9.1 FCRA and FACTA

9.1 FCRA and FACTA

Domain II of the CIPP/US Body of Knowledge 2.6.1 is Federal Privacy Laws and accounts for 15–19 of the exam's 90 questions. Competency II.C is financial privacy. This section is the first of those financial statutes: the Fair Credit Reporting Act of 1970 (FCRA), 15 U.S.C. §§ 1681–1681x, and the Fair and Accurate Credit Transactions Act of 2003 (FACTA), Pub. L. 108-159, which amended the FCRA rather than creating a separate code. Treat FACTA as an FCRA amendment. Do not treat it as a second, stand-alone privacy statute.

What a consumer report is — and the four roles

A consumer report is a communication by a consumer reporting agency (CRA) that bears on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, and that is used or expected to be used for credit, insurance, employment, or another purpose the FCRA authorizes. The nationwide CRAs — Equifax, Experian, and TransUnion — dominate exam fact patterns, but specialty CRAs (tenant screening, check writing, employment) are covered too.

Four roles appear on almost every FCRA item:

A bank that both reports account history and pulls reports to underwrite loans is a furnisher and a user. Name the role the question is actually testing.

Permissible purpose

Section 604 (15 U.S.C. § 1681b) is the gate. A CRA may furnish a consumer report only for a listed permissible purpose, including:

• a credit transaction involving the consumer
• employment purposes, but only after the user makes a clear written disclosure and obtains written authorization, and with extra pre-adverse-action steps (a copy of the report and the Summary of Rights) before a final adverse employment decision
• underwriting of insurance
• a court order or federal grand-jury subpoena
• a legitimate business need in a transaction the consumer initiated for personal, family, or household purposes
• certain government benefits, child-support, and licensing determinations the statute names

Curiosity, marketing curiosity, and "we already have an account relationship" are not, by themselves, a permissible purpose. Prescreened firm offers of credit or insurance are a separate, tightly conditioned path: the consumer must be given a chance to opt out of future prescreens, historically through 1-888-5-OPTOUT.

Scenario. A mortgage lender pulls a full Equifax file on a neighbor who never applied, "just to see if she is a good prospect." There is no permissible purpose. The CRA that released the file without a certified purpose, and the user that obtained it, both have FCRA exposure.

Adverse-action notice

If a user takes adverse action based in whole or in part on a consumer report, Section 615(a) (15 U.S.C. § 1681m) requires an oral, written, or electronic notice. Adverse action includes a denial of credit, insurance, or employment, an unfavorable change in terms, or a similar negative decision. The notice must:

1. tell the consumer that adverse action was taken based on information in a consumer report
2. give the CRA's name, address, and telephone number (toll-free if it is a nationwide CRA)
3. state that the CRA did not make the decision and cannot explain the specific reasons
4. state the consumer's right to a free copy of the report from that CRA if requested within 60 days
5. state the right to dispute the accuracy or completeness of the file
6. if a credit score was used, disclose the score and related information (a Dodd-Frank addition)

The CRA does not send this notice. The user does. Confusing those duties is a classic miss. If the decision used information from a source other than a CRA, a different 615(b) notice applies: the consumer may request the nature of that information within 60 days.

Accuracy, dispute, and the free annual file

CRAs must follow reasonable procedures to assure maximum possible accuracy of the information they report (15 U.S.C. § 1681e(b)). That is a procedures duty, not a strict-liability promise that every line is correct.

If the consumer disputes completeness or accuracy, Section 611 (15 U.S.C. § 1681i) requires a free, reasonable reinvestigation, generally completed within 30 days of the CRA's receipt of the dispute. The CRA may add 15 days (45 total) if the consumer supplies additional relevant information during the 30-day window. A dispute filed after the consumer receives the free annual file can also run 45 days. The CRA must forward the dispute to the furnisher. If the item cannot be verified, it must be deleted or modified, and the consumer gets written results.

FACTA created the right to a free annual file disclosure from each nationwide CRA. The centralized source Congress authorized is AnnualCreditReport.com. That statutory right is annual. Any more frequent free access the bureaus later offered is a business practice, not a substitute for the FACTA right. A consumer who receives an adverse-action notice has a separate 60-day free-copy right from the CRA named in that notice.

FACTA add-ons the exam actually names

FACTA is the identity-theft and accuracy package. Memorize these operational pieces:

• Disposal Rule, 16 C.F.R. Part 682 (FACTA § 216 / 15 U.S.C. § 1681w). Any person who maintains or possesses consumer information derived from a consumer report must take reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal. Reasonable measures include burning, pulverizing, or shredding paper, and wiping or destroying electronic media so the information cannot practicably be read or reconstructed. After Dodd-Frank, Disposal Rule rulemaking stayed with the Federal Trade Commission (FTC).
• Truncation, 15 U.S.C. § 1681c(g). No person that accepts a credit or debit card may print more than the last five digits of the card number, or the expiration date, on an electronically printed point-of-sale receipt. Handwritten or imprinted receipts are outside that subsection.
• Red Flags origin. FACTA § 114 directed the agencies to issue identity-theft red-flag guidelines. The resulting Red Flags Rule is taught in section 9.3; know here that FACTA is the statutory source.
• Risk-based pricing. If a creditor uses a consumer report and grants credit on material terms materially less favorable than the most favorable terms available to a substantial proportion of its consumers, it must generally give a risk-based pricing notice (Regulation V, 12 C.F.R. Part 1022, Subpart H). Providing a credit-score exception notice is a common alternative. This is not the same as an adverse-action notice: the consumer received credit, just on worse terms.
• Medical information, 15 U.S.C. § 1681b(g). A CRA generally may not furnish a report containing medical information for employment, credit, or insurance unless a listed exception applies (including coded medical-debt information that does not identify the provider or the nature of the services). Creditors generally may not obtain or use medical information to determine credit eligibility, subject to regulatory exceptions for legitimate operational needs.

FACTA also built the national fraud-alert system and required CRAs to block information that resulted from identity theft. Later legislation made credit freezes free; do not credit FACTA alone for today's freeze fee rule.

Private right of action and who enforces

FCRA is one of the few federal privacy statutes with a robust private right of action.

Willfulness after Safeco includes reckless disregard of a statutory duty, not only knowing defiance. Some furnisher duties (especially the duty to furnish accurate information to a CRA in the first instance) are enforceable by agencies, not by a private suit, unless the consumer has disputed and the furnisher failed to investigate. Read the fact pattern for which duty was broken.

Enforcement map. The Consumer Financial Protection Bureau (CFPB) received most FCRA rulemaking in the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 and recodified those rules as Regulation V, 12 C.F.R. Part 1022. The FTC still enforces the FCRA against many nonbank actors and retained rulemaking for Red Flags (15 U.S.C. § 1681m(e)) and the Disposal Rule (15 U.S.C. § 1681w). Federal banking regulators examine banks. State attorneys general may bring civil actions under 15 U.S.C. § 1681s(c). Verify the current preemption guidance: the CFPB's July 2022 interpretive rule, which read FCRA preemption as narrow and targeted, was withdrawn in May 2025 and replaced by an interpretive rule applicable 28 October 2025 (90 Fed. Reg. 48710) taking the opposite view — that 15 U.S.C. § 1681t(b)(1) sweeps broadly and generally preempts state laws touching the subject matter of the enumerated FCRA provisions, including state limits on medical debt in consumer reports. An interpretive rule does not have the force of law, and after Loper Bright the courts, not the Bureau, decide what § 1681t(b)(1) means. The exam-safe answer in 2026 is that the Bureau now asserts broad FCRA preemption of state credit-reporting rules and that the question is being litigated — not that the 2022 'narrow and targeted' reading is still the agency's position.

Exam traps

• Permissible purpose is required before the pull. A later "we meant to market to her" story does not cure an unlawful furnish or obtain.
• Adverse-action notice is a user duty. The CRA's job is the file, the dispute, and the free copy.
• FACTA did not repeal the FCRA. It added tools inside the same title.
• Willful statutory damages and punitive damages do not attach to a merely negligent violation.
• Card-receipt truncation is last five digits and no expiration date, and it applies to electronically printed receipts.