To amend the Fair Credit Reporting Act, to prevent identity theft, improve resolution of consumer disputes, improve the accuracy of consumer records, make improvements in the use of, and consumer access to, credit information, and for other purposes.

June 26, 2003

Mr. BACHUS (for himself, Ms. HOOLEY of Oregon, Mrs. BIGGERT, Mr. MOORE, Mr. LATOURETTE, Mr. KANJORSKI, Mr. CASTLE, Mrs. MALONEY, Mr. SHADEGG, Mr. FORD, Mr. TIBERI, Mr. HINOJOSA, Mr. HENSARLING, Mr. CROWLEY, Mr. SESSIONS, Mr. ROSS, Mr. MATHESON, Mr. DAVIS of Alabama, Mr. BAKER, Mr. KING of New York, Mr. LUCAS of Oklahoma, Mr. LUCAS of Kentucky, Mr. NEY, Mrs. KELLY, Mr. JONES of North Carolina, Mr. ISRAEL, Ms. HART, Mr. MILLER of North Carolina, Mrs. CAPITO, Mrs. MCCARTHY of New York, Mr. BARRETT of South Carolina, Mr. FEENEY, and Ms. HARRIS) introduced the following bill; which was referred to the Committee on Financial Services

To amend the Fair Credit Reporting Act, to prevent identity theft, improve resolution of consumer disputes, improve the accuracy of consumer records, make improvements in the use of, and consumer access to, credit information, and for other purposes.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

(a) SHORT TITLE- This Act may be cited as the `Fair and Accurate Credit Transactions Act of 2003'.

(b) TABLE OF CONTENTS- The table of contents for this Act are as follows:

Sec. 1. Short title; table of contents.

Sec. 2. Definitions.

TITLE I--UNIFORM NATIONAL CONSUMER PROTECTION STANDARDS

Sec. 101. Uniform national consumer protections standards made permanent.

TITLE II--IDENTITY THEFT PREVENTION

Sec. 201. Investigating changes of address.

Sec. 202. Fraud alerts.

Sec. 203. Truncation of credit card and debit card account numbers.

Sec. 204. Summary of rights of identity theft victims.

Sec. 205. Blocking of information resulting from identity theft.

Sec. 206. Establishment of procedures for depository institutions to identify possible instances of identity theft.

TITLE III--IMPROVING RESOLUTION OF CONSUMER DISPUTES

Sec. 301. Coordination of consumer complaint investigations.

Sec. 302. Notice of dispute through reseller.

Sec. 303. Prompt investigation of disputed consumer information.

TITLE IV--IMPROVING ACCURACY OF CONSUMER RECORDS

Sec. 401. Reconciling addresses.

Sec. 402. Prevention of repollution of consumer reports.

Sec. 403. Notice by users with respect to fraudulent information.

TITLE V--IMPROVEMENTS IN USE OF AND CONSUMER ACCESS TO CREDIT INFORMATION

Sec. 501. Free reports annually.

Sec. 502. Summary of credit scores.

Sec. 503. Simpler and easier method for consumers to use notification system.

TITLE VI--PROTECTING EMPLOYEE MISCONDUCT INVESTIGATIONS

Sec. 601. Certain employee investigation communications excluded from definition of consumer report.

SEC. 2. DEFINITIONS.

Section 603 of the Fair Credit Reporting Act (15 U.S.C. 1681a) is amended by adding at the end the following new subsections:

`(r) RESELLER- The term `reseller' means a consumer reporting agency that--

`(1) acts as a reseller of information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies; and

`(2) does not maintain a permanent database of the assembled or merged information from which new consumer reports are produced.

`(s) OTHER DEFINITIONS-

`(1) BOARD; CREDIT; CREDITOR- The terms `Board', `credit' and `creditor' have the same meanings as in section 103 of the Truth in Lending Act.

`(2) ELECTRONIC FUND TRANSFER- The term `electronic fund transfer' has the same meaning as in section 903 of the Electronic Fund Transfer Act.

`(3) FEDERAL BANKING AGENCY- The term `Federal banking agency' has the same meaning as in section 3 of the Federal Deposit Insurance Act.

`(4) IDENTITY THEFT- The term `identity theft' includes a violation of section 1028, 1029, or 1030 of title 18, United States Code.'.

TITLE I--UNIFORM NATIONAL CONSUMER PROTECTION STANDARDS

SEC. 101. UNIFORM NATIONAL CONSUMER PROTECTIONS STANDARDS MADE PERMANENT.

Section 624(d) of the Fair Credit Reporting Act (15 U.S.C. 1681t(d)) is amended--

(1) by striking `Subsections (b) and (c)' and all that follows through `do not affect any settlement,' and inserting `Subsections (b) and (c) do not affect any settlement,'; and

(2) by striking `Consumer Credit Reporting Reform Act of 1996' and all that follows through the period at the end of paragraph (2) and inserting `Consumer Credit Reporting Reform Act of 1996.'.

TITLE II--IDENTITY THEFT PREVENTION

SEC. 201. INVESTIGATING CHANGES OF ADDRESS.

(a) IN GENERAL- Section 605 of the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by inserting after subsection (f), the following new subsection:

`(g) INVESTIGATION OF CHANGES OF ADDRESS- If a credit card issuer receives a request for an additional credit card with respect to an existing credit card account within 30 days after receiving notification of a change of address for that account, the card issuer shall--

`(1) notify the cardholder of the request--

`(A) at both the new address and the former address of the cardholder; or

`(B) by such other means of communication as the cardholder and the credit card issuer previously agreed to,

in accordance with reasonable policies and procedures established by the card issuer pursuant to regulations which the Board shall prescribe; and

`(2) provide to the cardholder a means of promptly reporting incorrect changes.'.

(b) CLERICAL AMENDMENTS-

(1) The heading for section 605 of the Fair Credit Reporting Act is amended to read as follows:

`Sec. 605. Requirements relating to information contained in consumer reports and to identity theft.'.

(2) The table of sections for title VI of the Consumer Credit Protection Act is amended by striking the item relating to section 605 and inserting the following new item:

`605. Requirements relating to information contained in consumer reports and to identity theft.'.

SEC. 202. FRAUD ALERTS.

Section 605 of the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by adding at the end the following new subsection:

`(i) FRAUD ALERTS-

`(1) IN GENERAL- Upon the request of a consumer who asserts in good faith a suspicion that the consumer has been or is about to become a victim of fraud or related crime, and upon receiving proper identification, a consumer reporting agency shall include a fraud alert in the file of that consumer.

`(2) NOTICE TO USERS- A consumer reporting agency shall notify each person procuring a consumer report with respect to a consumer of the existence of a fraud alert in effect for such consumer, regardless of whether a full credit report, credit score, or summary report is requested.

`(3) PROHIBITION- No user of a consumer report with a fraud alert may issue or extend credit in the name of the consumer to a person other than the consumer without attempting to obtain the authorization or preauthorization of the consumer in the manner contained in the fraud alert in effect for such consumer.

`(4) DEFINITION- In this subsection, the term `fraud alert' means a clear and conspicuous statement in the file of a consumer that notifies all prospective users of a consumer report made with respect to that consumer that the consumer does not authorize the issuance or extension of credit in the name of the consumer unless--

`(A) the issuer or extender of such credit first obtains verbal authorization from the consumer at a telephone number designated by the consumer; or

`(B) the issuer of such credit utilizes another reasonable means of communication to obtain the express authorization or preauthorization of the consumer.

`(5) EXCEPTIONS-

`(A) RESELLERS-

`(i) IN GENERAL- The provisions of this subsection shall not apply to a reseller.

`(ii) LIMITATION- A reseller shall preserve any fraud alert placed on a consumer report by another consumer reporting agency.

`(B) EXEMPT INSTITUTIONS- The requirement under this subsection to place a fraud alert in a consumer file shall not apply to--

`(i) a check services company, which issues authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments; or

`(ii) a deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a demand deposit account at the inquiring bank or financial institution.'.

SEC. 203. TRUNCATION OF CREDIT CARD AND DEBIT CARD ACCOUNT NUMBERS.

(a) IN GENERAL- Except as provided in this section, no person, firm, partnership, association, corporation, or limited liability company that accepts credit cards or debit cards for the transaction of business shall print more than the last 4 digits of the card account number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.

(b) LIMITATION- This section applies only to receipts that are electronically printed, and does not apply to transactions in which the sole means of recording the person's credit card or debit card account number is by handwriting or by an imprint or copy of the card.

(c) DEFINITIONS- For purposes of this section, the following definitions shall apply:

(1) CREDIT CARD- The term `credit card' has the same meaning as in section 103(k) of the Truth in Lending Act.

(2) DEBIT CARD- The term `debit card' means any card issued by a financial institution to a consumer for use in initiating electronic fund transfers (as defined in section 903(6) of the Electronic Fund Transfer Act) from the account (as defined in such Act) of the consumer at such financial institution for the purpose of transferring money between accounts or obtaining money, property, labor, or services.

(d) EFFECTIVE DATE- This section shall become effective on--

(1) January 1, 2007, with respect to any cash register or other machine or device that electronically prints receipts for credit card or debit card transactions that is in use before January 1, 2005; and

(2) January 1, 2005, with respect to any cash register or other machine or device that electronically prints receipts for credit card or debit card transactions that is first put into use on or after such date.

SEC. 204. SUMMARY OF RIGHTS OF IDENTITY THEFT VICTIMS.

(a) IN GENERAL- Section 609 of the Fair Credit Reporting Act (15 U.S.C. 1681g) is amended by adding at the end the following new subsection:

`(d) SUMMARY OF RIGHTS OF IDENTITY THEFT VICTIMS- A consumer reporting agency shall establish reasonable policies and procedures for providing consumers who have reason to believe they are the victims of fraud or identity theft involving credit, electronic fund transfers, or accounts or transactions at or with a financial institution with a summary of the rights of consumers under the Consumer Credit Protection Act and other provisions of Federal law and procedures for remedying the effects of any such alleged offense.'.

(b) BEST PRACTICES- The Federal Trade Commission shall develop guidelines for model policies and model

procedures with regard to the summary of rights required under the amendment made by subsection (a).

SEC. 205. BLOCKING OF INFORMATION RESULTING FROM IDENTITY THEFT.

Section 605 of the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by inserting after subsection (i) (as added by section 202 of this title) the following new subsection:

`(j) BLOCK OF INFORMATION RESULTING FROM IDENTITY THEFT-

`(1) BLOCK- Except as provided in paragraph (3) and not later than 30 days after the date of receipt of proof of the identity of a consumer and an official copy of a police report evidencing the claim of the consumer of identity theft, a consumer reporting agency shall block the reporting of any information identified by the consumer in the file of the consumer resulting from the alleged identity theft, so that the information cannot be reported.

`(2) NOTIFICATION- A consumer reporting agency shall promptly notify the furnisher of information identified by the consumer under paragraph (1)--

`(A) that the information may be a result of identity theft;

`(B) that a police report has been filed;

`(C) that a block has been requested under this subsection; and

`(D) of the effective date of the block.

`(3) AUTHORITY TO DECLINE OR RESCIND-

`(A) IN GENERAL- A consumer reporting agency may decline to block, or may rescind any block, of consumer information under this subsection if--

`(i) the consumer reporting agency reasonably determined that--

`(I) the information was blocked due to a misrepresentation of fact by the consumer relevant to the request to block; or

`(II) the consumer knowingly obtained possession of goods, services, or moneys as a result of the blocked transaction or transactions, or the consumer should have known that the consumer obtained possession of goods, services, or moneys as a result of the blocked transaction or transactions; or

`(ii) the consumer agrees that the blocked information or portions of the blocked information were blocked in error.

`(B) NOTIFICATION TO CONSUMER- If the block of information is declined or rescinded under this paragraph, the affected consumer shall be notified promptly, in the same manner as consumers are notified of the reinsertion of information under section 611(a)(5)(B).

`(C) SIGNIFICANCE OF BLOCK- For purposes of this paragraph, if a consumer reporting agency rescinds a block, the presence of information in the file of a consumer prior to the blocking of such information is not evidence of whether the consumer knew or should have known that the consumer obtained possession of any goods, services, or monies as a result of the block.

`(4) EXCEPTIONS-

`(A) NEGATIVE INFORMATION DATA- A consumer reporting agency shall not be required to comply with this subsection when such agency is issuing information for authorizations, for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment, based solely on negative information, including--

`(i) dishonored checks;

`(ii) accounts closed for cause;

`(iii) substantial overdrafts;

`(iv) abuse of automated teller machines; or

`(v) other information which indicates a risk of fraud occurring.

`(B) RESELLERS-

`(i) NO RESELLER FILE- The provisions of this subsection do not apply to a consumer reporting agency if the consumer reporting agency--

`(I) is a reseller;

`(II) is not, at the time of the request of the consumer under paragraph (1), otherwise furnishing or reselling a consumer report concerning the information identified by the consumer; and

`(III) informs the consumer, by any means, that the consumer may report the identity theft to the Federal Trade Commission to obtain consumer information regarding identity theft.

`(ii) RESELLER WITH FILE- The sole obligation of the consumer reporting agency under this subsection, with regard to any request of a consumer under this subsection, shall be to block the consumer report maintained by the consumer reporting agency from any subsequent use if--

`(I) the consumer, in accordance with the provisions of paragraph (1), identifies, to a consumer reporting agency, information in the file of the consumer that resulted from identity theft; and

`(II) the consumer reporting agency is a reseller of the identified information.

`(iii) NOTICE- In carrying out its obligation under clause (ii), the reseller shall promptly provide a notice to the consumer of the decision to block the file. Such notice shall contain the name, address, and telephone number of each consumer reporting agency from which the

consumer information was obtained for resale.'.

SEC. 206. ESTABLISHMENT OF PROCEDURES FOR DEPOSITORY INSTITUTIONS TO IDENTIFY POSSIBLE INSTANCES OF IDENTITY THEFT.

(a) IN GENERAL- Section 605 of the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by inserting after subsection (j) (as added by section 205 of this title) the following new subsection:

`(k) `RED FLAG' GUIDELINES REQUIRED- The Federal banking agencies shall jointly establish and maintain guidelines for use by insured depository institutions in identifying patterns, practices, and specific forms of activity that indicate the possible existence of identity theft, and update such guidelines as often as necessary.'.

(b) EFFECTIVE DATE- The amendment made by subsection (a) shall take effect at the end-of the 1-year period beginning the date of the enactment of this Act.

TITLE III--IMPROVING RESOLUTION OF CONSUMER DISPUTES

SEC. 301. COORDINATION OF CONSUMER COMPLAINT INVESTIGATIONS.

Section 621 of the Fair Credit Reporting Act (15 U.S.C. 1681s) is amended by adding at the end the following new subsections:

`(f) COORDINATION OF CONSUMER COMPLAINT INVESTIGATIONS- Not later than 365 days after the date of enactment of the Fair and Accurate Credit Transactions Act of 2003, the Federal Trade Commission shall prescribe rules in accordance with section 553 of title 5, United States Code--

`(1) to develop procedures for referral of consumer complaints under this title about identity theft and fraud alerts between and among the consumer reporting agencies and the Commission; and

`(2) to develop a model form and model procedures to be used by consumers who are victims of identity fraud for contacting and informing creditors and consumer reporting agencies of the fraud.'.

SEC. 302. NOTICE OF DISPUTE THROUGH RESELLER.

Section 611(a)(1)(A) of the Fair Credit Reporting Act (15 U.S.C. 1681i(a)(1)(A)) is amended by inserting `, or indirectly through a reseller,' after `notifies the agency directly'.

SEC. 303. PROMPT INVESTIGATION OF DISPUTED CONSUMER INFORMATION.

(A) STUDY REQUIRED- The Board of Governors of the Federal Reserve System and the Federal Trade Commission shall each study the extent to which, and the manner in which, consumer reporting agencies and furnishers of consumer information to consumer reporting agencies are complying with the procedures, time lines, and requirements under the Fair Credit Reporting Act for the prompt investigation of the disputed accuracy of any consumer information and the prompt correction or deletion, in accordance with such Act, of any inaccurate or incomplete information or information that cannot be verified.

(b) REPORT REQUIRED- Before the end of the 6-month period beginning on the date of the enactment of this Act, the Board of Governors of the Federal Reserve System and the Federal Trade Commission shall each submit a progress report to the Congress on the results of the study required under subsection (a).

(c) RECOMMENDATIONS- The report under subsection (b) shall include such recommendations as the Board and the Commission determine to be appropriate for legislative or administrative action to ensure that--

(1) consumer disputes with consumer reporting agencies over the accuracy or completeness of information in a consumer's file are promptly and fully investigated and any incorrect, incomplete, or unverifiable information is immediately corrected or deleted;

(2) furnishers of information to consumer reporting agencies maintain full and prompt compliance with the duties and responsibilities established under section 623 of the Fair Credit Reporting Act; and

(3) consumer reporting agencies establish and maintain appropriate internal controls and management review procedures for maintaining full and continuous compliance with the procedures, time lines, and requirements under the Fair Credit Reporting Act for the prompt investigation of the disputed accuracy of any consumer information and the prompt correction or deletion, in accordance with such Act, of any inaccurate or incomplete information or information that cannot be verified.

(d) DEFINITIONS- For purposes of this section, the terms `consumer', `consumer report', and `consumer reporting agency' have the same meaning as in the Fair Credit Reporting Act.

TITLE IV--IMPROVING ACCURACY OF CONSUMER RECORDS

SEC. 401. RECONCILING ADDRESSES.

Section 605 of the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by inserting after subsection (g) (as added by section 201 of this Act) the following new subsection.

`(h) NOTICE OF DISCREPANCY- In any case in which a person has requested a consumer report relating to a consumer, and the request includes an address for the consumer that substantially differs from the most recent address in the file of the consumer, the consumer reporting agency shall--

`(1) notify the requester of the discrepancy; and

`(2) reconcile or resolve, within 30 days, any substantial variation between the most recent address in the file of the consumer at the agency and the address contained in the request, in accordance with reasonable policies and procedures established by the consumer reporting agency.'.

SEC. 402. PREVENTION OF REPOLLUTION OF CONSUMER REPORTS.

Section 623(a)(1) of the Fair Credit Reporting Act (15 U.S.C. 1681s-2(a)(1)) is amended by adding at the end the following new subparagraph:

`(D) INFORMATION KNOWN TO INCLUDE IDENTITY THEFT ACTIVITY- A person may not furnish information to any consumer reporting agency that the person knows or has reason to believe has resulted from fraudulent activity, including identity theft.'.

SEC. 403. NOTICE BY USERS WITH RESPECT TO FRAUDULENT INFORMATION.

Section 615 of the Fair Credit Reporting Act (15 U.S.C. 1681m) is amended by adding at the end the following new subsection:

`(e) NOTICE OF FRAUDULENT INFORMATION RELATING TO IDENTITY THEFT- Any assignee or agent, including a debt collector (as defined in title VIII), of a person who uses a consumer report on any consumer, who learns that any information in such consumer report is fraudulent and may be the result of identity theft shall notify the person of such fraudulent information.'.

TITLE V--IMPROVEMENTS IN USE OF AND CONSUMER ACCESS TO CREDIT INFORMATION

SEC. 501. FREE REPORTS ANNUALLY.

Section 612(c) of the Fair Credit Reporting Act (15 U.S.C. 1681j(c)) is amended to read as follows:

`(c) FREE ANNUAL DISCLOSURE- Upon the request of the consumer, a consumer reporting agency shall make all disclosures pursuant to section 609 once during any 12-month period without charge to the consumer.'.

SEC. 502. SUMMARY OF CREDIT SCORES.

Section 609(a)(1) of the Fair Credit Reporting Act (15 U.S.C. 1681g(a)(1)) is amended by striking `except that nothing' and all that follows through the period at the end and inserting `including a summary of how any individual credit score of the consumer was derived and how such score might be improved.'.

SEC. 503. SIMPLER AND EASIER METHOD FOR CONSUMERS TO USE NOTIFICATION SYSTEM.

(a) IN GENERAL- Section 604(e)(5)(A)(i) of the Fair Credit Reporting Act (15 U.S.C. 1681b(e)(5)(A)(i)) is amended by inserting `in a simple and easy manner and' after `notify the agency,'.

(b) TECHNICAL AND CONFORMING AMENDMENT- Section 615(d) of the Fair Credit Reporting Act (15 U.S.C. 1681m(d)) is amended--

(1) by redesignating paragraphs (2), (3), and (4), as paragraphs (3), (4) and (5); and

(2) by inserting after paragraph (1) the following new paragraph:

`(2) SIMPLE AND EASY NOTIFICATION- Any statement given the consumer under paragraph (1)(E) shall be in a simple and easy to understand format and shall afford a simple and easy method for the consumer to respond.'.

TITLE VI--PROTECTING EMPLOYEE MISCONDUCT INVESTIGATIONS

SEC. 601. CERTAIN EMPLOYEE INVESTIGATION COMMUNICATIONS EXCLUDED FROM DEFINITION OF CONSUMER REPORT.

(a) IN GENERAL- Section 603 of the Fair Credit Reporting Act (15 U.S.C. 1681a) is amended--

(1) by redesignating subsection (p) as subsection (q); and

(2) by inserting after subsection (o) the following new subsection:

`(p) EXCLUSION OF CERTAIN COMMUNICATIONS FOR EMPLOYEE INVESTIGATIONS-

`(1) COMMUNICATIONS DESCRIBED IN THIS SUBSECTION- A communication is described in this subsection if--

`(A) but for subsection (d)(2)(D), the communication would be a consumer report;

`(B) the communication is made to an employer in connection with an investigation of--

`(i) suspected misconduct relating to employment; or

`(ii) compliance with Federal, State, or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer;

`(C) the communication is not made for the purpose of investigating a consumer's credit worthiness, credit standing, or credit capacity; and

`(D) the communication is not provided to any person except--

`(i) to the employer or an agent of the employer;

`(ii) to any Federal or State officer, agency, or department, or any officer, agency, or department of a unit of general local government;

`(iii) to any self-regulatory organization with regulatory authority over the activities of the employer or employee;

`(iv) as otherwise required by law; or

`(v) pursuant to section 608.

`(2) SUBSEQUENT DISCLOSURE- After taking any adverse action based in whole or in part on a communication described in paragraph (1), the employer shall disclose to the consumer a summary containing the nature and substance of the communication upon which the adverse action is based, except that the sources of information acquired solely for use in preparing what would be but for subsection (d)(2)(D) an investigative consumer report need not be disclosed.

`(3) SELF-REGULATORY ORGANIZATION DEFINED- For purposes of this subsection, the term `self-regulatory organization' includes any self-regulatory organization (as defined in section 3(a)(26) of the Securities Exchange Act of 1934), any entity established under Title I of the Sarbanes-Oxley Act of 2002, any board of trade designated by the Commodity Futures Trading Commission, and any futures association registered with such Commission.'.

(b) TECHNICAL AND CONFORMING AMENDMENT- Section 603(d)(2)(D) of the Fair Credit Reporting Act (15 U.S.C. 1681a(d)(2)(D)) is amended by inserting `or (p)' after `subsection (o)'.

END