, Experian Information Solutions, Inc., and Trans Union LLC.

One nationwide consumer reporting agency expresses concern that the “joint” establishment requirements might be interpreted to mean that the centralized source should be redesigned and reimplemented each time a new entrant is presented. The Commission agrees that to cause the entire centralized source to be reinvented for a new entrant would be inappropriate. Rather, § 610.2(b) of the rule contemplates that the centralized source would be modified only as necessary to allow consumers to request file disclosures from new entrants with the same ease as they can request file disclosures from existing participants.

Further, representatives of the nationwide consumer reporting agencies comment that the existing nationwide consumer reporting agencies, who will bear the costs of initial development and implementation of the centralized source, should be permitted to require any new entrants to reimburse them for the initial development and implementation costs associated with the centralized source. In contrast, some marketers of credit-related products and services express concern that the existing nationwide consumer reporting agencies will seek to impose unreasonable costs on potential new entrants to the centralized source in order to create an unreasonable barrier to entry. While the rule requires that the centralized source be jointly funded, it does not state how costs are to be shared among the nationwide consumer reporting agencies. In the Commission’s view, final rule § 610.2(b), which specifically requires joint funding, would permit both the sharing of ongoing operating costs as well as the reimbursement of design and development costs in an equitable manner. Section 610.2 of the final rule should not be used unreasonably to prevent new entrants from participating in the centralized source.

One nationwide consumer reporting agency urges the Commission to “assume responsibility” for identifying new entrants — i.e., those consumer reporting agencies that meet the definition of nationwide consumer reporting agency, and thus, must participate in the centralized source. This commenter argues that the determination of whether a particular consumer reporting agency is a nationwide consumer reporting agency should not be made by competitors of that agency. The Commission agrees that such a determination should not be made by an entity’s competitors. It does not follow, however, that the determination must then be made by the Commission. The determination of whether an entity meets the statutory definition of a nationwide consumer reporting agency-like the determination of whether an entity meets the definition of a consumer reporting agency-is fact specific. Thus, as is true with the determination of whether an entity is a consumer reporting agency, the entity itself must analyze its practices in light of the statute and existing law, and make its own determination.

Some commenters offer a similar argument in relation to the determination of what entities are nationwide specialty consumer reporting agencies. These commenters suggest that the Commission publish a list of such entities. For the reasons explained here, the Commission does not believe such a list would be appropriate.

Joint and several liability.

The final rule requirement for joint design, funding, implementation, maintenance, and operation of the centralized source suggests that all nationwide consumer reporting agency participants in the centralized source could be jointly liable for violations of final rule § 610.2. The nationwide consumer reporting agencies and CDIA object to the idea that a nationwide consumer reporting agency could be held jointly and severally liable for violations committed by one or more of the others, over which that entity had no control. The Commission recognizes that any question of individual or joint and several liability would be fact specific. The Commission does not intend to alter existing applicable standards of liability.

Required Request Methods.

As specified under the FACT Act, § 211(d)(3), final rule § 610.2(b)(1), like the proposed rule, requires the centralized source to include a toll-free telephone number, an Internet website, and a mail process for consumers to make requests for annual file disclosures. Comments received relating to this provision of the proposed rule generally note that it is consistent with the mandate of the FACT Act. The Act requires the nationwide consumer reporting agencies to establish a centralized source through which, by means of a single request, consumers may obtain annual file disclosures. As noted in the NPR, the FACT Act requires that consumers be able to request their annual file disclosures through specific request methods, but does not mandate the method by which the nationwide consumer reporting agencies may deliver those file disclosures. 69 FR at 13194.

Some commenters express concern regarding particular aspects of how the request methods might be presented. One nationwide consumer reporting agency commenter urges the Commission to clarify that the FACT Act and the final rule do not require any “live” telephone assistance to consumers requesting file disclosures. The final rule, like the proposed rule, requires nationwide consumer reporting agencies to provide the request methods mandated by the Act, but does not provide detailed specifications on how each request method should be presented. The Commission notes that there is nothing in the FACT Act that would either require or prohibit a completely automated telephone system for accepting file disclosure requests.

Several commenters urge the Commission to specify in the final rule how annual file disclosures may be provided to consumers who request them. One consumer advocacy group supports requiring that all three reports be generated simultaneously, in order to facilitate comparison. Some consumers, on the other hand, urge the Commission to specify that the reports do not have to be provided at the same time, arguing that a consumer may wish to monitor their file disclosures over the course of a year. Because the consumer is entitled to a free file disclosure from each nationwide consumer reporting agency, that consumer may, for example, choose to order only one file disclosure every four months. The Commission believes that the divergence of opinion on this point illustrates the need for flexibility. Because neither the FACT Act, nor the final rule, specifies that all annual file disclosures must be delivered simultaneously, consumers benefit from having a choice of when they would prefer to request any, or all, of the available annual file disclosures.

One state official argues that the final rule must specify by what means annual file disclosures may be provided. The commenter argues that, without specificity in the final rule, nationwide consumer reporting agencies might limit the available methods of delivery in such a way as to effectively thwart certain consumers from obtaining annual file disclosures. Representatives

of the nationwide consumer reporting agencies, on the other hand, argue that the proposed rule improperly allows consumers alone to select the delivery channel for annual file disclosures.

FCRA § 610(b), 15 U.S.C. 1681h(b), specifies that disclosures may be made in such form as may be specified by the consumer and available from the agency. Thus, the proposed rule allowed nationwide consumer reporting agencies flexibility in determining what methods of annual file disclosure delivery to make available generally to consumers. Similarly the final rule neither prohibits nor requires any particular method of delivery for annual file disclosures. The Commission notes that the FCRA, notwithstanding the FACT Act amendments, already specifies, in some detail, how file disclosures may be delivered to consumers.

See FCRA § 610(a)-(b), 15 U.S.C. 1681h(a)-(b). Because the delivery of file disclosures to consumers is already delineated in the FCRA, the final rule neither adds to nor subtracts from those pre-existing provisions of law.

FCRA § 610(a)(2), 15 U.S.C. 1681h(a)(2), requires that file disclosures be made in writing, except as provided in subsection (b). Section 610(b), 15 U.S.C. 1681h(b), in turn, provides that disclosures may be made in forms other than in writing if such disclosures are (1) available from the consumer reporting agency and (2) specified by the consumer. Under § 610(b)(2), 15 U.S.C. 1681h(b)(2), consumers may specify that file disclosures may be made in person (under specified conditions), by telephone (upon written request), by electronic means (if available from the consumer reporting agency) or any other reasonable means that is available from the agency. Thus, under FCRA § 610(b), it is clear that consumers may specify any means of delivery for their file disclosures that are available from the consumer reporting agency.

Similarly, some consumers suggest that the final rule should require that annual file disclosures be delivered within a specified period of time. The Commission notes that the FACT Act itself sets forth the appropriate timing for delivery of annual file disclosures. Under FACT Act § 211(a)(2), codified at FCRA § 612(a)(2), 15 U.S.C. 1681j(a)(2), “a consumer reporting agency shall provide [an annual file disclosure] not later than 15 days after the date on which the request is received . . ..” In light of this clear statutory mandate, the final rule does not further specify the timing for delivery of annual file disclosures.

Adequate capacity.

Under § 610.2(b)(2)(i) of the proposed rule, the centralized source was required to have adequate capacity to accept requests from the reasonably anticipated volume of consumers contacting the centralized source through each request method. The reasonably anticipated volume was required to be determined in compliance with § 610.2(c), discussed infra. Under the FACT Act, nationwide consumer reporting agencies must fulfill consumers’ requests for free annual disclosures “only if the request from the consumer is made using the centralized source established for such purpose.” FACT Act § 211(a)(2), codified at FCRA § 612(a)(1)(B), 15 U.S.C. 1681j(a)(1)(B). In recognition of the importance of a centralized source with adequate capacity to ensure the ability of consumers to obtain annual file disclosures, the final rule adopts § 610.2(b)(2)(i) as proposed, and thus requires that the centralized source be designed, funded, implemented, maintained, and operated in a manner that has adequate capacity to accept requests from the reasonably anticipated volume of consumers contacting the centralized source. Final rule § 610.2(b)(2)(i).

It is important to note that, under the final rule, nationwide consumer reporting agencies are required to anticipate the number of consumers who will contact the centralized source. Because nationwide consumer reporting agencies must meet this requirement during the transition periods defined by the final rule under § 610.2(i), this language is intended to include consumers who contact the centralized source at a time when it is not yet available in their state. In the Commission’s view, the nationwide consumer reporting agencies may employ technological or other means (such as blocking non-eligible area codes during the transition) to prevent consumers from mistakenly contacting the centralized source during the transition at a time when they are not eligible to receive an annual file disclosure.

The Commission received few comments on this provision itself.

CDIA comments that “it is entirely appropriate to require that the nationwide consumer reporting agencies build and maintain each individual request method of the centralized source to anticipate consumer’s request volume when there is data upon which to estimate demand.”

The Commission agrees, and § 610.2(b)(2)(i) is adopted as proposed.

The Commission did, however, receive numerous comments on its companion provision, § 610.2(c), which requires reasonable procedures to anticipate and respond to the volume of consumer requests. See discussion under § 610.2(c) of this notice, infra.

Comment, CDIA #000018

Collection of information and identification of consumers.

The proposed rule, in § 610.2(b)(2)(ii), required that the nationwide consumer reporting agencies collect only as much information from a consumer through the centralized source as is reasonably necessary in order to properly identify the consumer and to process the transaction(s) requested by the consumer. The final rule retains this requirement, with some modification. See final rule § 610.2(b)(2)(ii).

Personally identifiable information.

One nationwide consumer reporting agency comments that the proposed rule limitation on the collection of “information” may prohibit the nationwide consumer reporting agencies from collecting useful anonymous data through the centralized source. This commenter explains that such anonymous data would be useful for system maintenance and in detecting activities that would harm the centralized source, such as fraud.

The purpose of this provision of the rule is to ensure that the centralized source will be easy for consumers to use, while allowing the nationwide consumer reporting agencies to properly identify consumers who request their file disclosures through the centralized source, in compliance with FCRA § 610(a)(1), 15 U.S.C. 1681h(a)(1). The Commission is concerned that a centralized source that collects too much personal information may discourage some consumers from requesting their annual file disclosures. The Commission also recognizes, however, the need for collection of anonymous data for purposes such as system maintenance, service improvement, or fraud prevention.

Accordingly, the Commission has modified the § 610.2(b)(2)(ii) requirement to limit the collection of personally identifiable information — rather than all information — to that which is reasonably necessary to properly identify the consumer and process the transaction(s) requested by that consumer. Accordingly, final rule § 610.2(b)(2)(ii) would not prevent nationwide consumer reporting agencies from collecting anonymous information.

For example, the nationwide consumer reporting agencies may want to collect information and statistics on the number of consumers that use the centralized source website and toll-free telephone number, so they can efficiently allocate resources.

Social Security number.

Some consumers suggest that the final rule should specify that consumers are not required to provide their Social Security numbers when requesting their free file disclosures through the centralized source. These commenters contend that, in order to prevent identity theft, consumers have been repeatedly instructed by consumer advocates and government not to provide their Social Security numbers to anyone, and that some consumers do not have Social Security numbers. Therefore, they assert, the availability of annual file

disclosures should not be conditioned on providing a Social Security number.

The final rule does not specifically require or prohibit the collection of Social Security numbers through the centralized source. Section 610.2(b)(2)(ii) is intended to provide a standard for information collection that is sufficiently flexible to accommodate the proper identification of consumers requesting free annual file disclosures by all nationwide consumer reporting agencies. The collection of this information is limited to that which is “reasonably necessary” to achieve proper identification of the consumer. The Commission believes that a consumer’s Social Security number may be “reasonably necessary” to properly identify the consumer, given the requirements of the nationwide consumer reporting agencies’ current systems. Therefore, the rule does not prohibit the collection of that information. If, however, at some future time, due to changes in technology or in the consumer data industry, a Social Security number is not “reasonably necessary” for proper identification, then the collection of that information would be prohibited by final rule § 610.2(b)(2)(ii).

Separate authentication.

Representatives of the nationwide consumer reporting agencies comment on the need for each agency to conduct separate authentication processes for each consumer requesting a free annual file disclosure through the centralized source. As noted in the NPR, proposed rule § 610.2(b)(2)(ii) was intended to afford each nationwide consumer reporting agency the flexibility to implement its own identification procedures for consumers who request file disclosures through the centralized source, in order to allow proper identification of consumers and to protect against fraud. File disclosures contain a great deal of very sensitive information. If misdirected to, or fraudulently obtained by, someone other than the consumer to whom it relates, a file disclosure would provide the ideal means for identity theft and other fraudulent activity. In addition, the nationwide consumer reporting agencies each maintain slightly different information in their consumer files, making it difficult to devise a common identification scheme. Moreover, a flexible approach allows the nationwide consumer reporting agencies to adjust to changing threats and patterns of fraudulent activity over time. Accordingly, like the proposed rule, the final rule does not prohibit the use of separate authentication processes by each nationwide consumer reporting agency for consumers requesting free annual file disclosures through the centralized source.

Reasonably necessary.

One nationwide consumer reporting agency suggests that the final rule alter the limitation on information collection. This commenter expresses concern that the “reasonably necessary” standard creates uncertainty and would, therefore, increase the risk of litigation.

The commenter also states that this risk of liability would create incentive for a nationwide consumer reporting agency to collect only the minimum necessary amount of information in order to identify consumers, thus creating increased risk of identity theft or fraud.

Throughout their comments, CDIA and the nationwide consumer reporting agencies repeatedly object to the use of “reasonable” standards in the proposed rule-such as may be found in proposed rule §§ 610.2(b)(2)(i) (“reasonably anticipated volume”); 610.2(b)(2(ii) (collect only as much information as is “reasonably necessary”); 610.2(b)(2)(iv)(B) (provide information that consumers might “reasonably need”); 610.2(c) (implement “reasonable procedures”); 610.2(c)(2)(i)(B) (time when centralized source may be “reasonably anticipated” to be able to accept requests); and 610.2(c)(2)(i)(C) (take all “reasonable steps” and defer requests until a “reasonable later time”). In general, the stated objection to such provisions is that the use of a “reasonable” standard is inappropriately vague, creates uncertainty and increases the risk of private litigation. The Commission notes, however, that, since its inception more than 30 years ago, the provisions of the FCRA itself have been based upon the concept of “reasonableness.” Indeed, Congress declared that the very purpose of the FCRA is “to require that consumer reporting agencies adopt reasonable procedures.” FCRA § 602(b), 15 U.S.C. 1681(b). Further, FCRA § 607(b) requires all consumer reporting agencies to “follow reasonable procedures to assure maximum possible accuracy” in consumer reports. 15 U.S.C. 1681e(b). Far from abandoning this approach, the FCRA, as amended by the FACT Act, uses the words “reasonable” or “reasonably” more than 70 times. Further, the “reasonable” standard is particularly appropriate when technology and the industry are continually changing. A more prescriptive standard might provide certainty today, but it would likely be overtaken and rendered anachronistic by advances in technology within a very short time. Accordingly, the Commission believes use of a “reasonable” standard in the final rule is appropriate and consistent with the regulatory scheme long established by the FCRA.

As noted above, the Commission intends for the final rule to strike a balance between ease of use of the centralized source and maintaining adequate identification and authentication procedures to protect against fraud and identity theft. In part, the purpose of the “reasonably necessary” standard is to allow for advances in technology or other developments that improve proper identification and authentication. The Commission believes that creating a flexible standard that can adapt over time is the most effective way of ensuring that proper procedures are implemented. Accordingly, nationwide consumer reporting agencies are required to limit the collection of personally identifiable information through the centralized source to that which is “reasonably necessary.”

Potential for fraud.

In promulgating the proposed rule, the Commission posed a question as to whether and how the rule should address the potential for fraudulent websites, telephone numbers, or other ploys that might mimic the centralized source in order to gain access to personally identifiable consumer information for illegal purposes. In addition, the Commission asked whether the rule should require the nationwide consumer reporting agencies to employ measures to reassure consumers that they are contacting the legitimate centralized source.

Two of the nationwide consumer reporting agencies and CDIA responded to these questions by stating that the primary mechanism for preventing such fraudulent ploys is FTC enforcement action. These comments further assert that no specific preventive measures should be required of the nationwide consumer reporting agencies. One nationwide consumer reporting agency suggests that the nationwide consumer reporting agencies and the Commission engage in future discussions regarding effective measures to reassure consumers that they are contacting the centralized source.

At this time, the Commission has not identified any specific appropriate measures that, if incorporated into the centralized source, would sufficiently address fraudulent spoofing or mimicking of the centralized source. It welcomes further dialogue with the nationwide consumer reporting agencies regarding this important topic of fraud prevention. The Commission may also address these issues through consumer education, and, if appropriate, enforcement actions pursuant to the FTC Act, 15 U.S.C. 45(a). As a further aid to wary consumers, the Commission urges the nationwide consumer reporting agencies to make it easy for consumers to navigate from the nationwide consumer reporting agencies’ individual homepages to the centralized source website. In addition, to assist consumers in identifying the centralized source, the final rule requires the nationwide consumer reporting agencies to include a statement indicating that the consumer has reached the website or telephone number “operated by the national credit reporting agencies for ordering free annual credit reports, as required by

federal law.” Final rule §610.2 (b)(2)(iv)(D).

Information on alternate request methods.

To ensure that consumers can access the centralized source request method of their choice, proposed rule § 610.2(b)(2)(iii) required the centralized source toll-free number and Internet website to provide information regarding how to make a request for annual file disclosures through all available request methods. The Commission received no comments relating to this provision and adopts the provision as set forth in the proposed rule. Final rule § 610.2(b)(2)(iii).

Clear and easily understandable instructions.

Under proposed rule § 610.2(b)(2)(iv), the centralized source was required to provide clear and easily understandable information and instructions to consumers. This provision required the nationwide consumer reporting agencies to communicate to consumers, through the centralized source, information and instructions that may be needed by a consumer to request a free annual file disclosure. Under the proposed rule, such communications include informing consumers of the progress of their request for a file disclosure while they are in the process of making the request. Proposed rule § 610.2(b)(2)(iv)(A). For a website request method, the proposed rule also required the centralized source to provide access to a “help” or “frequently asked questions” screen. Proposed rule § 610.2(b)(2)(iv)(B). Finally, in the event that a consumer cannot be properly identified through the centralized source, the proposed rule required the nationwide consumer reporting agencies to notify the consumer of that fact, and to provide instructions on how to complete the request. Proposed rule § 610.2(b)(2)(iv)(C).

As stated in the NPR, the intent of these rule provisions was to ensure that centralized source materials are provided to consumers in plain language and that the centralized source is easy for consumers to use. A nationwide consumer reporting agency argues that the phrase “clear and easily understandable” is overly broad and subject to troubling interpretation. This commenter suggests that the Commission provide model language that could be used to give consumers the instructions and information required by the rule. Similarly, some consumer commenters suggest that the final rule should require that centralized source instructions be written at a 12-year old reading level. Since the instructions and information to be provided will be determined in substantial part by the format and structure of the yet-to-be-created centralized source, the Commission has decided not to include such model “information and instructions” in the final rule. The Commission also declines to require that centralized source materials be written to a specific reading level, but notes that evaluation of centralized source communications by consumer communication experts, and consumer testing, may be instructive in determining whether centralized source materials are “clear and easily understandable.”

Many consumer advocacy groups and a state official suggest that the centralized source be required to provide instructions in languages, other than English, that are spoken by a substantial number of consumers in the United States. These commenters point to the fact that a significant portion of the United States population communicates primarily in languages other than English. Having carefully considered these comments, the Commission has determined not to require instructions in other languages. The Commission believes that requiring multi-language translations of centralized source materials, including the centralized source website itself, would impose significant additional burden on the nationwide consumer reporting agencies at a time when they will already be responding to the multiple and varied new obligations that the FACT Act imposes upon them. Accordingly, the Commission declines, at this time, to require multi-language centralized source information and instructions. The Commission, however, intends to provide education and outreach to consumers concerning the final rule in Spanish

— the language most commonly mentioned by commenters on this issue — and encourages other stakeholders in the centralized source, including the nationwide consumer reporting agencies, to do the same.

The Commission has been active in both consumer outreach and enforcement initiatives relevant to Spanish-speaking consumers. See, e.g., www.ftc.gov/opa/2004/04/hispanicsweep2.htm. To date, the Commission has translated nearly 70 consumer publications into Spanish and posted them to the FTC’s En Espanol Web site at www.ftc.gov/spanish.

Consumer advocacy groups recommend that the centralized source be required to provide additional information, including a statement of the consumer’s right to obtain a credit score, a disclosure of the other circumstances under which a consumer is entitled to a free report (e.g., when a consumer is a victim of identity theft, unemployed, or a welfare recipient), and information about nationwide speciality consumer reporting agencies. The Commission does not adopt these recommendations, primarily because requirements to provide such additional information appear elsewhere in the FCRA.

Similarly, requirements relating to nationwide speciality consumer reporting agencies are contained in final rule § 610.3. The Commission believes the dissemination of information required under these statutory and rule provisions is sufficient to inform consumers.

Section 609(d) of the FCRA as amended by the FACT Act, 15 U.S.C. 1681g(d), requires the Commission in consultation with other agencies to prepare and make available a summary of the rights of identity theft victims. Section 609(c) of the FCRA as amended by the FACT Act, 15 U.S.C. 1681g(c), requires the Commission to prepare and make available a Summary of Rights to Obtain and Dispute Information in Consumer Reports and to Obtain Credit Scores, which summary is required to be included with each written disclosure provided to the consumer by a consumer reporting agency, including free annual file disclosures. Pursuant to § 609(a)(6) of the FCRA, 15 U.S.C. 1681g(a)(6), as amended by § 212 of the FACT Act, consumers who request a file disclosure but not the credit score must be informed of the right to request and obtain a credit score.

A nationwide consumer reporting agency recommends that the requirement of proposed rule § 610.2(b)(2)(iv)(A) that the centralized source provide “information on the progress of the consumer’s request while the consumer is engaged in the process of requesting a file disclosure” be limited to requests made using the Internet website. This commenter argues that this requirement will cause confusion in the telephone request context. The Commission has decided not to adopt this recommendation because it finds such information to be useful in the context of a telephone request. The purpose of having the centralized source provide such information is to ensure that consumers do not mistakenly discontinue the order process without finishing their request. The centralized source could comply with this requirement in the telephone context, for example, by instructing consumers to “please hold while we find your record.”

A nationwide consumer reporting agency recommends that the requirement of proposed rule § 610.2(b)(2)(iv)(A) be modified to state that it is not intended to allow a consumer to return to the centralized source to check the “status” of a request for an annual file disclosure already made, but rather is intended to keep the consumer informed as the request is

being made. The language of the rule provision itself is clear on this point: it requires information on the progress of the request “while the consumer is engaged in the process of requesting a file disclosure.” This provision is intended only to require the centralized source to communicate with the consumer while the consumer is in the process of providing information to make the request. Once all the requisite information is provided, there is no further obligation for the centralized source to “update” consumers on the status of the processing of their request. The Commission has determined that the rule provision is clear as stated, and accordingly, adopts it as proposed. Final rule § 610.2(b)(2)(iv)(A).

The Commission received no comments regarding the language of proposed rule §§ 610.2(b)(2)(iv)(B) and (C). The Commission adopts § 610.2(b)(2)(iv)(A)-(C) as set forth in the proposed rule.

Make standardized form available.

Proposed rule § 610.2(b)(3) required that the centralized source make available to consumers a standardized form established jointly by the nationwide consumer reporting agencies. The Commission has adopted a model form which may be used to comply with this section. See final rule § 698, App. D. and the discussion of that section in this notice, infra. The Commission did not receive comment on § 610.2(b)(3), and it is adopted as proposed.

The Commission did, however, receive comments on the content of the model standardized form contained in the proposed rule. These comments, and the final rule modifications to the model form, are discussed under the section of this notice entitled “Part 698 Appendix D,” infra.

Section 610.2(c)—Requirement to anticipate

Proposed rule § 610.2(c) required nationwide consumer reporting agencies to implement reasonable procedures to anticipate and respond to the volume of consumers who will contact the centralized source through each request method. This requirement included developing and implementing contingency plans to address circumstances that may materially and adversely impact the centralized source. These contingency plans were to include measures to minimize the impact of such circumstances.

Implement reasonable procedures to anticipate and respond to volume.

General requirement.

CDIA and the nationwide consumer reporting agencies object to the proposed rule requirement that nationwide consumer reporting agencies “implement reasonable procedures to anticipate, and respond to, the volume of consumers who will contact the centralized source through each request method, to request, or attempt to request, a file disclosure.” Proposed rule § 610.2(c). These commenters argue that this requirement will put them in the untenable position of defending their “guesses” regarding the required capacity, against the perfect hindsight of consumer litigants and the Commission.

This is not the case. Proposed rule §610.2(c) required only that the nationwide consumer reporting agencies develop and implement reasonable procedures to anticipate volume. It did not require the nationwide consumer reporting agencies to anticipate volume perfectly. The nationwide consumer reporting agencies have considerable experience in anticipating the likely volume of consumer contacts. For example, in the last five years, they have developed and implemented procedures to anticipate the volume of consumer calls to their toll-free dispute telephone numbers to facilitate their compliance with FCRA requirements.

Also, the nationwide consumer reporting agencies have had to anticipate consumer request volume for free disclosures in those states where, under state law, consumers have previously been granted the right to obtain them. The Commission believes it is critical to meeting the objectives of the centralized source that the nationwide consumer reporting agencies implement reasonable procedures to anticipate and respond to consumer contact volume. The Commission believes this standard is both feasible and appropriate.

See, U.S. v. Equifax Credit Information Services, Inc., 1:00-CV-0087 (N.D. GA 2000), http://www.ftc.gov/os/2000/01/equifaxconsent.htm, U.S. v. Experian Information Solutions, Inc., 3-00CV0056-L (N.D. TX 2000), http://www.ftc.gov/os/2000/01/experianconsent.htm, U.S. v. Trans Union LLC, Civil Action No. 00C0235 (N.D. IL 2000), http://www.ftc.gov/os/2000/01/transunionconsent.htm.

Set point for initial capacity.

Proposed rule § 610.2(c) required the nationwide consumer reporting agencies to implement reasonable procedures to anticipate and respond to the volume of consumer contacts, both during and after the transition period for the centralized source. CDIA and the nationwide consumer reporting agencies argue that the absence of any actual volume data for centralized source operations makes this requirement impossible to meet during the first two years of implementation of the centralized source. These commenters claim that the Commission itself has declared initial request volume impossible to estimate,

and, in the absence of any reliable historical data, the nationwide consumer reporting agencies should not be required to anticipate and respond to the “unknowable” volume of consumer contacts.

Comment, CDIA #000018. While the Commission acknowledged in the NPR that accurately anticipating the initial volume for the centralized source would be difficult, it did not state, and does not believe, that it is “impossible.” See 69 FR at 13198. This is especially true because the proposed and final rules require only reasonable procedures to anticipate volume.

See, e.g., Comment, Experian Information Solutions, Inc. #000040.

CDIA and the nationwide consumer reporting agencies suggest that the Commission should designate the starting capacity for the centralized source in the rule itself. Further, they argue that the starting capacity set point should constitute a safe harbor from all liability under the rule for the first two years of operations of the centralized source. In other words, they contend that the Commission should designate the starting capacity, and the nationwide consumer reporting agencies should not be required to exceed that capacity until December 2006.

For a number of reasons, the Commission does not believe such a rule provision would be appropriate, and thus has declined to adopt this suggestion. As noted above, the Commission believes that the § 610.2(c) requirement to implement reasonable procedures to anticipate and respond to capacity is both feasible and appropriate. In the NPR, the Commission explained how such reasonable procedures might be implemented, for example, by conducting a sample analysis of the only probative data available at that time. Thus, the Commission noted that,

“Although the precise demand for consumer free annual file disclosures on a nationwide basis is largely unknown, there is some available information that appears to be instructive in anticipating request volume when the rule becomes effective. For example, according to a Congressional Research Service Report to Congress, the consumer request rate for file disclosures in states where free annual disclosures are not currently available is 0.5% to 2%. In those states where consumers are, by state law, already guaranteed the right to a free annual disclosure, the request rate ranges from 3.5% to 10%. This represents an average disclosure rate that is 231% [of] the request rate in

other states.

Based upon these statistics alone, and taking into account also the publicity likely to be generated by the promulgation of the final rule, it would be reasonable to anticipate that the number of requests for annual file disclosures will be 300% of the current disclosure rate, absent any unanticipated intervening factors.”

Loretta Nott and Angie Welborn, “A Consumer’s Access to Free Credit Report: A Legal and Economic Analysis,” Congressional Research Service, Library of Congress, July 21, 2003, p. 11.

69 FR at 13198. Based upon the comments and the information available to date, the Commission continues to believe that 300% of the current rate of file disclosures is a reasonable estimation of needed initial capacity for the centralized source.

Further, the Commission believes that the comments of CDIA and the nationwide consumer reporting agencies themselves demonstrate that it is possible to implement reasonable procedures to anticipate and respond to the volume of consumers who will contact, or attempt to contact, the centralized source.

The nationwide consumer reporting agencies, not the Commission, are in the best position to anticipate likely demand for annual file disclosures, particularly as the initial implementation of the centralized source begins to provide additional data on the likely level of demand. The rule is designed and intended to require only that the nationwide consumer reporting agencies develop a reasonable initial estimate of adequate capacity, and then reasonably expand capacity if those estimates prove too low. Further, the nationwide consumer reporting agencies have decades of experience in dealing with consumer requests and disputes relating to consumer reports. In the Commission’s view, it would not be appropriate to substitute its estimation of consumer demand for free annual file disclosures for that of the seasoned business judgment of organizations that have superior access to existing relevant information and experience in the industry.

Trans Union declares that “we believe that there is sufficient data regarding experience with state free file disclosure requirements that would enable the Commission to develop a clear and reasonable standard for central source capacity at its inception.” Comment, Trans Union #000035. CDIA states that it “believes the initial capacity should be based on experiential data.” Comment, CDIA #000018. CDIA goes on to explain:“CDIA believes that the consumer request volume will be the highest in the first year that the centralized source is in operation. . . . As discussed above, . . . data indicates that consumer requests for all their file disclosures will be based on 231% of the current total number of requests for file disclosures received by the nationwide consumer reporting agencies in states that do not currently require free file disclosures. Thus, the approximate percentage attributable to the new federal free file disclosure right should be 131% of the current file disclosure request rate in those states. The total volume based upon those percentages should be adjusted to reflect the fact that 43 of the 51 jurisdictions do not currently require free file disclosures. The initial capacity of the centralized source and of each nationwide consumer reporting agency should be determined by applying the appropriate formula (i.e., based upon 231% or 131%) to the daily average of all consumer requests for file disclosures received by the nationwide consumer reporting agencies . . . .” These comments demonstrate that it is possible to examine existing data, draw conclusions based upon that examination, and develop reasonable procedures based upon those conclusions.

Similarly, as discussed further under § 610.2(i) of this notice, infra, the Commission does not believe that reasonable estimations can be made only after a full two years of centralized source operations. The final rule does, however, provide the nationwide consumer reporting agencies with a reliable safe harbor structure, based upon request volume, that applies both during and after the centralized source transition period. See discussion under §§ 610.2(e) and 610.2(i)(2)-(3), infra.

Developing and implementing contingency plans.

As part of its requirement for reasonable procedures to anticipate and respond to consumer request volume, proposed rule § 610.2(c) required the nationwide consumer reporting agencies to develop and implement contingency plans to address circumstances that may materially and adversely impact the operation of the nationwide consumer reporting agency, a centralized source request method, or the centralized source. Examples of the types of circumstances for which the nationwide consumer reporting agencies were required to develop contingency plans included natural disasters, telecommunications interruptions, equipment malfunctions, labor shortages, computer viruses, coordinated hacker attacks, and seasonal or other fluctuations in consumer request volume.

CDIA, the nationwide consumer reporting agencies, and some members of Congress comment that these provisions of the proposed rule “essentially require[d] the nationwide consumer reporting agencies to anticipate the unpredictable”

and “perform despite those disasters.”

These commenters suggest that the proposed rule imposed liability upon the nationwide consumer reporting agencies even if they were unable to accept or respond to consumer requests due to some unpredictable and materially adverse event. These commenters go on to posit that it would be more appropriate for the final rule to relieve the nationwide consumer reporting agencies of liability in the event of such circumstances than to impose a requirement to reasonably anticipate and respond to events that may be completely outside their control.

Comment, CDIA #000018.

Comment, Equifax Information Services, LLC #000028. See also, Comment, Experian Information Solutions, Inc. #000040; Comment, U.S. House of Representatives Committee on Financial Services #000136; and Comment, U.S. Senate #000137.

The proposed rule was not intended to suggest that nationwide consumer reporting agencies should be required to process requests for annual file disclosures despite any and all unpredictable and uncontrollable events that may hamper their performance. Rather, proposed rule § 610.2(c) was intended to require only that the nationwide consumer reporting agencies consider the types of material and adverse events that are reasonably likely to occur, and develop reasonable plans to address such events in ways that will minimize impact on the centralized source. Further, the Commission did not intend that this provision should be interpreted to require nationwide consumer reporting agencies to develop precise and unique plans for every particular event listed in the proposed rule or otherwise anticipated. Rather, the intent of this provision was to require that generally appropriate plans be developed and implemented, based upon the types of interruption such events may bring. Accordingly, final rule § 610.2(c) has been modified to clarify this intent, and references to specific types of events have been removed.

As clarified, the Commission believes the requirement for nationwide consumer reporting agencies to develop and implement contingency plans for material and adverse circumstances that are reasonably likely to occur is appropriate. The Commission notes that it is common practice in many industries to develop contingency and recovery plans for events that are not completely predictable but likely enough that contingency plans are appropriate. For example, it is not possible to predict exactly where and when a hurricane may strike. The final rule would not require nationwide consumer reporting agencies to have hurricane contingency plans regardless of where centralized source operations are located. If, however, centralized source operation centers are located in Miami, Florida, it would be reasonably likely—based upon historical weather patterns for that region— that a hurricane may occur that would materially and adversely impact those operations. In such a case, the final rule

would require the nationwide consumer reporting agencies to develop and implement contingency plans to minimize the impact of such events, to the extent reasonably practicable under the circumstances.

The Commission also recognizes that some events may be predictable, but are so devastating that there are no reasonable measures that can be implemented to minimize impact. Thus, the Commission intends that the required contingency plans be tempered by two factors: the likelihood of a material and adverse event occurring, and the extent to which particular measures to minimize impact are reasonable under the circumstances. For example, even though a hurricane that will materially and adversely impact the centralized source operations in Miami, Florida may be reasonably likely to occur, the contingency plan for such an event need not include measures to minimize the impact of the complete destruction of the centralized source operations by a hurricane. Even if hurricanes of such destructive magnitude may have occurred in the region previously, there are no reasonable measures that could be undertaken to minimize the impact of such a devastating event.

As revised, § 610.2(c) is intended to reflect what would be sound business planning in nearly any industry. Indeed, in the Commission’s view, the nationwide consumer reporting agencies may comply with the requirement to develop and implement contingency plans under final rule § 610.2(c) by implementing the same contingency procedures for centralized source operations that they maintain and implement for their for-profit enterprises.

Specific measures to minimize impact.

Under the proposed rule the contingency plans required by paragraph (c) were to include specific reasonable measures to minimize the impact of material and adverse circumstances on the operation of the centralized source. These measures included, but were not necessarily limited to: (1) providing information to consumers on how to use another available request method; (2) communicating, to a consumer who attempts but is unable to make a request, the fact that a condition exists that has precluded the centralized source from accepting all requests, and the period of time after which the centralized source is reasonably anticipated to be able to accept the consumer’s request for an annual file disclosure; and (3) taking all reasonable steps to restore the centralized source to normal operating status as quickly as possible. Measures to minimize impact also included, as appropriate, collecting request information but declining to accept the request for processing until a reasonable later time, provided that the nationwide consumer reporting agency clearly and prominently informs the consumer when it will accept the request for processing. Proposed rule § 610.2(c)(2).

Industry commenters on this provision generally believe the list of measures to minimize impact to be sufficiently inclusive and the measures appropriate. CDIA and one nationwide consumer reporting agency comment, however, that, as proposed, this section required some measures to be performed “to the extent possible.” These commenters argue that a standard of what is “possible” is too broad and subjective to be truly meaningful. To address these concerns, the final rule provides that these measures should be undertaken “to the extent reasonably practicable under the circumstances.” Final rule § 610.2(c)(1).

Centralized source maintenance.

One nationwide consumer reporting agency comments that temporary outages may result from the need to perform maintenance on the centralized source Internet website or telephone lines. The commenter requests that the final rule clarify that such outages are not violations of the rule. The Commission acknowledges that particular request methods may be unavailable for reasonable periods of time due to the need for maintenance. Accordingly, final rule § 610.2(c)(2) provides that nationwide consumer reporting agencies shall not be in violation of the final rule’s adequate capacity requirement if a centralized source request method is unavailable for a reasonable period of time for purposes of maintenance. This provision requires, however, that only one request method be unavailable for such maintenance at any given time.

In light of the foregoing discussion, the Commission adopts proposed rule § 610.2(c) with some modifications. As explained above, the final rule requires nationwide consumer reporting agencies to develop and implement contingency plans for material and adverse events that are reasonably likely to occur. These contingency plans must contain measures to minimize impact “to the extent reasonably practicable under the circumstances.” Further, the final rule includes a new subparagraph (3) to clarify that the nationwide consumer reporting agencies are not in violation of the rule if a centralized source request method is temporarily unavailable for maintenance. Final rule §§ 610.2(c)(1) and (2). The Commission believes that final rule § 610.2 (c) appropriately balances the considerations of minimizing potential disruptions of the centralized source, and providing nationwide consumer reporting agencies with both flexibility and sufficient guidance in their compliance obligations.

Section 610.2(d)—Disclosure of all files

The proposed rule, in § 610.2(d), required a nationwide consumer reporting agency to provide an annual file disclosure to any consumer who requests one if the consumer reporting agency has the ability to provide a consumer report to a third party relating to that consumer. As noted in the NPR, this provision was intended to ensure that every consumer can obtain annual file disclosures through the centralized source from each of the nationwide consumer reporting agency systems, regardless of whether the information in that consumer’s file is owned by the nationwide consumer reporting agency or an associated consumer reporting agency. See 69 FR at 13197.

Files Owned by Associated Consumer Reporting Agencies.

As noted in the discussion of the definition of associated consumer reporting agency, supra, some nationwide consumer reporting agencies house within their systems data owned by one or more associated consumer reporting agencies. By virtue of such relationships with associated consumer reporting agencies, a nationwide consumer reporting agency, which does not itself own consumer files in a localized area or region of the country, is able to provide consumer reports on consumers residing in that area or region to its customers. On that basis, the proposed rule required nationwide consumer reporting agencies to provide free annual file disclosures to any consumer for whom they could sell a consumer report, even if they did not “own” that particular consumer’s file.

Representatives of the nationwide consumer reporting agencies raise many objections to this requirement. They comment that requiring them to disclose files owned by another consumer reporting agency is contrary to the intent of Congress, and outside the scope of the FACT Act. These commenters assert that although, absent such a requirement, not all consumers would be able to obtain annual file disclosures from each of the three identified nationwide consumer reporting agencies through the centralized source, this is a “problem,”

in their view, based in the FACT Act itself, and the Commission should not attempt to fix it.

As stated in the NPR, the Commission believes that the legislative history indicates Congressional intent that all consumers be able to obtain free annual file disclosures from each of the three known nationwide consumer reporting agencies.

The Commission does not believe that it was the intent of Congress to create pockets of the country in which consumers could obtain only one or two annual file disclosures through the centralized source. Further, the language of the FACT Act places the responsibility for providing annual file disclosures solely on the nationwide consumer reporting agencies. The Commission believes, therefore, that the intent of Congress and the mandate of the FACT Act are best realized by requiring the nationwide consumer reporting agencies to disclose to consumers all files in their possession that they can provide to third parties, including those residing on their systems but owned or maintained by an associated consumer reporting agency. Moreover, the Commission believes it is appropriate that if a nationwide consumer reporting agency has the ability to provide a consumer report on a consumer to a third party, and thereby profit from the sale of that report, that nationwide consumer reporting agency should disclose the file to the consumer.

“The centralized system shall allow consumers to obtain free reports from all three [nationwide consumer reporting] agencies using a single request.” S. Rep. No.108-166, at 17 (2003) (emphasis supplied).

As an alternative means of providing free annual file disclosures to all consumers, the nationwide consumer reporting agencies suggest that an associated consumer reporting agency should be considered a “consumer reporting agency that compiles and maintains files on consumers on substantially a nationwide basis,” as referred to in § 211(d)(6)(A) of the FACT Act, and that such agencies should be obligated to provide consumers with annual file disclosures through the centralized source. These commenters assert that all associated consumer reporting agencies are substantially nationwide, based upon their relationships with nationwide consumer reporting agencies. The Commission notes that associated consumer reporting agencies are a diverse group of entities, including many that own consumer credit files for only a small geographic area. The Commission believes it is not appropriate to classify all associated consumer reporting agencies, regardless of their size, the scope of their operations, or the number of files they own, as compiling and maintaining files on consumers “on substantially a nationwide basis” based solely on their contractual relationships with nationwide consumer reporting agencies.

See discussion under section IV of this notice, infra.

The nationwide consumer reporting agencies also assert that this provision is unfair. They argue that the requirement to provide annual file disclosures for files owned by associated consumer reporting agencies gives the associated consumer reporting agencies an overwhelming advantage in any negotiations between the two entities for supplying and paying for the file disclosures. These commenters suggest that the Commission should include in the final rule provisions that would govern the bargaining between these entities-for example, by prohibiting the charging of certain fees by the associated consumer reporting agencies. The nationwide consumer reporting agencies assert that otherwise they will have unequal bargaining power when negotiating contracts with the associated consumer reporting agencies.

The Commission does not believe it is appropriate or necessary to intervene in the contractual relationships between the nationwide consumer reporting agencies and the associated consumer reporting agencies. These relationships have existed for many years, during which the parties have managed to successfully negotiate various kinds of terms and adjust to a wide variety of economic and regulatory changes affecting the industry. The nationwide consumer reporting agencies’ assertion that they will have little leverage in these negotiations seems improbable given the reciprocal and symbiotic nature of the relationships between these entities. The parties involved rely on each other to provide products or services of value to their customers. The associated consumer reporting agencies rely on the nationwide consumer reporting agencies to obtain updates for, and to some extent, to sell their consumer reports on a national basis. In return, the nationwide consumer reporting agencies rely on the associated consumer reporting agencies for access to files in parts of the country where the nationwide agency does not own files. It is clearly in the interests of both parties to maintain these relationships, and the Commission does not believe that the final rule will disrupt those interests or be substantially unfair to any of the parties.

In addition, one nationwide consumer reporting agency comments that the proposed rule does not specify that this provision applies only to its own files and those of associated consumer reporting agencies. Therefore, this commenter asserts, the rule provision could also be read to require a nationwide consumer reporting agency to disclose files owned by any other consumer reporting agency, regardless of whether the files were housed in the system of the nationwide consumer reporting agency. In order to clarify that this obligation applies only to files that are either owned by the nationwide consumer reporting agency itself, or housed on that agency’s system but owned by an associated consumer reporting agency, the final rule includes modified § 610.2(d) that clarifies the intended limited application of this provision.

Proper Identification of Consumers.

One nationwide consumer reporting agency comments that the obligation to provide an annual file disclosure should apply only when the nationwide consumer reporting agency can confirm the requester’s identity. The Commission notes that FCRA § 610(a)(1), 15 U.S.C. 1681h(a)(1), requires consumer reporting agencies to obtain proper identification from consumers before providing file disclosures. This statutory provision applies to those disclosures requested through the centralized source. Accordingly, § 610.2(d) of the rule has been modified to clarify that the nationwide consumer reporting agencies are obligated to provide annual file disclosures only upon proper identification in compliance with § 610(a)(1) of the FCRA, and § 610.2(b)(2)(ii) of the final rule.

Section 610.2(e)—High request volume and extraordinary request volume

The Commission recognizes that there may be times when the volume of consumer requests for file disclosures may be higher than anticipated, such as may overwhelm the systems of a nationwide consumer reporting agency or a nationwide specialty consumer reporting agency. As noted in the NPR, the Commission recognizes that, even with careful planning and preparation, it may be difficult for the nationwide consumer reporting agencies to anticipate and respond to consumer request volume under all circumstances. In light of these uncertainties, and in consideration of the possible impact of unexpected and extraordinary demand for annual file disclosures on the ability of the nationwide consumer reporting agencies to produce other file

disclosures and consumer reports, the proposed rule provided some limits on the liability of nationwide consumer reporting agencies during times when request volume significantly exceeds what could reasonably have been anticipated. Proposed rule § 610.2(e).

Members of Congress, industry commenters-including CDIA, nationwide and associated consumer reporting agencies, and several trade organizations-strongly support the concept of liability relief (sometimes called “surge protection”) during times of heavy consumer request volume. These comments provide a number of compelling arguments that reasonable surge protection must be a feature of the final rule. They posit that, without such protections, the nationwide consumer reporting agencies could be overwhelmed with unexpected volume and be unable to respond to consumer requests-a situation that would frustrate consumers and thwart the purposes of the FACT Act and the rule. They also contend that maintaining vast amounts of excess capacity for the sole purpose of responding to sporadic surges is wasteful and prohibitively expensive.

In addition, a number of commenters who represent organizations that furnish consumer report information to nationwide consumer reporting agencies comment that large surges in annual file disclosure request volume may have a ripple effect for the whole financial services industry. Even if nationwide consumer reporting agencies could accept and process all of the requests for annual file disclosures during a surge, the corresponding surge in consumers contacting the nationwide and associated consumer reporting agencies and furnishers to dispute information contained in those reports would constitute a significant strain on the financial services industry. These commenters assert that surge protection must be provided to manage the number of requests for annual file disclosures that are accepted by nationwide consumer reporting agencies in the first instance, in part to allow the nationwide and associated consumer reporting agencies and furnishers to manage these “back end” effects.

In response to these comments, the final rule provides two tiers of relief for times when the consumer request volume is higher than the normal fluctuations in demand. In times of “high request volume”— i.e., when volume exceeds 125% of average — nationwide consumer reporting agencies may delay accepting requests for processing until a reasonable later time.

Final rule § 610.2(e)(1). In addition, the rule provides a more complete limitation on liability in times of “extraordinary request volume”—i.e. exceeding 175% of the daily average volume- by allowing nationwide consumer reporting agencies to decline requests at such times. The Commission believes the combined structure of high request volume relief and extraordinary request volume relief provides the industry with adequate protection from unexpected, overwhelming request volume.

Except as provided in §§ 610.2(i) and 610.3(g), high request volume occurs when the number of consumers requesting or attempting to request file disclosures during any 24-hour period is more than 125% of the daily rolling 90-day average. Final rule § 610.1(b)(8).

High and extraordinary request volume thresholds.

Under the proposed rule, extraordinary request volume occurred when the volume of requests exceeded twice the daily average volume. The Commission received comment from consumer advocacy groups expressing concern that the proposed rule definition of “extraordinary request volume” set the bar too low for the nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies to obtain relief from the rule’s requirements. In particular, these commenters are concerned that because extraordinary request volume was defined as only twice the daily average of consumer requests, a single security breach or national media event could produce request volume at the “extraordinary” level, thus allowing nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies to stop fulfilling file disclosure requests too frequently. In contrast, representatives of the nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies, as well as some members of Congress, express concern that relief that is triggered at twice the daily rolling average is, in fact, no relief at all. These commenters argue that such a standard would require the nationwide consumer reporting agencies to maintain an unrealistic amount of costly, daily excess capacity.

The Commission notes that while the nationwide consumer reporting agency and nationwide specialty consumer reporting agency commenters agree that the extraordinary request volume threshold contained in the proposed rule is too high, they are not similarly uniform in their opinion as to what the appropriate threshold should be. The nationwide consumer reporting agencies, as well as an associated consumer reporting agency, suggest the proper threshold is 125% of average volume. One nationwide specialty consumer reporting agency commenter suggests 110% of average volume.

In addition, industry commenters noted that under the proposed rule, nationwide consumer reporting agencies, during the transition period, were permitted to queue requests for file disclosures and delay accepting such requests until a reasonable later time, when “high request volume” occurs. No such relief was provided under the proposed rule for nationwide specialty consumer reporting agencies or for nationwide consumer reporting agencies after the transition period. Compare proposed rule §§ 610.2(i)(3) and 610.3(g). Accordingly, industry commenters urge the Commission to revise the final rule to (1) lower the extraordinary request volume threshold from 200% to 125%, and (2) allow nationwide consumer reporting agencies to delay accepting requests for file disclosures by queuing them at an intermediate threshold of 115%, and to continue to have this option beyond the transition period. Some commenters also ask the Commission to adopt “high request volume” provisions that would apply to nationwide specialty consumer reporting agencies, both during and after the transition period. As noted above, the Commission agrees that the addition of high request volume relief during and after the transition for both nationwide and nationwide specialty consumer reporting agencies is appropriate.

In support of their argument that “high request volume” should be defined as any volume that exceeds 115% of the rolling daily average volume, the nationwide consumer reporting agencies posit that demand for file disclosures is so volatile and difficult to predict that even modest fluctuations beyond the average volume are likely to cause significant difficulty for their operations. The Commission notes that, according to CDIA, “volatility in contact rates usually ranges no higher (or lower) than 20% of the average baseline of contact.”

The Commission believes that the nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies should be prepared to respond to such day-to-day volatility. High request volume and extraordinary request volume provisions, on the other hand, should be available to address volatility that significantly exceeds the norm.

Comment, CDIA #000018.

In light of these comments, the final rule provides for “high request volume” relief when the number of consumers requesting or attempting to request file disclosures exceeds 125% of the rolling daily 90-day average volume. The Commission believes requiring the

nationwide consumer reporting agencies to be prepared to accept 125% of the daily rolling 90-day average of consumer requests is reasonable. As one nationwide consumer reporting agency asserted: “We believe that maintaining a 25% buffer in excess capacity should be reasonably achievable and should be sufficient based on our historical experience with surges in demand for file disclosures.”

Comment, Trans Union #000035.

Further, the Commission notes that the threshold for extraordinary request volume is meant to be truly extraordinary because, at that level, the rule provides complete relief from liability. For as long as that level is maintained, the nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies are protected from liability under the rule even if they decline to accept additional consumer requests for file disclosures. See final rule §§ 610.2(e)(2) and 610.3(c)(2). As noted above, the Commission believes the nationwide consumer reporting agencies should be prepared to respond to normal, day-to-day volatility of 25% over average volume. The Commission also believes, however, that a volume that is more than three times that normal variation in demand—i.e. 175% of rolling 90-day daily average—would be “extraordinary,” and consequently the level at which extraordinary relief should be provided. Accordingly, the final rule provides that “extraordinary request volume” is volume that exceeds 175% of rolling 90-day daily average volume.

As noted above, some consumer advocacy groups assert that the high and extraordinary request volume threshold should not be set at a level that is likely to be triggered by a single event. The Commission notes, however, that the capacity of the centralized source likely cannot be expanded and contracted immediately in response to sudden, unpredictable events.

Accordingly, the final rule provides for high and extraordinary request volume relief at request levels that significantly exceed normal fluctuations in demand, regardless of the particular causes of such fluctuations.

The commenters who argue that extraordinary request volume relief should not be available at a level likely to be triggered by a single event cite to the possibility of a large-scale security breach or incidence of identity theft. The Commission notes that while the consumers impacted by such events may choose at that point in time to seek their annual file disclosures through the centralized source, that is not the only means by which they might obtain a file disclosure under those circumstances. Under the FCRA, an individual who “has reason to believe that the file on the consumer at the agency contains inaccurate information due to fraud” is entitled to a free file disclosure during any 12-month period. FCRA § 612(c)(3), 15 U.S.C. 1681j(c)(3). In addition, a consumer who asserts a good faith suspicion that he or she is or is about to become a victim of fraud or identity theft is entitled to a free file disclosure. FACT Act § 112, codified at FCRA § 605A, 15 U.S.C. 1681c-1. The Commission notes that these free file disclosures are available to consumers in such circumstances, in addition to — not in place of — the annual free file disclosure to be provided through the centralized source. FACT Act § 211(a), codified at FCRA § 612(a), 15 U.S.C. 1681j(a).

To ensure that the high and extraordinary request volume threshold functions as intended, however, the final rule alters the definition of extraordinary request volume slightly. The Commission notes that, once extraordinary request volume is reached, attempts to make requests for file disclosures may be declined or queued for later processing. See final rule §§ 610.2(e) and 610.3(c). These attempted requests, to the extent that they can be tracked, should be considered part of the consumer request volume. Accordingly, the final rule modifies the proposed rule’s definition of “extraordinary request volume” to make clear that the threshold is calculated based upon “the number of consumers requesting, or attempting to request, file disclosures during any 24-hour period.” Final rule § 610.1(b)(6).

Under the final rule high and extraordinary request volume are measured on the basis of requests for all types of file disclosures, rather than only requests for annual file disclosures. Although the FACT Act requires the nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies to develop the centralized source and streamlined process described in the final rule for the purpose of receiving requests for annual file disclosures, Congress specifically directed the Commission to consider “the significant demands that may be placed on consumer reporting agencies in providing [annual file disclosures],” and “appropriate means to ensure that consumer reporting agencies can satisfactorily meet those demands.” FACT Act § 211(d)(2). The significant demands of providing annual file disclosures include demands associated with simultaneously responding to requests for other types of file disclosures, such as free file disclosures resulting from adverse action under FCRA § 612(b), 15 U.S.C. 1681j(b), and free file disclosures provided in response to suspected fraud under FCRA § 612(c)(3), 15 U.S.C. 1681j(c)(3). Further, consumer reporting agencies may face additional significant demands in responding to inquiries, or requests for reinvestigation,

generated through each of these types of file disclosures.

Delays in this system caused by excess demand may adversely impact consumers with a specific, immediate need for access to their file disclosures and to reinvestigation procedures. Accordingly, it is appropriate to consider the volume of request for all types of file disclosures in determining “extraordinary request volume” for the purpose of limiting liability under the final rule. Final rule § 610.1(b)(6).

See FCRA § 611(a), 15 U.S.C. 1681i(a).

The Commission notes that the FACT Act has expanded consumers’ rights to obtain a free file disclosure in a number of ways. See, e.g., FACT Act § 112.

For the same reasons, high request volume also is calculated based upon volume of all types of file disclosures.

In addition, the Commission recognizes that the volume of requests for annual file disclosures will be particularly difficult to predict and volatile during the transition period. Due to such special considerations during the transition period, high and extraordinary request volume is defined differently during that period.

See discussion of §§ 610.2(i) and 610.3(g) infra.

The final rule definition of extraordinary request volume found in § 610.1 (b)(6) also makes clear that this definition will prevail, except during the transition periods defined in §§ 610.2 (i) and 610.3 (g). As noted, the term is defined differently in those sections, for the duration of the transition periods described.

High and extraordinary request volume protections.

When high request volume occurs, nationwide consumer reporting agencies may collect consumer request information and delay accepting the request for processing until a reasonable later time. The nationwide consumer reporting agency must, however, clearly and prominently inform the consumer of when the request will be accepted for processing. This provision will provide nationwide consumer reporting agencies with some protection from unexpected surges, and, as one consumer advocacy group points out, it has the benefit of eliminating the need for consumers within the surge to reinitiate contact with the centralized source at a later time in order to obtain an annual file disclosure. In order to take advantage of this high request volume protection, however, the nationwide consumer reporting agency must implement reasonable procedures to anticipate consumer request volume developed in compliance with final rule § 610.2(c).

The FACT Act requires nationwide consumer reporting agencies to provide annual file disclosures within 15 days of

when the request is received. By permitting nationwide consumer reporting agencies to queue some requests for annual file disclosures during times of high request volume, the final rule allows the nationwide consumer reporting agencies to postpone receiving those requests — and thereby postpone the running of the 15-day delivery requirement — for a reasonable period of time.

What constitutes a “reasonable period of time” to postpone accepting requests will likely depend on a number of factors, including the length and magnitude of the surge. For example, if high request volume lasts only one day, it may not be reasonable to postpone accepting the request for annual file disclosures for three weeks. In addition, the rule does not specify how the nationwide consumer reporting agencies should process requests placed in a queue versus new requests after high request volume ceases. The nationwide consumer reporting agencies are in the best position to manage their resources to process these requests. However, because the nationwide consumer reporting agencies may only postpone accepting requests for a “reasonable period of time,” they must efficiently process requests placed in a queue, and it would be logical to process requests in a chronological order from the time they were received.

Under final rule § 610.2(e)(2), when extraordinary request volume occurs, nationwide consumer reporting agencies will not be deemed in violation of the rule’s requirement for adequate capacity, provided that they implement reasonable procedures to anticipate consumer request volume in compliance with § 610.2(c). This provision is adopted as proposed, with only minor modifications.

In the event of high or extraordinary request volume affecting a particular request method, the final rule requires nationwide consumer reporting agencies to direct consumers to other available request methods to the extent reasonably practicable. Final rule § 610.2(c)(1)(i)(A). Thus, high or extraordinary request volume affecting just one request method would not necessarily lead to a limitation on liability in relation to the operation of the other request methods.

The Commission believes that—taken in combination with the provisions of the FACT Act itself— the high and extraordinary request volume protections will provide appropriate and sufficient relief to the nationwide consumer reporting agencies and other affected businesses during times of unexpected, heavy volume. The 15-day time line for providing reports prescribed under the FACT Act allows considerable flexibility for nationwide consumer reporting agencies to smooth normal fluctuations in demand for “back end” services by managing when the requested annual file disclosures are provided. In times of excess volume, final rule provisions for high and extraordinary request volume allow the nationwide consumer reporting agencies additional flexibility to manage both the acceptance of the requests and timing of the processing of the requests.

Liability limitations contingent upon reasonable procedures.

CDIA and the nationwide consumer reporting agencies also comment that, under the proposed rule, surge protection was contingent upon the nationwide consumer reporting agency having complied with the § 610.2(c) requirement to develop and implement reasonable procedures to anticipate and respond to request volume. These comments assert that the development of contingency plans for material adverse events and relief from the effects of excess consumer request volume must remain distinct. To support this argument, CDIA uses this example:

“[i]t would be possible for the nationwide consumer reporting agencies to adopt reasonable procedures to anticipate consumer request volume, but to have the actual demand exceed their reasonable expectations. Under the proposed rule, these agencies could avail themselves of the extraordinary request volume provisions or high request volume provisions only if the agencies had also developed and implemented contingency plans to address circumstances that would materially and adversely impact the operations, even if none of those circumstances affected the actual volume of requests.”

Comment, CDIA #000045.

The Commission believes this argument misinterprets the intended application of the rule. The purpose of requiring the nationwide consumer reporting agencies to implement reasonable procedures at all times, including during times of high or extraordinary request volume, is to ensure that the agencies respond, to the extent reasonably practicable under the circumstances, to material and adverse circumstances that impact the centralized source. It would seem of little use to require nationwide consumer reporting agencies to develop and implement reasonable procedures to anticipate and respond to consumer demand if there was no corresponding requirement to implement those procedures when they are most needed. Final rule § 610.2(e) ensures that excessive volume does not excuse the nationwide consumer reporting agencies from their responsibility to implement reasonable procedures to minimize impact on the centralized source, as required under § 610.2(c). Conversely, final rule § 610.2(e) should not be interpreted to deny high and extraordinary request volume protections to a nationwide consumer reporting agency because the agency failed to develop and implement contingency plans for events that are unrelated to the ability of the agency to respond to request volume during the time period at issue.

Ongoing staggering of availability of file disclosures.

The FACT Act § 211(d)(2) directs the Commission to consider “appropriate means to ensure that consumer reporting agencies can satisfactorily meet [the demands of providing annual file disclosures], including the efficacy of a system of staggering the availability to consumers of such [annual file disclosures].” The proposed rule provided for a staggering of availability over a nine-month transition in which regions of the country would successively become eligible every three months. The NPR stated that “there is no basis for concluding ongoing staggering of the availability of annual file disclosures is necessary” and, accordingly, the proposed rule did not provide for such staggering beyond the transition period. 69 FR at 13196.

The nationwide consumer reporting agencies urge the Commission to change this process in two ways: (1) to permit consumers to request file disclosures only during discrete periods of time (e.g., birth month or birth quarter); and (2) to continue this segmentation in perpetuity. One nationwide consumer reporting agency expresses doubt that the Commission has properly considered ongoing, permanent staggering of annual file disclosure availability. This commenter maintains the Commission is “ignor[ing] the plain language of the statute [by] maximizing consumer ease of access at the expense of the staggered availability contemplated by the statute.”

The commenter suggests that the FACT Act requires the Commission to adopt such staggering if it is found to be effective in ensuring that nationwide consumer reporting agencies can meet their responsibilities.

Comment, Equifax Information Services LLC #000028.

The Commission has considered the significant demands placed upon the nationwide and nationwide specialty consumer reporting agencies in the process of formulating both the proposed and the final rule. As noted in the NPR, these demands include not only the provision of annual file disclosures to consumers, but also

demands associated with simultaneously responding to requests for other types of file disclosures, such as free file disclosures resulting from adverse action under FCRA § 612(b), 15 U.S.C. 1681j(b), and free file disclosures provided in response to suspected fraud under FCRA § 612(c)(3), 15 U.S.C. 1681j(c)(3). Further, consumer reporting agencies may face additional significant demands in responding to inquiries, or requests for reinvestigation,

generated through each of these types of file disclosures. The Commission has also considered, and adopted, a number of appropriate means to ensure that nationwide consumer reporting agencies can meet those demands, including a staggered transition period and two levels of surge protection. The Commission does not agree that the FACT Act’s direction to “consider . . . appropriate means to ensure that consumer reporting agencies can satisfactorily meet [the significant demands]” (emphasis supplied) equates to a mandate to adopt a particular scheme of staggering, especially when viewed in light of the FACT Act’s direction also to consider the ease by which consumers should be able to request annual file disclosures. FACT Act § 211(d).

See FCRA § 611(a), 15 U.S.C. 1681i(a).

The nationwide consumer reporting agencies themselves state that consumer demand for annual file disclosures, after the transition period, can be reasonably anticipated based upon experiential data. The final rule provides for a gradual, staggered roll-out, final rule § 610.2(i), and for protection from unexpected surges in file disclosure demand, both during the rollout period and thereafter, § 610.2(e). Further, the FACT Act provides nationwide consumer reporting agencies with considerable flexibility in meeting the significant demands placed upon them. As noted above, the FACT Act allows nationwide consumer reporting agencies 15 days from the time a request for an annual file disclosure is received to provide that disclosure. FACT Act § 211(a), codified at FCRA § 612(a)(2), 15 U.S.C. 1681j(a)(2). The Act also allows nationwide consumer reporting agencies a significantly longer period of time to resolve requests for reinvestigation when they originate from an annual file disclosure. FACT Act § 211(a), codified at FCRA § 612(a)(3), 15 U.S.C. 1681(a)(3) (45 days, rather than 30 days). In addition, annual file disclosures must be provided only once in a 12-month period. The 12-month limitation should result in the continuation of the demand-smoothing effects of the transition roll-out scheme, for the requests that are first made during that period. This provides some ongoing limitation on unexpected volume after the transition period-i.e., a consumer who received an annual file disclosure when his or her state first became eligible under the transition provisions is not eligible to request another such disclosure for 12 months.

Accordingly, the Commission determines that ongoing staggering of the availability of the annual file disclosures is not an appropriate means to ensure that the nationwide consumer reporting agencies can meet the significant demands placed upon them by the FACT Act, particularly when balanced against the interests of consumers in having ready access to file disclosures. The high and extraordinary request volume protections incorporated into the final rule achieve the same objective, and strike a better balance between the competing interests. The Commission intends, however, to closely monitor the progress of the transition and the capability of the nationwide consumer reporting agencies to respond to actual request volume, and may adjust the rule, as necessary or appropriate, in the future.

Section 610.2(f)—Information use and disclosure

Under the proposed rule, § 610.2(f) addressed only information security. The proposed rule did not contain any limitations on use and disclosure of information collected by the centralized source.

In the NPR, the Commission posed several questions regarding what, if any, use and disclosure restrictions would be appropriate for the personally identifiable information collected through the centralized source. Based upon those comments, as described below, the Commission adopts a new § 610.2(f) in the final rule, addressing information use and disclosure. The provision of the proposed rule relating to information security has been deleted, as discussed below.

Proposed rule § 610.2(b)(2)(ii) did address collection of information by the centralized source, but not use or disclosure of the information collected. This provision has been altered slightly in the final rule. See discussion under § 610.2(b) of this notice, supra.

Information use and disclosure.

The majority of consumer and consumer advocate commenters assert that the final rule should contain restrictions on “secondary” use and disclosure of information collected through the centralized source. These commenters argue that consumers must be reassured that providing their information to the centralized source will not subject them to unintended consequences, such as unwanted marketing. Further, these commenters note that because concern for information privacy is “a key motivating factor for consumers to request their [file disclosures],” a final rule that does not restrict use and disclosure of information “will seriously impair [consumers’] trust in the system.”

For these reasons, the commenters advocate that use and disclosure of information collected through the centralized source be limited to verifying the identity of the consumer making the request.

Comment, Consumer Federation of America et al. #000019.

Similarly, some marketers of credit-related products and services also recommend that secondary uses of the personally identifiable information collected through the centralized source be prohibited. One commenter asserts, for example, that without such restrictions, “consumers will be forced to choose between exercising their rights [to obtain an annual file disclosure] . . .and maintaining their privacy.”

Further, these commenters argue that the ability to use and disclose this consumer information would provide the nationwide consumer reporting agencies with an unfair competitive advantage.

In contrast, CDIA comments that the final rule should not attempt to interfere with the use and disclosure requirements already applicable to such personal information.

Comment, Intersections Inc. #000034.

These commenters assert the same arguments that some advanced to support banning the marketing and advertising of non-statutorily mandated products on the centralized source. The Commission’s response to this argument is discussed under § 610.2(g) of this notice.

The Commission notes that the information collected by the centralized source may include information that consumers view as particularly sensitive and vulnerable to misuse-such as Social Security numbers. Under FCRA §612(a)(1)(B), 15 U.S.C. 1681j(a)(1)(B), consumers can obtain annual file disclosures from the nationwide consumer reporting agencies only through the centralized source. In obtaining free annual file disclosures, then, consumers are compelled to use the centralized source. As a result, if consumers are reluctant to use the centralized source due to concerns relating to the use and disclosure of their personal information, the purpose of the FACT Act’s requirement for free annual file disclosures would be thwarted.

Further, as some commenters point out, the Commission believes it is not

appropriate to make the availability of annual file disclosures — a right conferred by federal law — contingent on a consumer’s willingness to subject personal identifying information to unrelated, secondary uses. In this sense, the final rule is analogous to the Commission’s restriction on secondary uses of the Do Not Call Registry required by the Telemarketing Sales Rule, 16 CFR Part 310 (TSR). Under the TSR, use of the Commission’s Do Not Call Registry for purposes other than to prevent telephone calls to the persons listed is prohibited. 16 CFR 310.2(b)(2). Similar reasoning applies here; consumers should not be subjected to unrelated uses of their information as a condition of availing themselves of protections and benefits afforded to them by law.

For these reasons, in the final rule § 610.2(f), the Commission limits the use and disclosure of “any personally identifiable information collected from consumers as a result of a request for annual file disclosure, or other disclosure required by the [FCRA], made through the centralized source.” This provision applies only to personally identifiable information that is collected as the result of providing a statutorily-mandated product-such as a file disclosure or credit score. As noted under § 610.2(g) of this notice, infra, the final rule does not prevent nationwide consumer reporting agencies from offering other products and services through the centralized source. The Commission notes that use and disclosure of information collected as a result of a consumer purchase of one of these non-statutorily-mandated products is not subject to the limitation of § 610.2(f).

Final rule § 610.2(f) permits use and disclosure of personally identifiable information in four ways: “[1] to provide the annual file disclosure or other disclosure requested by the consumer; [2] to process a transaction requested by the consumer at the same time as a request for annual file disclosure or other disclosure; [3] to comply with applicable legal requirements, including those imposed by the Fair Credit Reporting Act and this [rule]; and [4] to update personally identifiable information already maintained by the nationwide consumer reporting agencies for the purpose of providing consumer reports, provided that the nationwide consumer reporting agency uses and discloses the updated personally identifiable information subject to the same restrictions that would apply to the information updated.”

The final rule makes it clear that personally identifiable information collected through the centralized source may be used and disclosed as necessary to process a transaction that the consumer requests at the same time as a statutorily-mandated disclosure. The purpose of this provision is to avoid requiring consumers to reenter the information in order to purchase a non-statutorily mandated product.

Some consumer advocacy organizations express concern regarding the use of information collected through the centralized source to enhance the nationwide consumer reporting agencies’ consumer reporting files. The final rule permits nationwide consumer reporting agencies to use the information collected through the centralized source to update the information they already maintain for consumer reporting purposes, but would not permit them to add additional information that they do not already collect from other sources — such as an email address. This provision would also prevent nationwide consumer reporting agencies from using the protected information to develop new consumer files for non-consumer reporting agency purposes.

The Commission notes that the information maintained by nationwide consumer reporting agencies for consumer reporting purposes is subject to a variety of restrictions under existing law. The Commission does not believe it would be appropriate to permit the updating of such information to interfere with any use and disclosure limitations that may apply to the existing data prior to the update. For this reason, this provision makes clear that if a nationwide consumer reporting agency uses personally identifiable information obtained from consumers requesting disclosures through the centralized source to update information it maintains for consumer reporting purposes, the updated information is subject to the same restrictions that apply to the original, pre-updated data. One commenter from outside the consumer reporting industry suggests that use and disclosure of information collected through the centralized source is already limited to “permissible purposes” under the FCRA.

This commenter argues that any provision of the final rule that restricts the use and disclosure of such information would be an attempt to change the operation of the FCRA itself.

This is not the case. The FCRA limits the use and disclosure of “consumer reports.” As noted above, most information collected through the centralized source is not a “consumer report” as that term is defined under the FCRA, and thus, the FCRA’s restrictions on use and disclosure of consumer reports do not apply. To the extent that information collected through the centralized source is consumer report information, final rule § 610.2(f) would permit the nationwide consumer reporting agencies to use that information to update their consumer report files. Thus, contrary to the commenter’s assertions, the final rule’s restriction on use and disclosure of information collected through the centralized source does not impact the availability of consumer reports for permissible purposes under the FCRA.

See FCRA § 604, 15 U.S.C. 1681b.

Comment, ACA International #000043.

Information security.

The proposed rule, in § 610.2(f), required nationwide consumer reporting agencies to comply with the requirements set forth in Standards for Safeguarding Customer Information, 16 CFR 314 (the Safeguards Rule),

regarding all personally identifiable information collected through or disclosed by the centralized source. Representatives of the nationwide consumer reporting agencies comment that this provision of the proposed rule is unnecessary because consumer reporting agencies are financial institutions subject to the Commission’s jurisdiction under GLBA, and thus, already subject to the Safeguards Rule. See 67 FR 36484, 36485 (May 23, 2002). Representatives of the nationwide consumer reporting agencies also comment that by requiring compliance with the Safeguards Rule in this rule, the Commission has sought to alter the scheme of GLBA by applying the FCRA’s private right of action to GLBA violations where no private right of action previously existed.

16 C.F.R. Part 314 was promulgated by the Commission pursuant to the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. 6801 et seq.

The Commission notes that the nationwide consumer reporting agencies are subject to a variety of existing laws relating to unauthorized access and/or security of information they collect and disclose, including, but not limited to the FCRA, the Safeguards Rule and the FTC Act. The record in this rulemaking provides no basis for concluding that these existing requirements are inadequate to address the information collected and disclosed through the centralized source, or that the centralized source creates any new or unique risks that are not addressed by such existing requirements. Thus, the Commission does not believe it is necessary to duplicate or augment those requirements in the final rule.

Accordingly, § 610.2(f) of the proposed rule is not adopted in the final rule.

Section 610.2(g)—Communications provided by the centralized source

The Commission noted in the NPR that the centralized source would afford the nationwide consumer reporting agencies the opportunity to communicate information to consumers about other credit-related products and services they may sell. In addition, the Commission stated that the proposed rule would not prohibit these agencies from offering other file disclosures or products and services, in addition to the required annual file disclosures, through the centralized source. In order to ensure that such advertising or marketing does not undermine the purpose of the centralized source, or mislead consumers, § 610.2(g) of the proposed rule states that any communications provided through the centralized source “shall not interfere with, detract from, contradict, or otherwise undermine the purpose of the centralized source.” In addition, the proposed rule listed examples of representations that would be unacceptable: (1) pop-up advertisements that hinder the consumer’s ability to complete an online request for annual file disclosures; (2) representations that a consumer must purchase a product in order to receive or understand the file disclosures; (3) representations that the annual file disclosures are not free or that requesting them will have a negative impact on the consumer’s credit rating; and (4) representations that other products are free, if that is not the case, or failing to disclose clearly and prominently that a service advertised as initially free must be cancelled to avoid a charge.

The final rule retains this provision with only minor modifications. The example described in § 610.2(g)(2)(i) with respect to pop-up advertisements has been modified to make clear that any offers or promotions that hinder the consumer’s ability to complete an online request for file disclosures would constitute undue interference with the purpose of the centralized source.

A number of commenters, including consumer organizations, individual consumers, and businesses that market credit-related products or services, address this issue, urging the Commission to prohibit advertising and marketing on the centralized source. Competitors of the nationwide consumer reporting agencies argue that advertising and marketing would give the nationwide consumer reporting agencies an unfair competitive advantage. Consumer advocacy organizations argue that the promotion of products or services - other than credit scores - would necessarily confuse consumers and undermine the purpose of the centralized source. Moreover, they did not believe that any regulation could address adequately the potential for confusion or deceptive advertising practices. In addition, some argue that any advertising or marketing of products on the centralized source would carry an implication of government endorsement or approval of the products offered.

Most of these commenters further argue that there is no congressional authority to allow the centralized source to be used for other purposes. In addition, some suggest that if there is to be advertising and marketing on the centralized source, the source should be made available to other sellers of credit products or services or to consumer groups that wish to provide their own information about credit issues.

Comments from the nationwide consumer reporting agencies and CDIA generally favor the Commission’s approach on this matter, although some express concern that the language of this rule provision is not sufficiently specific to provide clear guidance.

Section 212(a) of the FACT Act requires that consumer reporting agencies inform consumers about the availability of credit scores when providing file disclosures to them. Further, a credit score that is based upon consumer reporting information can only be generated from that information. A consumer must be properly identified and the appropriate consumer file must be located in order for either a credit score or a file disclosure to be generated. It would be an anomalous result, for both consumers and the nationwide consumer reporting agencies, for the law to require the centralized source to inform consumers about the availability of credit scores, but not permit them to obtain credit scores at that juncture. Accordingly, it is consistent with the FACT Act to make both file disclosures and credit scores available through the centralized source. Allowing consumers who wish to purchase credit scores to do so at the same time that they obtain their annual file disclosures will result in efficiency for both consumers and nationwide consumer reporting agencies.

The statute, however, is silent with respect to other products or services that may be advertised or marketed on the centralized source. The Commission does not interpret this silence as an indication that the nationwide consumer reporting agencies are barred from the advertising or marketing of other products or services. An absolute prohibition of such communications would have to withstand scrutiny under U.S. Supreme Court decisions regarding the First Amendment and commercial speech. See Central Hudson Gas & Elec. Corp. v. Public Serv. Comm’n., 447 U.S. 557, 564 (1980). The Commission believes that its substantial interest in preventing communications that are misleading, confusing to consumers, or undermine the purpose of the centralized source can be served by less restrictive means than an absolute ban, and it has crafted § 610.2(g) accordingly.

The purpose of the centralized source is to enable consumers to make a single request to obtain annual file disclosures from the nationwide consumer reporting agencies. Advertising or marketing must be secondary to, and constrained by, that purpose. If a consumer is hindered in the effort to make an online request for file disclosures by the need to view and respond to, or close windows for, multiple offers of products and services, such communications would interfere with or undermine the purpose of the centralized source. Any representation that a consumer must purchase a product in order to receive or understand the annual file disclosure would contradict and detract from the right to obtain the free annual disclosure. Similarly, any representation that the file disclosure request itself will have a negative effect on the consumer’s credit rating would undermine and detract from the right to the free annual disclosure. The same would be true of misrepresentations about the cost of other products or services, or the terms of any subscription service such as credit monitoring.

The Commission further notes that the specific provisions of the rule are not the only mechanisms available to it to address deceptive or unfair marketing practices in connection with the operation of the centralized source. The FTC Act’s prohibition against such practices also would apply to the nationwide consumer reporting agencies in their joint operation of the centralized source, just as it does in their individual business operations. 15 U.S.C. 45(a). For example, any express or implied claim that any product or service offered via the centralized source bears government approval or endorsement would be deceptive, and therefore a violation of the FTC Act. The Commission believes that the enforcement tools available to the agency, under both the rule and the FTC Act, will enable it to ensure that the centralized source is operated in an appropriate manner - i.e., one that enables consumers to request their

annual file disclosures easily and without being subjected to deceptive or unfair practices.

The Commission believes that, in general, competition with regard to credit-related products and services may be enhanced as a result of the final rule, because easier consumer access to file disclosures may create greater consumer awareness of the entire industry. Further, any competitive advantage for the nationwide consumer reporting agencies is created by the FACT Act’s requirement to establish the centralized source, an undertaking that imposes significant costs on the industry.

Section 610.2(h)—Effective date

The FACT Act, in § 211(d)(5), requires that the Commission issue centralized source regulations in final form no later than six months after the enactment date of the FACT Act, and that these rules take effect no later than six months after the date on which the regulations are issued in final form. The statute, therefore, requires that the effective date be no later than December 4, 2004.

The Commission proposed an effective date of December 1, 2004, at which time the phase-in of consumer eligibility for free annual file disclosures would begin. Some consumers suggest that this transition would begin too late, and that free annual file disclosures should begin to be available as soon as the final rule is issued. Some members of Congress assert that the transition should be completed, and all consumers should be eligible to request their free annual file disclosures, by December 4, 2004.

Representatives of the nationwide consumer reporting agencies comment that a six-month period is the minimum necessary time prior to the initial deployment of the centralized source to any portion of the country. These commenters explain that at least six months will be required to evaluate the final rule and design and build the necessary infrastructure for the centralized source.

The Commission has considerable recent experience in designing and implementing structures to respond to large volumes of consumer requests, e.g. the implementation of the Do-Not-Call Registry. After considering the FACT Act requirements under § 211(d), and the significant technological challenges presented by designing, building and implementing the centralized source required by this part, the Commission believes it is reasonable to require the nationwide consumer reporting agencies to begin to implement the centralized source about six months after the final rule is issued. Accordingly, the final rule becomes effective on December 1, 2004. Final rule § 610.2(h).

Section 610.2(i)—Transition

The final rule — like the proposed rule— requires a cumulative regional roll-out for the centralized source. Under § 610.2(i), the centralized source will become available to consumers by region, starting in the west and moving eastward across the country, at three-month intervals. Consumers residing in the western part of the United States (California and 12 other western states) will have access to the centralized source beginning on December 1, 2004.

On March 1, 2005, consumers in 12 midwestern states also will become eligible to request their annual file disclosures from the centralized source. On June 1, 2005, the centralized source will become available to consumers in 11 southern states. Finally, on September 1, 2005, the centralized source will become available to all remaining consumers, including those residing in eastern states, the District of Columbia, and all U.S. territories and possessions.

According to the 2000 U.S. Census, these states account for 22.1% of total U.S. population.

Some consumers and consumer groups comment that there is insufficient evidence to justify any gradual transition scheme. Accordingly, those commenters suggest that annual file disclosures should be available without a segmented approach to consumer eligibility. These commenters also suggest that if the final rule provides for any transition, it should allow for only a very short “test” period when the centralized source would be available to a portion of the country. If the consumer demand proved overwhelming during the “test,” they argued, the Commission could then amend the rule to provide a more structured roll-out for the rest of the country. In contrast to these comments, all representatives of the consumer reporting industry emphasize the need for a substantial structured transition in order to manage initial consumer demand for annual file disclosures.

Section 211(d)(4) of the FACT Act requires that the Commission’s regulations provide for an “orderly transition” for nationwide consumer reporting agencies to fully implement the centralized source. The FACT Act directs that this transition be conducted in a manner that does not temporarily overwhelm such consumer reporting agencies with requests for disclosures beyond their capacity to deliver; and does not deny creditors, other users, and consumers access to consumer reports on a time-sensitive basis for specific purposes, such as home purchases or suspicions of identity theft, during the transition period. This provision of the statute clearly indicates that Congress contemplated allowing the nationwide consumer reporting agencies some period of time in which to build and implement the centralized source.

Some commenters suggested that even if the rule allows a transition period to phase in the availability of the centralized source, consumers who approach an individual nationwide consumer reporting agency directly should be entitled to receive their free annual file disclosures without waiting. The FACT Act amended FCRA § 612(a) to require the nationwide consumer reporting agencies to make free annual file disclosures upon request of the consumer. This right was limited, however, to requests that are made using the centralized source. FCRA § 612(a)(1)(B), 15 U.S.C. 1681j(a)(1)(B).

Given the significant development necessary to fully implement the centralized source, the Commission believes a gradual, segmented transition is appropriate. Further, the Commission notes that conditioning a structured transition on the results of a test period, as suggested by some commenters, would subject the availability of the centralized source to unreasonable uncertainty and delay. The Commission likely would not be able to examine test data and promulgate a revised rule without delaying the complete implementation of the centralized source. In the meantime, the nationwide consumer reporting agencies would be uncertain as to what this revised rule might require. Accordingly, the Commission believes that establishing, at the outset, a structured transition over a reasonable period of time will provide the best results for both industry and consumers.

Transition Length.

Consumers, consumer groups and members of Congress comment that the nine-month transition period set out in the proposed rule is unreasonably long, and that this delay in implementation is contrary to the intent of the FACT Act. These commenters point out that because the FACT Act was signed in December of 2003, and the transition does not begin until December of 2004, the nationwide consumer reporting agencies will already have had a year to work on meeting the requirements of the rule before the transition period begins. They assert that, without specific substantiation for such a delay, an additional nine months is an unreasonable amount of time for consumers — especially those at the end of the transition scheme — to wait to receive their annual file disclosures.

On the other hand, representatives of the nationwide consumer reporting

agencies assert that a transition period of nine months is too short to ensure a smooth implementation. They contend that even with this time frame, they are compelled to begin the process of building the centralized source prior to issuance of the final rule. They argue that a transition of two years is needed to fully implement the centralized source. During the first year of this suggested transition, consumers would become eligible for discrete periods of time (rather than on a cumulative basis). These commenters maintain that the centralized source’s first year of operation will not provide reliable data to determine the appropriate baseline for operations of the centralized source, because demand will be uncharacteristically high due to consumer education efforts and media campaigns. The first six to nine months of the second year of operation, they argue, would provide better data to use in anticipating normal demand. After collecting that data, the nationwide consumer reporting agencies assert, they would adjust capacity accordingly.

The Commission concludes that the proposed nine-month transition period proposed is appropriate. It is important for consumers to become eligible to obtain their annual file disclosures as quickly as practicable. The large number of consumers who commented on the proposed rule and requested a shorter transition is evidence that many consumers place much value on receiving these file disclosures.

The Commission is mindful, however, that the transition provided by the final rule must enable the nationwide consumer reporting agencies to meet the significant demands of building and adjusting a system with adequate capacity to respond to requests from all eligible consumers at the end of the transition. The nationwide consumer reporting agencies comment that significant adjustments in the capacity of the centralized source will require 60 to 90 days. Accordingly, a nine-month transition provides the nationwide consumer reporting agencies with adequate opportunity to adjust capacity based upon the experience provided by the first two segments, prior to the implementation of the centralized source nationwide. Further, this transition length and roll-out assist in smoothing out demand after the transition. That is, each group to become eligible in a period will not be able to request another annual file disclosure for 12 months, which will cause some natural staggering by groups after the transition.

For these reasons, the Commission believes that nine months provides adequate time, in light of the number of consumer files maintained by the nationwide consumer reporting agencies and the significant development demands that the centralized source will require, to gradually build capacity to meet full demand. Accordingly, § 610.2(i)(1) is adopted as proposed.

Regional Rollout.

Consumers and consumer advocacy groups comment that, in the event the final rule provides for a rollout, a regional rollout is preferable to one based on birth date or other identifier. These commenters assert that a regional approach permits better consumer education through regional and local media, and it aids in household financial management in that it allows members of the same household to obtain their free annual file disclosures at the same time.

Representatives of the nationwide consumer reporting agencies suggest, however, that a preferable method of staggering eligibility would be by consumers’ birth month, or first initial of last name, rather than by region of the country. Some commenters, including a member of Congress, advocate staggering eligibility based upon Social Security number. The nationwide consumer reporting agencies argue that a regional approach would exacerbate demand on the centralized source due to local media and advocacy group efforts.

The Commission believes that a regional approach is the most effective and appropriate method to roll out the centralized source. A regional rollout can be easily understood by consumers and will be complemented by local and regional press coverage, which will remind consumers when the centralized source becomes available to their state or media market.

Further, an approach that allows members of the same household to obtain their annual file disclosures at the same time is efficient and convenient for consumers.

The regional divisions do not divide metropolitan statistical areas.

Some commenters assert that the rollout of eligibi

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.