[House Report 116-416]
[From the U.S. Government Publishing Office]


116th Congress     }                                    {       Report
                        HOUSE OF REPRESENTATIVES
 2d Session        }                                    {      116-416

======================================================================



 
                PROTECTING YOUR CREDIT SCORE ACT OF 2019

                                _______
                                

 March 12, 2020.--Committed to the Committee of the Whole House on the 
              State of the Union and ordered to be printed

                                _______
                                

  Ms. Waters, from the Committee on Financial Services, submitted the 
                               following

                              R E P O R T

                             together with

                             MINORITY VIEWS

                        [To accompany H.R. 5332]

      [Including cost estimate of the Congressional Budget Office]

    The Committee on Financial Services, to whom was referred 
the bill (H.R. 5332) to amend the Fair Credit Reporting Act to 
ensure that consumer reporting agencies are providing fair and 
accurate information reporting in consumer reports, and for 
other purposes, having considered the same, reports favorably 
thereon with an amendment and recommends that the bill as 
amended do pass.

                                CONTENTS

                                                                   Page
Purpose and Summary..............................................     7
Background and Need for Legislation..............................     8
Section-by-Section Analysis......................................     9
Hearings.........................................................    11
Committee Consideration..........................................    12
Committee Votes..................................................    12
Statement of Oversight Findings and Recommendations of the 
  Committee......................................................    15
Statement of Performance Goals and Objectives....................    15
New Budget Authority and CBO Cost Estimate.......................    15
Committee Cost Estimate..........................................    19
Unfunded Mandate Statement.......................................    19
Advisory Committee...............................................    19
Application of Law to the Legislative Branch.....................    19
Earmark Statement................................................    19
Duplication of Federal Programs..................................    20
Changes to Existing Law..........................................    20

    The amendment is as follows:
  Strike all after the enacting clause and insert the 
following:

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

  (a) Short Title.--This Act may be cited as the ``Protecting Your 
Credit Score Act of 2019''.
  (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
Sec. 2. Establishment of online consumer portal landing page for 
consumer access to certain credit information.
Sec. 3. Accuracy in consumer reports.
Sec. 4. Improved dispute process for consumer reporting agencies.
Sec. 5. Injunctive relief.
Sec. 6. Increased transparency.
Sec. 7. Consumer reporting agency registry.
Sec. 8. Authority of Bureau with respect to consumer reporting 
agencies.
Sec. 9. Bureau standards for protecting nonpublic information.
Sec. 10. Report on data security risk assessments in examinations of 
consumer reporting agencies.
Sec. 11. GAO study on the use of social security numbers.

SEC. 2. ESTABLISHMENT OF ONLINE CONSUMER PORTAL LANDING PAGE FOR 
                    CONSUMER ACCESS TO CERTAIN CREDIT INFORMATION.

  (a) In General.--Section 612(a)(1) of the Fair Credit Reporting Act 
(15 U.S.C. 1681j(a)(1)) is amended by adding at the end the following:
                  ``(D) Online consumer portal landing page.--
                          ``(i) In general.--Not later than 1 year 
                        after the date of enactment of this 
                        subparagraph, each consumer reporting agency 
                        described in section 603(p) shall jointly 
                        develop an online consumer portal landing page 
                        that gives each consumer unlimited free access 
                        to--
                                  ``(I) the consumer report of the 
                                consumer;
                                  ``(II) the means by which the 
                                consumer may exercise the rights of the 
                                consumer under subparagraph (E) and 
                                section 604(e);
                                  ``(III) the ability to initiate a 
                                dispute with the consumer reporting 
                                agency regarding the accuracy or 
                                completeness of any information in a 
                                report in accordance with section 
                                611(a) or 623(a)(8);
                                  ``(IV) the ability to place and 
                                remove a security freeze on a consumer 
                                report for free under section 605A(i) 
                                and (j);
                                  ``(V) if the consumer reporting 
                                agency offers a product to consumers to 
                                prevent access to the consumer report 
                                of the consumer for the purpose of 
                                preventing identity theft, a disclosure 
                                to the consumer regarding the 
                                differences between that product and a 
                                security freeze as defined under 
                                section 605A(i) or (j);
                                  ``(VI) information on who has 
                                accessed the consumer report of the 
                                consumer over the last 24 months, and, 
                                as available, for what permissible 
                                purpose the consumer report was 
                                furnished in accordance with section 
                                604 and section 609; and
                                  ``(VII) the credit score of the 
                                consumer in accordance with section 
                                609(f)(7).
                          ``(ii) No waiver.--A consumer reporting 
                        agency described in section 603(p) may not 
                        require a consumer to waive any legal or 
                        privacy rights to access--
                                  ``(I) a portal established under this 
                                subparagraph; or
                                  ``(II) any of the services described 
                                in clause (i) that are provided through 
                                a portal established under this 
                                subparagraph.
                          ``(iii) No advertising or solicitations.--A 
                        portal established under this subparagraph may 
                        not contain any advertising, marketing offers, 
                        or other solicitations.
                          ``(iv) Extension.--The Bureau may allow the 
                        consumer reporting agencies an extension of 1 
                        year to develop the online consumer portal 
                        landing page required under clause (i).
                          ``(v) Rule of construction.--Nothing in this 
                        subparagraph may be construed as requiring a 
                        consumer reporting agency to disclose 
                        confidential proprietary information through 
                        the online consumer portal landing page.
                  ``(E) Opt-out option.--
                          ``(i) In general.--If a consumer reporting 
                        agency sells consumer information in a manner 
                        that is not included in a consumer report, the 
                        consumer reporting agency shall provide each 
                        consumer with a method (through a website, by 
                        phone, or in writing) by which the consumer may 
                        elect, free of charge, to not have the 
                        information of the consumer so sold.
                          ``(ii) No expiration.--An election made by a 
                        consumer under clause (i) shall expire on the 
                        date on which the consumer expressly revokes 
                        the election through a website, by phone, or in 
                        writing.''.
  (b) Conforming Amendment.--Section 612(f)(1) of the Fair Credit 
Reporting Act (15 U.S.C. 1681j(f)(1)) is amended, in the matter 
preceding subparagraph (A), by adding ``or that is made through the 
online consumer portal landing page established under subsection 
(a)(1)(D),'' after ``subsections (a) through (d),''.

SEC. 3. ACCURACY IN CONSUMER REPORTS.

  Section 607(b) of the Fair Credit Reporting Act (15 U.S.C. 1681e) is 
amended to read as follows:
  ``(b) Ensuring Accuracy.--
          ``(1) In general.--In preparing a consumer report, each 
        consumer reporting agency shall follow reasonable procedures to 
        assure maximum possible accuracy of the information concerning 
        the consumer to whom the report relates.
          ``(2) Matching information in a file.--In assuring the 
        maximum possible accuracy under paragraph (1), each consumer 
        reporting agency described in section 603(p) shall ensure that, 
        when including information in the file of a consumer, the 
        consumer reporting agency--
                  ``(A) matches all 9 digits of the social security 
                number of the consumer with the information that the 
                consumer reporting agency is including in the file; or
                  ``(B) if a consumer does not have a social security 
                number, matches information that includes the full 
                legal name, date of birth, current address, and at 
                least one former address of the consumer.
          ``(3) Periodic audits.--Each consumer reporting agency shall 
        perform periodic audits, on a schedule determined by the 
        Bureau, on a representative sample of consumer reports of the 
        agency to check for accuracy.''.

SEC. 4. IMPROVED DISPUTE PROCESS FOR CONSUMER REPORTING AGENCIES.

  (a) Responsibilities of Furnishers of Information to Consumer 
Reporting Agencies.--Section 623 of the Fair Credit Reporting Act (15 
U.S.C. 1681s-2) is amended--
          (1) in subsection (a)(8)--
                  (A) in subparagraph (E)(ii), by inserting ``and 
                consider'' after ``review''; and
                  (B) in subparagraph (F)--
                          (i) in clause (i)(II), by inserting ``, and 
                        does not include any new or additional 
                        information that would be relevant to a 
                        reinvestigation'' before the period at the end; 
                        and
                          (ii) by adding at the end the following new 
                        clause:
                          ``(iv) New or additional information.--For 
                        purposes of clause (i)(II), the term `new or 
                        additional information'--
                                  ``(I) means information of a type 
                                designated by the Bureau; and
                                  ``(II) does not include information 
                                previously provided to the person.''; 
                                and
          (2) in subsection (b)(1), by inserting ``and consider'' after 
        ``review''.
  (b) Bureau Credit Reporting Ombudsperson.--Section 611(a) of the Fair 
Credit Reporting Act (15 U.S.C. 1681i(a)) is amended by adding at the 
end the following:
          ``(8) Bureau credit reporting ombudsperson.--
                  ``(A) In general.--Not later than 180 days after the 
                date of enactment of this paragraph, the Bureau shall 
                establish the position of credit reporting 
                ombudsperson, whose specific duties shall include 
                carrying out the Bureau's responsibilities with respect 
                to--
                          ``(i) resolving persistent errors that are 
                        not resolved in a timely manner by a consumer 
                        reporting agency; and
                          ``(ii) enhancing oversight of consumer 
                        reporting agencies by--
                                  ``(I) advising the Director of the 
                                Bureau, in consultation with the Office 
                                of Enforcement and the Office of 
                                Supervision of the Bureau, on any 
                                potential violations of paragraph (5) 
                                or any other applicable law by a 
                                consumer reporting agency, including 
                                appropriate corrective action for such 
                                a violation; and
                                  ``(II) making referrals to the Office 
                                of Supervision for supervisory action 
                                or the Office of Enforcement for 
                                enforcement action, as appropriate, in 
                                response to violations of paragraph (5) 
                                or any other applicable law by a 
                                consumer reporting agency.
                  ``(B) Report.--The ombudsperson shall submit to the 
                Committee on Financial Services of the House of 
                Representatives and the Committee on Banking, Housing, 
                and Urban Affairs of the Senate an annual report 
                including statistics and analysis on consumer 
                complaints the Bureau receives relating to consumer 
                reports, as well as a summary of the supervisory 
                actions and enforcement actions taken with respect to 
                consumer reporting agencies during the year covered by 
                the report.''.
  (c) Responsibilities of Consumer Reporting Agencies.--Section 611 of 
the Fair Credit Reporting Act (15 U.S.C. 1681i) is amended--
          (1) in subsection (a)--
                  (A) in paragraph (1), by adding at the end the 
                following:
                  ``(D) Obligations of consumer reporting agencies 
                relating to reinvestigations.--Commensurate with the 
                volume and complexity of disputes about which a 
                consumer reporting agency receives notice, or 
                reasonably anticipates to receive notice, under this 
                paragraph, each consumer reporting agency shall--
                          ``(i) maintain sufficient personnel to 
                        conduct reinvestigations of those disputes; and
                          ``(ii) provide training with respect to the 
                        personnel described in clause (i).'';
                  (B) in paragraph (6)(B)--
                          (i) by amending clause (ii) to read as 
                        follows:
                          ``(ii) a copy of the consumer's file and a 
                        consumer report that is based upon such file as 
                        revised, including a description of the 
                        specific modification or deletion of 
                        information, as a result of the 
                        reinvestigation;'';
                          (ii) by striking clause (iii) and 
                        redesignating clauses (iv) and (v) as clauses 
                        (vi) and (vii), respectively;
                          (iii) by inserting after clause (ii) the 
                        following:
                          ``(iii) a description of the actions taken by 
                        the consumer reporting agency regarding the 
                        dispute;
                          ``(iv) if applicable, contact information for 
                        any furnisher involved in responding to the 
                        dispute and a description of the role played by 
                        the furnisher in the reinvestigation process;
                          ``(v) the options available to the consumer 
                        if the consumer is dissatisfied with the result 
                        of the reinvestigation, including--
                                  ``(I) submitting documents in support 
                                of the dispute;
                                  ``(II) adding a consumer statement of 
                                dispute to the file of the consumer 
                                pursuant to subsection (b);
                                  ``(III) filing a dispute with the 
                                furnisher pursuant to section 
                                623(a)(8); and
                                  ``(IV) submitting a complaint against 
                                the consumer reporting agency or 
                                furnishers through the consumer 
                                complaint database of the Bureau or the 
                                State attorney general for the State in 
                                which the consumer resides;'';
                  (C) by striking paragraph (7) and redesignating 
                paragraph (8) as paragraph (7); and
                  (D) in paragraph (7), as so redesignated, by striking 
                ``paragraphs (2), (6), and (7)'' and inserting 
                ``paragraphs (2) and (6)''; and
          (2) by adding at the end the following new subsection:
  ``(h) Notification of Deletion of Information.--A consumer reporting 
agency described in section 603(p) shall communicate with other 
consumer reporting agencies described in section 603(p) to ensure that 
a dispute initiated with one consumer reporting agency is noted in a 
file maintained by such other consumer reporting agencies.''.

SEC. 5. INJUNCTIVE RELIEF.

  (a) In General.--The Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.) is amended--
          (1) in section 616 (15 U.S.C. 1681n)--
                  (A) in subsection (a), by amending the subsection 
                heading to read as follows: ``Damages'';
                  (B) by redesignating subsections (c) and (d) as 
                subsections (d) and (e), respectively; and
                  (C) by inserting after subsection (b) the following:
  ``(c) Injunctive Relief.--
          ``(1) In general.--In addition to any other remedy under this 
        section, a court may award injunctive relief to require 
        compliance with the requirements imposed under this title with 
        respect to any consumer.
          ``(2) Attorney's fees.--In the event of any successful action 
        for injunctive relief under this subsection, a court may award 
        to the prevailing party reasonable attorney's fees (as 
        determined by the court) incurred by the prevailing party 
        during the action.''; and
          (2) in section 617 (15 U.S.C. 1681o)--
                  (A) in subsection (a), in the subsection heading, by 
                striking ``(a) In General.--'' and inserting ``(a) 
                Damages.--'';
                  (B) by redesignating subsection (b) as subsection 
                (c); and
                  (C) by inserting after subsection (a) the following:
  ``(b) Injunctive Relief.--
          ``(1) In general.--In addition to any other remedy under this 
        section, a court may award injunctive relief to require 
        compliance with the requirements imposed under this title with 
        respect to any consumer.
          ``(2) Attorney's fees.--In the event of any successful action 
        for injunctive relief under this subsection, a court may award 
        to the prevailing party reasonable attorney's fees (as 
        determined by the court) incurred by the prevailing party 
        during the action.''.
  (b) Enforcement.--Section 615(h)(8) of the Fair Credit Reporting Act 
(15 U.S.C. 1681m(h)(8)) is amended--
          (1) in subparagraph (A), by striking ``section'' and 
        inserting ``subsection''; and
          (2) in subparagraph (B), by striking ``This section'' and 
        inserting ``This subsection''.

SEC. 6. INCREASED TRANSPARENCY.

  (a) Disclosures to Consumers.--Section 609 of the Fair Credit 
Reporting Act (15 U.S.C. 1681g) is amended--
          (1) in subsection (a)(3)(B)--
                  (A) in clause (i), by striking ``and'' at the end; 
                and
                  (B) by striking clause (ii) and inserting the 
                following:
                  ``(ii) the address and telephone number of the 
                person; and
                  ``(iii) the permissible purpose, as available, of the 
                person for obtaining the consumer report, including the 
                specific type of credit product that is extended, 
                reviewed, or collected, as described in section 
                604(a)(3)(A).'';
          (2) in subsection (f)--
                  (A) by amending paragraph (7)(A) to read as follows:
                  ``(A) supply the consumer with a credit score through 
                the portal established under section 612(a)(1)(D) or 
                upon request by the consumer, as applicable, that--
                          ``(i) is derived from a credit scoring model 
                        that is widely distributed to users by that 
                        consumer reporting agency for the purpose of 
                        any extension of credit or other transaction 
                        designated by the consumer who is requesting 
                        the credit score; or
                          ``(ii) is widely distributed to lenders of 
                        common consumer loan products and predicts the 
                        future credit behavior of the consumer; and''; 
                        and
                  (B) in paragraph (8), by inserting ``, except that a 
                credit score shall be provided free of charge to the 
                consumer if requested in connection with a free annual 
                consumer report described in section 612(a) or through 
                the online consumer portal landing page established 
                under section 612(a)(1)(D)'' before the period at the 
                end; and
          (3) in subsection (g)(1)--
                  (A) in subparagraph (A)(ii)--
                          (i) in the clause heading, by striking 
                        ``subparagraph (d)'' and inserting 
                        ``subparagraph (C)''; and
                          (ii) by striking ``subparagraph (D)'' and 
                        inserting ``subparagraph (C)'';
                  (B) in subparagraph (B)(ii), by striking ``consistent 
                with subparagraph (C)'';
                  (C) by striking subparagraph (C); and
                  (D) by redesignating subparagraphs (D) through (G) as 
                subparagraphs (C) through (F), respectively.
  (b) Notification Requirements.--
          (1) Adverse information notification.--
                  (A) In general.--The Fair Credit Reporting Act (15 
                U.S.C. 1681 et seq.) is amended--
                          (i) in section 612 (15 U.S.C. 1681j), by 
                        striking subsection (b) and inserting the 
                        following:
  ``(b) Free Disclosure After Notice of Adverse Action or Offer of 
Credit on Materially Less Favorable Term.--Not later than 30 days after 
the date on which a consumer reporting agency receives a notification 
under subsection (a)(2) or (h)(6) of section 615, or from a debt 
collection agency affiliated with the consumer reporting agency, the 
consumer reporting agency shall make to a consumer, without charge to 
the consumer, all disclosures that are made to a user of a consumer 
report in accordance with the rules prescribed by the Bureau.''; and
                          (ii) in section 615(a) (15 U.S.C. 1681m(a))--
                                  (I) by redesignating paragraphs (2), 
                                (3), and (4) as paragraphs (3), (4), 
                                and (5), respectively;
                                  (II) by inserting after paragraph (1) 
                                the following:
          ``(2) direct the consumer reporting agency that provided the 
        consumer report that was used in the decision to take the 
        adverse action to provide the consumer with the disclosures 
        described in section 612(b);''; and
                                  (III) in paragraph (5), as so 
                                redesignated--
                                          (aa) in the matter preceding 
                                        subparagraph (A), by striking 
                                        ``of the consumer's right'';
                                          (bb) by striking subparagraph 
                                        (A) and inserting the 
                                        following:
                  ``(A) that the consumer shall receive a copy of the 
                consumer report with respect to the consumer, free of 
                charge, from the consumer reporting agency that 
                furnished the consumer report; and''; and
                                          (cc) in subparagraph (B), by 
                                        inserting ``of the right of the 
                                        consumer'' before ``to 
                                        dispute''.
                  (B) Conforming amendment.--Section 604(b)(2)(B)(i) of 
                the Fair Credit Reporting Act (15 U.S.C. 
                1681b(b)(2)(B)(i)) is amended by striking ``section 
                615(a)(3)'' and inserting ``section 615(a)(4)''.
          (2) Notification in cases of less favorable terms.--Section 
        615(h) of the Fair Credit Reporting Act (15 U.S.C. 1681m(h)) is 
        amended--
                  (A) in paragraph (1), by striking ``paragraph (6)'' 
                and inserting ``paragraph (7)'';
                  (B) in paragraph (2), by striking ``paragraph (6)'' 
                and inserting ``paragraph (7)'';
                  (C) in paragraph (5)(C), by striking ``may obtain'' 
                and inserting ``shall receive'';
                  (D) by redesignating paragraphs (6), (7), and (8) as 
                paragraphs (7), (8), and (9), respectively; and
                  (E) by inserting after paragraph (5) the following:
          ``(6) Reports provided to consumers.--A person who uses a 
        consumer report as described in paragraph (1) shall notify and 
        direct the consumer reporting agency that provided the consumer 
        report to provide the consumer with the disclosures described 
        in section 612(b).''.
          (3) Notification of subsequent submissions of negative 
        information.--Section 623(a)(7)(A)(ii) of the Fair Credit 
        Reporting Act (15 U.S.C. 1681s-2(a)(7)(A)(ii)) is amended by 
        striking ``with respect to'' and all that follows through the 
        period at the end and inserting ``without providing additional 
        notice to the consumer, unless another person acquires the 
        right to repayment connected to the additional negative 
        information. The acquiring person shall be subject to the 
        requirements of this paragraph and shall be required to send 
        consumers the written notices described in this paragraph, if 
        applicable.''.

SEC. 7. CONSUMER REPORTING AGENCY REGISTRY.

  Section 621 of the Fair Credit Reporting Act (15 U.S.C. 1681s) is 
amended by adding at the end the following:
  ``(h) Consumer Reporting Agency Registry.--
          ``(1) Establishment of registry.--Not later than 180 days 
        after the date of enactment of this subsection, the Bureau 
        shall establish a publicly available registry of consumer 
        reporting agencies that includes--
                  ``(A) each consumer reporting agency that compiles 
                and maintains files on consumers on a nationwide basis;
                  ``(B) each nationwide specialty consumer reporting 
                agency;
                  ``(C) all other consumer reporting agencies that are 
                not included under section 603(p) or 603(x); and
                  ``(D) links to any relevant websites of a consumer 
                reporting agency described under subparagraphs (A) 
                through (C).
          ``(2) Registration requirement.--The Bureau shall establish a 
        deadline, which shall be not later than 270 days after the date 
        of the enactment of this subsection, by which each consumer 
        reporting agency described in paragraph (1) shall be required 
        to register in the registry established under such 
        paragraph.''.

SEC. 8. AUTHORITY OF BUREAU WITH RESPECT TO CONSUMER REPORTING 
                    AGENCIES.

  Section 1024(a)(1) of the Dodd-Frank Wall Street Reform and Consumer 
Protection Act (12 U.S.C. 5514(a)(1)) is amended--
          (1) in subparagraph (D), by striking ``or'' at the end;
          (2) in subparagraph (E), by striking the period at the end 
        and inserting ``; or''; and
          (3) by adding at the end the following new subparagraph:
                  ``(F) is a consumer reporting agency described under 
                section 603(p) of the Fair Credit Reporting Act.''.

SEC. 9. BUREAU STANDARDS FOR PROTECTING NONPUBLIC INFORMATION.

  Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.) is 
amended--
          (1) in section 501, by adding at the end the following new 
        subsection:
  ``(c) Consumer Reporting Agency Safeguards.--The Bureau of Consumer 
Financial Protection shall establish, by rule, appropriate standards 
for consumer reporting agencies described under section 603(p) of the 
Fair Credit Reporting Act relating to administrative, technical, and 
physical safeguards to protect records and information as described in 
paragraphs (1) through (3) of subsection (b).'';
          (2) in section 504(a)(1)(A), by striking ``, except that the 
        Bureau of Consumer Financial Protection shall not have 
        authority to prescribe regulations with respect to the 
        standards under section 501''; and
          (3) in section 505(a)(8), by inserting ``, other than under 
        subsection (c) of section 501'' after ``section 501''.

SEC. 10. REPORT ON DATA SECURITY RISK ASSESSMENTS IN EXAMINATIONS OF 
                    CONSUMER REPORTING AGENCIES.

  Not later than 90 days after the date of the enactment of this Act, 
the Director of the Bureau of Consumer Financial Protection shall 
assess whether examinations conducted by the Director of consumer 
reporting agencies described under section 603(f) of the Fair Credit 
Reporting Act (15 U.S.C. 1681a(f)) include sufficient processes to 
addresses any data security risks to the consumers of such agencies on 
which such agencies maintain and compile files. Along with the first 
semiannual report required under section 1016(b) of the Consumer 
Financial Protection Act of 2010 (12 U.S.C. 5496(b)) to be submitted 
after the 90-day period after the date of the enactment of this Act, 
the Director shall submit to Congress a report containing the results 
of such assessment that includes--
          (1) recommendations for improving the processes to addresses 
        any such data security risks; and
          (2) the progress of the Director on making any improvements 
        described under paragraph (1).

SEC. 11. GAO STUDY ON THE USE OF SOCIAL SECURITY NUMBERS.

  (a) Study.--The Comptroller General of the United States shall carry 
out a study on the feasibility and means of consumer reporting agencies 
replacing the use of social security numbers as identifiers with 
another type of Federal identification.
  (b) Report.--Not later than the end of the 2-year period beginning on 
the date of the enactment of this Act, the Comptroller General shall 
issue a report to the Congress containing all findings and 
determinations made in carrying out the study required under subsection 
(a).

                          Purpose and Summary

    On December 6, 2019, Representative Josh Gottheimer 
introduced H.R. 5332, the ``Protecting Your Credit Score Act of 
2019,'' which directs the nationwide consumer reporting 
agencies (CRAs) to create a single online portal landing page 
for consumers to access free credit reports, credit scores, 
dispute errors, and place or lift security freezes. This 
landing page would also contain clear information on consumer 
rights and handling report disputes. The bill also codifies the 
Consumer Financial Protection Bureau's (CFPB or Consumer 
Bureau) supervision of the nationwide CRAs and clarifies that 
the Consumer Bureau has authority, under the Gramm-Leach-Bliley 
Act, to prescribe and enforce data security safeguards for the 
nationwide CRAs. The bill provides for injunctive relief to 
allow a court to compel a CRA to fix an error or remove 
inaccurate information from a consumer report. The bill creates 
an Ombudsperson at the Consumer Bureau tasked with resolving 
persistent errors on reports that are not addressed in a timely 
fashion and allows the Ombudsperson to make referrals to the 
Offices of Supervision and Enforcement for corrective action in 
response to violations of applicable law by a CRA. Finally, the 
bill requires the Government Accountability Office (GAO) to 
conduct a study on the feasibility and means of CRAs replacing 
the use of Social Security numbers as identifiers.

                  Background and Need for Legislation

    Our nation's credit reporting system is broken yet has an 
impact on almost every American. Credit scores and credit 
reports are increasingly relied upon by creditors, employers, 
insurers, and even law enforcement. Yet it has been more than 
15 years since Congress enacted comprehensive reform of the 
consumer reporting system,\1\ and there have been numerous 
shortcomings with the current system identified during that 
time that need to be addressed. For example, a Federal Trade 
Commission (FTC) study found that one out of every five 
consumers have a verified error on their consumer reports and 
five percent had errors serious enough to result in them being 
denied credit or paying more for mortgages, auto loans, 
insurance policies, and other financial obligations.\2\ An 
analysis of the Consumer Bureau's consumer complaint database 
revealed that in 2018, credit reports were the most complained 
about financial product, and the three major credit bureaus--
Equifax, Experian and TransUnion--were the most complained 
about financial companies.\3\
---------------------------------------------------------------------------
    \1\The Fair and Accurate Credit Transactions Act of 2003 (FACT Act; 
P.L. 108-159), among other things, allows consumers to request and 
obtain a free credit report once a year from each of the three 
nationwide consumer reporting agencies.
    \2\https://www.ftc.gov/sites/default/files/documents/reports/
section-319-fair-and-accurate-credit-transactions-act-2003-fifth-
interim-federal-trade-commission/130211factareport.pdf.
    \3\https://uspirg.org/news/usp/youre-not-alone-cfpb-complaints-
rise.
---------------------------------------------------------------------------
    According to the Consumer Bureau, many consumers believe 
consumer reports are ``hard to get and hard to understand.''\4\ 
Unlike a consumer's Federal right to obtain a free annual 
consumer report from each of the nationwide CRAs and nationwide 
specialty CRAs, in most cases, consumers have no legal right to 
their credit score.\5\ Unlike other businesses where 
dissatisfied and unhappy consumers can decide to stop doing 
business with a company, consumers have almost no control over 
whether furnishers provide information about them to CRAs that 
is compiled and maintained in the CRAs' databases. Consumers' 
concerns about credit reporting errors and their fears about 
stolen credit information and identity theft have also 
increased consumers' purchases of credit monitoring services 
and other products from the nationwide CRAs, which have allowed 
these companies to profit, in part, from their own deficient 
practices.\6\
---------------------------------------------------------------------------
    \4\CFPB, ``Consumer Voices on Credit Reports and Scores,'' Feb. 
2015, at 19, available at: https://files.consumerfinance.gov/f/
201502_cfpb_report_consumer-voices-on-credit-reports-and-scores.pdf.
    \5\The Dodd-Frank Act, amended the FCRA, to require ``adverse 
action notices'' (which are disclosures sent to consumers by creditors 
when a person has applied, but been denied, credit by a company to 
identify for the consumer, the CRA that the company obtained a report 
from to help make this decision) and ``risk-based pricing notices'' 
(which are disclosures sent to consumers by creditors informing a 
consumer that their request for new credit has been granted to them 
but, on materially less favorable terms and conditions, than the 
creditor has provided to other consumers to identify the CRA that the 
creditor obtained a report from to help make this decision) to include 
credit score disclosures.
    \6\Consumer Voices on Credit Reports and Scores, supra note 4, at 
13.
---------------------------------------------------------------------------
    The Consumer Bureau has found that there is significant 
consumer confusion about the differences between the credit 
scores available to consumers and those that are sold to, and 
used by, creditors or lenders.\7\ This confusion can lead to 
consumers forming inaccurate perceptions of their ability to 
access credit on affordable terms.\8\ In addition, CRAs 
frequently market consumer reporting products and services as 
``free'' when they are actually paid-subscription services that 
automatically convert after a trial period.
---------------------------------------------------------------------------
    \7\Id. at 9.
    \8\Id. at 18.
---------------------------------------------------------------------------
    In addition, following the Equifax data breach, which 
compromised at least 145.5 million consumers' data, the GAO 
found that consumers have little control over what information 
credit reporting agencies have, and that Federal oversight 
could be improved, including by enhancing the Consumer Bureau's 
oversight of CRAs and strengthening Federal enforcement of data 
safeguards.\9\
---------------------------------------------------------------------------
    \9\Government Accountability Office, Consumer Data Protection: 
Actions Needed to Strengthen Oversight of Consumer Reporting Agencies 
31 (2019), available at https://www.gao.gov/products/GAO-19-196.
---------------------------------------------------------------------------
    It is critical that Congress act swiftly to address these 
critical flaws and modernize the Fair Credit Reporting Act to 
ensure the credit reporting system works better for all 
Americans.
    This legislation is supported by a coalition of consumer 
and community organizations.\10\ The National Association of 
Realtors also support this legislation.\11\
---------------------------------------------------------------------------
    \10\Supporting organizations include Americans for Financial 
Reform, Consumer Action, Consumer Federation of America, Consumer 
Reports, National Association of Consumer Advocates, National Consumer 
Law Center (on behalf of its low-income clients), U.S. PIRG, World 
Privacy Forum.
    \11\National Association of Realtors letter, available at https://
narfocus.com/billdatabase/clientfiles/172/2/3473.pdf.
---------------------------------------------------------------------------
    This legislation was considered at a Financial Services 
Task Force on Financial Technology hearing on July 25th, 2019 
and discussed at a full committee hearing on February 26, 
2019.\12\
---------------------------------------------------------------------------
    \12\Financial Services Task Force on Financial Technology Committee 
Hearing: ``Examining the Use of Alternative Data in Underwriting and 
Credit Scoring to Expand Access to Credit'' (2019). Hearing information 
available at https://financialservices.house.gov/calendar/
eventsingle.aspx?EventID=404003. See also Financial Services Committee 
Hearing: ``Who's Keeping Score? Holding Credit Bureaus Accountable and 
Repairing a Broken System'' (2019). Hearing information available at 
https://financialservices.house.gov/calendar/
eventsingle.aspx?EventID=402343.
---------------------------------------------------------------------------

                      Section-by-Section Analysis


Section 1. Title; Table of contents

    This section provides that H.R. 5332 may be cited as the 
``Protecting Your Credit Score Act of 2019.''

Section 2. Establishment of online consumer portal landing page for 
        consumer access to certain credit information

    This section adds a new subparagraph (D) to Section 
612(a)(1) of the Fair Credit Reporting Act.
    The new subparagraph (D) mandates that within one year of 
enactment, the three largest consumer reporting agencies 
described in section 603(p) must jointly develop an online 
portal that gives consumers unlimited free access to their 
consumer report, the ability to initiate disputes, the ability 
to lift and remove security freezes, information on who has 
accessed their report over the last two years, and their credit 
score. The portal cannot contain any advertising or 
solicitations. The CFPB may also grant the CRAs an additional 
year to create the portal if necessary.

Section 3. Accuracy in consumer reports

    This section amends Section 607(b) of the Fair Credit 
Reporting Act.
    In order to ensure the maximum possible accuracy of a 
consumer report, the amended section 607(b) provides that CRAs 
must match all nine digits of a social security number (SSN) to 
the consumer. If there is no SSN available, the CRAs must match 
the full legal name, date of birth, current address, and at 
least one previous address of the consumer. Each CRA must also 
conduct periodic audits on a sample of consumer reports to 
check for accuracy.

Section 4. Improved dispute process for consumer reporting agencies

    Subsection (a) amends Section 623 of the Fair Credit 
Reporting Act by providing that the CRAs must ``review and 
consider'' disputes.
    Subsection (b) amends section 611(a) of the Fair Credit 
Reporting Act by adding a new paragraph (8) that creates a 
Credit Reporting Ombudsperson at the CFPB in order to help 
resolve persistent errors that are not resolved in a timely 
manner as well as make referrals for supervisory and 
enforcement action, as may be appropriate, against CRAs. The 
Ombudsperson will support an annual report including an 
analysis of consumer complaints to the CFPB regarding credit 
reporting issues.
    Subsection (c) further amends section 611(a) to mandate 
that CRAs must maintain and train enough personnel to conduct 
reinvestigations of disputes, and provides for additional 
requirements with respect to such reinvestigations.

Section 5. Injunctive relief

    This section amends the Fair Credit Reporting Act by adding 
a new subsection (c) to section 616 and a new subsection (b) to 
section 617 of such Act.
    Under the new subsections added by this section, courts may 
award injunctive relief to require compliance with the Fair 
Credit Reporting Act. This section also authorizes courts to 
award costs and reasonable attorney's fees.
    This section also amends section 615(h)(8) of the Fair 
Credit Reporting Act to make certain conforming amendments.

Section 6: Increased transparency

    This section amends Sections 604, 609, 612, and 615 of the 
Fair Credit Reporting Act.
    Subsection (a) amends section 609 of the Fair Credit 
Reporting Act. The amended section 609 provides that upon 
request, the CRAs must disclose to the consumer the name, 
address, and telephone number of anyone that has accessed their 
consumer report, as well as for what purpose. It also provides 
that a credit score shall be provided free of charge if 
requested through the portal.
    Paragraph (1) of subsection (b) amends and replaces section 
612(b) of the Fair Credit Reporting Act to require that when a 
CRA receives notice of adverse action or offer of credit on 
materially less favorable terms on a consumer's report, they 
shall disclose that information to the consumer within 30 days. 
This paragraph also makes a conforming amendment to section 
604.
    Paragraph (2) of subsection (b) amends section 615(h) of 
the Fair Credit Reporting Act to provide that a person that 
uses a consumer report to offer credit to a consumer on 
materially less favorable terms must inform the relevant CRA 
and direct the CRA to provide the disclosures described in the 
amended section 612(b).
    Paragraph (3) of subsection (b) amends section 623 of the 
Fair Credit Reporting Act to ensure that consumers receive 
notice of subsequent submissions of negative information.

Section 7. Consumer reporting agency registry

    This section amends Section 621 of the Fair Credit 
Reporting Act by adding a new subsection (h).
    The new subsection (h) provides that within 180 days of the 
enactment of this subsection, the CFPB must establish a 
publicly available registry that includes all CRAs as well as 
links to any relevant websites of a CRA. It gives the CRAs 270 
days to register in this registry.

Section 8. Authority of Bureau with respect to consumer reporting 
        agencies

    This section amends Section 1024(a)(1) of the Dodd-Frank 
Wall Street Reform and Consumer Protection Act to codify the 
CFPB's supervisory authority over the CRAs.

Section 9. Bureau standards for protecting non-public information

    This section amends section 501 of the Gramm-Leach-Bliley 
Act (GLBA) by clarifying the CFPB's authority over the CRAs 
relating to administrative, technical, and physical safeguards 
required by GLBA to protect records and sensitive information.

Section 10. Report on data security risk assessments in examinations of 
        consumer reporting agencies

    This section provides that within 90 days of the enactment 
of H.R. 5332, the CFPB Director shall assess whether Bureau 
examinations of the CRAs include sufficient processes to 
address any data security risks to the consumers that have 
files held by the CRAs. This section also provides that in the 
first semi-annual report to Congress after the enactment of the 
bill, the Director shall submit a report that includes 
recommendations for improving the processes to address any data 
security risks as well as the progress of the Bureau on making 
these improvements.

Section 11. GAO study on the use of social security numbers

    This section directs the Comptroller General of the GAO to 
conduct a study on the feasibility and means of consumer 
reporting agencies replacing the use of social security numbers 
as identifiers with another type of federal identification. The 
GAO will have two years from the date of bill enactment to 
report the findings to Congress.

                                Hearings

    For the purposes of section 103(i) of H. Res. 6 for the 
116th Congress--
    (1) The Committee on Financial Services held a hearing, 
entitled ``Who's Keeping Score? Holding Credit Bureaus 
Accountable and Repairing a Broken System'' to consider the 
``Comprehensive Consumer Credit Reporting Reform Act of 2019'' 
(Title III of the discussion draft is substantially similar to 
H.R. 5332) on February 26, 2019. The two-panel hearing 
consisted of a panel with the CEOs of the three largest Credit 
Reporting Agencies: Equifax, TransUnion, and Experian. 
Witnesses on the second panel included representatives from the 
National Fair Housing Alliance, the National Consumer Law 
Center, UnidosUS, U.S. Public Interest Research Group (PIRG), 
and a Paul Hastings partner and attorney. The hearing allowed 
Members of the Financial Services Committee to hear from 
witnesses about the continuing challenges of modernizing the 
Fair Credit Reporting Act to better protect consumers and their 
data, as well as other legislation to help overcome those 
challenges.
    (2) The Committee on Financial Services' taskforce on 
Financial Technology held a hearing, entitled ``Examining the 
Use of Alternative Data in Underwriting and Credit Scoring to 
Expand Access to Credit'' on July 25, 2019 to discuss emerging 
technologies and how they impact access to credit, and their 
impact across communities. The panel of witnesses consisted of 
representatives from the National Consumer Law Center, Tulane 
University Law School, The Government Accountability Office 
(GAO), Upstart, and Upturn.
    (3) In addition, during the 115th Congress, the Financial 
Services Committee held a two-part hearing on the Equifax data 
breach and related credit reporting and consumer data 
protection issues. The first part of the hearing entitled 
``Examining the Equifax Data Breach'' took place on October 5, 
2017 and featured the former Chairman and CEO to Equifax. The 
Committee also held a Minority Day hearing, which was a 
continuation of the hearing entitled, ``Examining the Equifax 
Data Breach'' and took place on October 25, 2017. Witnesses 
included representatives from the Consumer Financial Protection 
Bureau, the National Consumer Law Center, Georgetown University 
Law Center, and the Office of the New York State Attorney 
General.

                        Committee Consideration

    The Committee on Financial Services met in open session on 
December 11, 2019 and ordered H.R. 5332 to be reported 
favorably to the House with an amendment in the nature of a 
substitute by a vote of 31 yeas and 24 nays, a quorum being 
present.

                  Committee Votes and Roll Call Votes

    In compliance with clause 3(b) of rule XIII of the Rules of 
the House of Representatives, the Committee advises that the 
following roll call votes occurred during the Committee's 
consideration of H.R. 5332:

              [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

  Statement of Oversight Findings and Recommendations of the Committee

    In compliance with clause 3(c)(1) of rule XIII and clause 
2(b)(1) of rule X of the Rules of the House of Representatives, 
the Committee's oversight findings and recommendations are 
reflected in the descriptive portions of this report.

             Statement of Performance Goals and Objectives

    Pursuant to clause (3)(c) of rule XIII of the Rules of the 
House of Representatives, the goals of H.R. 5332 are to 
increase easy access to free credit reports, scores, and credit 
file information for consumers.

                 New Budget Authority and CBO Estimate

    Pursuant to clause 3(c)(2) of rule XIII of the Rules of the 
House of Representatives and section 308(a) of the 
Congressional Budget Act of 1974, and pursuant to clause 
3(c)(3) of rule XIII of the Rules of the House of 
Representatives and section 402 of the Congressional Budget Act 
of 1974, the Committee has received the following estimate for 
H.R. 5332 from the Director of the Congressional Budget Office:

                                     U.S. Congress,
                               Congressional Budget Office,
                                 Washington, DC, February 21, 2020.
Hon. Maxine Waters,
Chairwoman, Committee on Financial Services,
House of Representatives, Washington, DC.
    Dear Madam Chairwoman: The Congressional Budget Office has 
prepared the enclosed cost estimate for H.R. 5332, the 
Protecting Your Credit Score Act of 2019.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contact is David Hughes.
            Sincerely,
                                         Phillip L. Swagel,
                                                          Director.
    Enclosure.

              [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
    

    The bill would:
           Require the Consumer Financial Protection 
        Bureau (CFPB) to issue rules that impose new 
        requirements on consumer reporting agencies (CRAs) and 
        entities that furnish information to CRAs
           Require the CFPB to hire a credit reporting 
        ombudsman to coordinate bureau activity regarding CRAs
           Impose private-sector mandates as defined in 
        the Unfunded Mandates Reform Act (UMRA) by placing new 
        requirements on CRAs, financial institutions, and 
        entities that furnish information to CRAs
           Impose intergovernmental mandates as defined 
        in UMRA by requiring users of consumer reports to 
        notify CRAs of adverse actions taken against a consumer
    Estimated budgetary effects would primarily stem from:
           Increases in direct spending for additional 
        CFPB staff
    Bill summary: H.R. 5332 would direct the Consumer Financial 
Protection Bureau (CFPB) to issue rules requiring consumer 
reporting agencies (CRAs) to provide consumers with free online 
access to their consumer reports and credit scores. The bill 
also would require CRAs to be staffed to adequately conduct 
reinvestigations of disputed information in consumers' files. 
The rules would establish standards for CRAs to safeguard 
consumer information and include a schedule for CRAs to audit 
the accuracy of personally identifiable information in consumer 
files.
    H.R. 5332 also would require the CFPB to hire a credit-
reporting ombudsman to identify and resolve persistent errors 
in CRAs' reports, enhance the bureau's supervision of CRAs, and 
report to the Congress annually about consumers' complaints. 
The bureau would be required to establish a public registry of 
CRAs and report to the Congress on whether its own examinations 
sufficiently address the security risks faced by consumers 
whose information is held by CRAs.
    Finally, the bill would require the Government 
Accountability Office (GAO) to report to the Congress on the 
feasibility of CRAs' methods of identifying consumers' 
information.
    Estimated Federal cost: The costs of the legislation fall 
within budget function 370 (commerce and housing credit).
    Basis of estimate: CBO assumes that H.R. 5332 would be 
enacted in 2020. The CFPB has permanent authority, not subject 
to annual appropriation, to spend amounts transferred from the 
Federal Reserve. CBO's estimates of the cost of the 
requirements in the bill are based on information from the CFPB 
and on the cost of similar activities.
    In total, CBO estimates that enacting H.R. 5332 would 
increase direct spending by $25 million over the 2020-2030 
period. The components of that cost are detailed below.
           CBO estimates that the CFPB would need to 
        hire 20 employees, at an annual cost of $220,000 each, 
        for about 18 months to issue the required rules for a 
        total cost of $7 million over the 2020-2021 period.
           CBO estimates that the CFPB would need to 
        hire an ombudsman and five additional staff near the 
        end of 2020 to fulfill various duties, at an initial 
        annual cost of $220,000 with adjustments in later years 
        for inflation, or $17 million over the 2020-2030 
        period.
           CBO estimates that the cost to the CFPB of 
        other required activities would be $1 million over the 
        2020-2030 period.
           CBO estimates that the cost for GAO to 
        report to the Congress would be less than $500,000 and 
        would be subject to the availability of appropriated 
        funds.
    Pay-As-You-Go considerations: The Statutory Pay-As-You-Go 
Act of 2010 establishes budget-reporting and enforcement 
procedures for legislation affecting direct spending or 
revenues. The net changes in outlays that are subject to those 
pay-as-you-go procedures are shown in Table 1.

 TABLE 1.--CBO'S ESTIMATE OF THE STATUTORY PAY-AS-YOU-GO EFFECTS OF H.R. 5332, THE PROTECTING YOUR CREDIT SCORE ACT OF 2019, AS ORDERED REPORTED BY THE
                                               HOUSE COMMITTEE ON FINANCIAL SERVICES ON DECEMBER 11, 2019
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                     By fiscal year, millions of dollars--
                                                      --------------------------------------------------------------------------------------------------
                                                        2020   2021   2022   2023   2024   2025   2026   2027   2028   2029   2030  2020-2025  2020-2030
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                               Net Increase in the Deficit
 
Pay-As-You-Go Effect.................................      1      7      1      2      2      2      2      2      2      2      2        15         25
--------------------------------------------------------------------------------------------------------------------------------------------------------

    Increase in long-term deficits: CBO estimates that enacting 
H.R. 5332 would not increase on-budget deficits by more than $5 
billion in any of the four consecutive 10-year periods 
beginning in 2031.
    Mandates: The bill contains intergovernmental and private-
sector mandates as defined in the Unfunded Mandates Reform Act 
(UMRA). CBO estimates that the costs of the intergovernmental 
mandates would fall below the UMRA threshold ($84 million in 
2020, adjusted annually for inflation). CBO estimates that the 
aggregate cost of the private-sector mandates would exceed the 
threshold established in UMRA ($168 in 2020, adjusted annually 
for inflation).
    Mandate that applies to private entities only: H.R. 5332 
would impose new requirements on CRAs, financial institutions, 
entities that furnish information to CRAs, and entities that 
use consumer reports to make personnel decisions.
    Under current law, CRAs must provide annual consumer 
reports, for free, upon request by a consumer. H.R. 5332 would 
require CRAs to include the consumer's credit score for free 
with the consumer report. Using industry data, CBO estimates 
that CRAs would provide free credit scores in about 20 million 
consumer reports each year, at an average cost of approximately 
$9.50 per score. Thus, CBO estimates that it would cost CRAs 
roughly $198 million annually to comply with this requirement.
    CRAs would be required to jointly develop an online portal 
to give consumers unlimited free access to various services 
including consumer reports, security freezes, and credit 
scores. According to industry sources, the cost to develop the 
portal would be roughly $50 million.
    H.R. 5332 would impose a number of other requirements on 
CRAs, which CBO estimates would impose small compliance costs. 
The bill would require CRAs to:
           Allow consumers to opt-out (free of charge) 
        of having their information sold,
           Ensure the accuracy of information in 
        consumer reports by matching social security numbers,
           Maintain a sufficient number of trained 
        personnel to conduct reinvestigations of information 
        under dispute by a consumer,
           Disclose new information to consumers 
        regarding dispute reinvestigations and requests for 
        their consumer report,
           Regularly audit information contained in 
        consumer reports,
           Communicate with other CRAs to ensure a 
        consumer's dispute is noted in their file at all 
        relevant CRAs,
           Notify consumers within 30 days (current law 
        requires notification within 60 days) of an adverse 
        action taken against a consumer as the result of 
        information contained in their consumer report, and
           Register with CFPB.
    The bill would require CFPB to establish rules and 
appropriate standards for CRAs to safeguard and protect 
customer records and information. However, because the CFPB has 
not yet established those rules, CBO cannot determine the costs 
to comply.
    The bill would require financial institutions that acquire 
a consumer's debt to provide notice to the consumer when 
supplying adverse information to a CRA. Because current law 
already requires a number of financial institutions to provide 
such notice, the cost to expand the requirement to a broader 
field of institutions would be small.
    H.R. 5332 would require entities that furnish information 
to CRAs to reinvestigate disputes from consumers if the 
claimant presents new or additional information. To qualify for 
a reinvestigation, the consumer must supply information deemed 
acceptable by CFPB. Because CBO cannot anticipate the type of 
information that CFPB would deem acceptable or the number of 
new reinvestigations that would be requested, we cannot 
determine the cost of the mandate.
    Mandate that applies both to public and private entities: 
The bill would require users of consumer reports to notify CRAs 
of any adverse actions taken against a consumer as a result of 
information contained in the report. That prohibition would 
impose an intergovernmental and private-sector mandate because 
individuals in both the public and private sector use consumer 
reports for background checks and personnel decisions. Current 
law already requires a number of the mandated entities to 
report information regarding an adverse action directly to 
consumers. Therefore, the incremental cost to notify CRAs would 
be small because the mandated entities already collect the 
information required to be disclosed under the bill.
    Estimate prepared by: Federal costs: David Hughes; 
Mandates: Rachel Austin.
    Estimate reviewed by: Kim Cawley, Chief, Natural and 
Physical Resources Cost Estimates Unit; Susan Willie, Chief, 
Public and Private Mandates Unit; H. Samuel Papenfuss, Deputy 
Director of Budget Analysis; Theresa Gullo, Director of Budget 
Analysis.

                        Committee Cost Estimate

    Clause 3(d)(1) of rule XIII of the Rules of the House of 
Representatives requires an estimate and a comparison of the 
costs that would be incurred in carrying out H.R. 5332. 
However, clause 3(d)(2)(B) of that rule provides that this 
requirement does not apply when the committee has included in 
its report a timely submitted cost estimate of the bill 
prepared by the Director of the Congressional Budget Office 
under section 402 of the Congressional Budget Act.

                       Unfunded Mandate Statement

    Pursuant to Section 423 of the Congressional Budget and 
Impoundment Control Act (as amended by Section 101(a)(2) of the 
Unfunded Mandates Reform Act, Pub. L. 104-4), the Committee 
adopts as its own the estimate of federal mandates regarding 
H.R. 5332, as amended, prepared by the Director of the 
Congressional Budget Office.

                           Advisory Committee

    No advisory committees within the meaning of section 5(b) 
of the Federal Advisory Committee Act were created by this 
legislation.

              Application of Law to the Legislative Branch

    H.R. 5332 does not apply to terms and conditions of 
employment or to access to public services or accommodations 
within the legislative branch.

                           Earmark Statement

    In accordance with clause 9 of rule XXI of the Rules of the 
House of Representatives, H.R. does not contain any 
congressional earmarks, limited tax benefits, or limited tariff 
benefits as described in clauses 9(e), 9(f), and 9(g) of rule 
XXI.

                    Duplication of Federal Programs

    Pursuant to clause 3(c)(5) of rule XIII of the Rules of the 
House of Representatives, the Committee states that no 
provision of H.R. 5332 establishes or reauthorizes a program of 
the Federal Government known to be duplicative of another 
federal program, a program that was included in any report from 
the Government Accountability Office to Congress pursuant to 
section 21 of Public Law 111-139, or a program related to a 
program identified in the most recent Catalog of Federal 
Domestic Assistance.

          Changes in Existing Law Made by the Bill as Reported

    In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, H.R. 5332, as reported, are shown as follows:

         Changes in Existing Law Made by the Bill, as Reported

  In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italics, and existing law in which no 
change is proposed is shown in roman):




TITLE VI--CONSUMER CREDIT REPORTING

           *       *       *       *       *       *       *


Sec. 604. Permissible purposes of reports

  (a) In General.--Subject to subsection (c), any consumer 
reporting agency may furnish a consumer report under the 
following circumstances and no other:
          (1) In response to the order of a court having 
        jurisdiction to issue such an order, or a subpoena 
        issued in connection with proceedings before a Federal 
        grand jury.
          (2) In accordance with the written instructions of 
        the consumer to whom it relates.
          (3) To a person which it has reason to believe--
                  (A) intends to use the information in 
                connection with a credit transaction involving 
                the consumer on whom the information is to be 
                furnished and involving the extension of credit 
                to, or review or collection of an account of, 
                the consumer; or
                  (B) intends to use the information for 
                employment purposes; or
                  (C) intends to use the information in 
                connection with the underwriting of insurance 
                involving the consumer; or
                  (D) intends to use the information in 
                connection with a determination of the 
                consumer's eligibility for a license or other 
                benefit granted by a governmental 
                instrumentality required by law to consider an 
                applicant's financial responsibility or status; 
                or
                  (E) intends to use the information, as a 
                potential investor or servicer, or current 
                insurer, in connection with a valuation of, or 
                an assessment of the credit or prepayment risks 
                associated with, an existing credit obligation; 
                or
                  (F) otherwise has a legitimate business need 
                for the information--
                          (i) in connection with a business 
                        transaction that is initiated by the 
                        consumer; or
                          (ii) to review an account to 
                        determine whether the consumer 
                        continues to meet the terms of the 
                        account.
                  (G) executive departments and agencies in 
                connection with the issuance of government-
                sponsored individually-billed travel charge 
                cards.
          (4) In response to a request by the head of a State 
        or local child support enforcement agency (or a State 
        or local government official authorized by the head of 
        such an agency), if the person making the request 
        certifies to the consumer reporting agency that--
                  (A) the consumer report is needed for the 
                purpose of establishing an individual's 
                capacity to make child support payments, 
                determining the appropriate level of such 
                payments, or enforcing a child support order, 
                award, agreement, or judgment;
                  (B) the parentage of the consumer for the 
                child to which the obligation relates has been 
                established or acknowledged by the consumer in 
                accordance with State laws under which the 
                obligation arises (if required by those laws); 
                and
                  (C) the consumer report will be kept 
                confidential, will be used solely for a purpose 
                described in subparagraph (A), and will not be 
                used in connection with any other civil, 
                administrative, or criminal proceeding, or for 
                any other purpose.
          (5) To an agency administering a State plan under 
        section 454 of the Social Security Act (42 U.S.C. 654) 
        for use to set an initial or modified child support 
        award.
          (6) To the Federal Deposit Insurance Corporation or 
        the National Credit Union Administration as part of its 
        preparation for its appointment or as part of its 
        exercise of powers, as conservator, receiver, or 
        liquidating agent for an insured depository institution 
        or insured credit union under the Federal Deposit 
        Insurance Act or the Federal Credit Union Act, or other 
        applicable Federal or State law, or in connection with 
        the resolution or liquidation of a failed or failing 
        insured depository institution or insured credit union, 
        as applicable.
  (b) Conditions for Furnishing and Using Consumer Reports for 
Employment Purposes.--
          (1) Certification from user.--A consumer reporting 
        agency may furnish a consumer report for employment 
        purposes only if--
                  (A) the person who obtains such report from 
                the agency certifies to the agency that--
                          (i) the person has complied with 
                        paragraph (2) with respect to the 
                        consumer report, and the person will 
                        comply with paragraph (3) with respect 
                        to the consumer report if paragraph (3) 
                        becomes applicable; and
                          (ii) information from the consumer 
                        report will not be used in violation of 
                        any applicable Federal or State equal 
                        employment opportunity law or 
                        regulation; and
                  (B) the consumer reporting agency provides 
                with the report, or has previously provided, a 
                summary of the consumer's rights under this 
                title, as prescribed by the Bureau under 
                section 609(c)(3).
          (2) Disclosure to consumer.--
                  (A) In general.--Except as provided in 
                subparagraph (B), a person may not procure a 
                consumer report, or cause a consumer report to 
                be procured, for employment purposes with 
                respect to any consumer, unless--
                          (i) a clear and conspicuous 
                        disclosure has been made in writing to 
                        the consumer at any time before the 
                        report is procured or caused to be 
                        procured, in a document that consists 
                        solely of the disclosure, that a 
                        consumer report may be obtained for 
                        employment purposes; and
                          (ii) the consumer has authorized in 
                        writing (which authorization may be 
                        made on the document referred to in 
                        clause (i)) the procurement of the 
                        report by that person.
                  (B) Application by mail, telephone, computer, 
                or other similar means.--If a consumer 
                described in subparagraph (C) applies for 
                employment by mail, telephone, computer, or 
                other similar means, at any time before a 
                consumer report is procured or caused to be 
                procured in connection with that application--
                          (i) the person who procures the 
                        consumer report on the consumer for 
                        employment purposes shall provide to 
                        the consumer, by oral, written, or 
                        electronic means, notice that a 
                        consumer report may be obtained for 
                        employment purposes, and a summary of 
                        the consumer's rights under [section 
                        615(a)(3)] section 615(a)(4); and
                          (ii) the consumer shall have 
                        consented, orally, in writing, or 
                        electronically to the procurement of 
                        the report by that person.
                  (C) Scope.--Subparagraph (B) shall apply to a 
                person procuring a consumer report on a 
                consumer in connection with the consumer's 
                application for employment only if--
                          (i) the consumer is applying for a 
                        position over which the Secretary of 
                        Transportation has the power to 
                        establish qualifications and maximum 
                        hours of service pursuant to the 
                        provisions of section 31502 of title 
                        49, or a position subject to safety 
                        regulation by a State transportation 
                        agency; and
                          (ii) as of the time at which the 
                        person procures the report or causes 
                        the report to be procured the only 
                        interaction between the consumer and 
                        the person in connection with that 
                        employment application has been by 
                        mail, telephone, computer, or other 
                        similar means.
          (3) Conditions on use for adverse actions.--
                  (A) In general.--Except as provided in 
                subparagraph (B), in using a consumer report 
                for employment purposes, before taking any 
                adverse action based in whole or in part on the 
                report, the person intending to take such 
                adverse action shall provide to the consumer to 
                whom the report relates--
                          (i) a copy of the report; and
                          (ii) a description in writing of the 
                        rights of the consumer under this 
                        title, as prescribed by the Bureau 
                        under section 609(c)(3).
                  (B) Application by mail, telephone, computer, 
                or other similar means.--
                          (i) If a consumer described in 
                        subparagraph (C) applies for employment 
                        by mail, telephone, computer, or other 
                        similar means, and if a person who has 
                        procured a consumer report on the 
                        consumer for employment purposes takes 
                        adverse action on the employment 
                        application based in whole or in part 
                        on the report, then the person must 
                        provide to the consumer to whom the 
                        report relates, in lieu of the notices 
                        required under subparagraph (A) of this 
                        section and under section 615(a), 
                        within 3 business days of taking such 
                        action, an oral, written or electronic 
                        notification--
                                  (I) that adverse action has 
                                been taken based in whole or in 
                                part on a consumer report 
                                received from a consumer 
                                reporting agency;
                                  (II) of the name, address and 
                                telephone number of the 
                                consumer reporting agency that 
                                furnished the consumer report 
                                (including a toll-free 
                                telephone number established by 
                                the agency if the agency 
                                compiles and maintains files on 
                                consumers on a nationwide 
                                basis);
                                  (III) that the consumer 
                                reporting agency did not make 
                                the decision to take the 
                                adverse action and is unable to 
                                provide to the consumer the 
                                specific reasons why the 
                                adverse action was taken; and
                                  (IV) that the consumer may, 
                                upon providing proper 
                                identification, request a free 
                                copy of a report and may 
                                dispute with the consumer 
                                reporting agency the accuracy 
                                or completeness of any 
                                information in a report.
                          (ii) If, under clause (B)(i)(IV), the 
                        consumer requests a copy of a consumer 
                        report from the person who procured the 
                        report, then, within 3 business days of 
                        receiving the consumer's request, 
                        together with proper identification, 
                        the person must send or provide to the 
                        consumer a copy of a report and a copy 
                        of the consumer's rights as prescribed 
                        by the Bureau under section 609(c)(3).
                  (C) Scope.--Subparagraph (B) shall apply to a 
                person procuring a consumer report on a 
                consumer in connection with the consumer's 
                application for employment only if--
                          (i) the consumer is applying for a 
                        position over which the Secretary of 
                        Transportation has the power to 
                        establish qualifications and maximum 
                        hours of service pursuant to the 
                        provisions of section 31502 of title 
                        49, or a position subject to safety 
                        regulation by a State transportation 
                        agency; and
                          (ii) as of the time at which the 
                        person procures the report or causes 
                        the report to be procured the only 
                        interaction between the consumer and 
                        the person in connection with that 
                        employment application has been by 
                        mail, telephone, computer, or other 
                        similar means.
          (4) Exception for national security investigations.--
                  (A) In general.--In the case of an agency or 
                department of the United States Government 
                which seeks to obtain and use a consumer report 
                for employment purposes, paragraph (3) shall 
                not apply to any adverse action by such agency 
                or department which is based in part on such 
                consumer report, if the head of such agency or 
                department makes a written finding that--
                          (i) the consumer report is relevant 
                        to a national security investigation of 
                        such agency or department;
                          (ii) the investigation is within the 
                        jurisdiction of such agency or 
                        department;
                          (iii) there is reason to believe that 
                        compliance with paragraph (3) will--
                                  (I) endanger the life or 
                                physical safety of any person;
                                  (II) result in flight from 
                                prosecution;
                                  (III) result in the 
                                destruction of, or tampering 
                                with, evidence relevant to the 
                                investigation;
                                  (IV) result in the 
                                intimidation of a potential 
                                witness relevant to the 
                                investigation;
                                  (V) result in the compromise 
                                of classified information; or
                                  (VI) otherwise seriously 
                                jeopardize or unduly delay the 
                                investigation or another 
                                official proceeding.
                  (B) Notification of consumer upon conclusion 
                of investigation.--Upon the conclusion of a 
                national security investigation described in 
                subparagraph (A), or upon the determination 
                that the exception under subparagraph (A) is no 
                longer required for the reasons set forth in 
                such subparagraph, the official exercising the 
                authority in such subparagraph shall provide to 
                the consumer who is the subject of the consumer 
                report with regard to which such finding was 
                made--
                          (i) a copy of such consumer report 
                        with any classified information 
                        redacted as necessary;
                          (ii) notice of any adverse action 
                        which is based, in part, on the 
                        consumer report; and
                          (iii) the identification with 
                        reasonable specificity of the nature of 
                        the investigation for which the 
                        consumer report was sought.
                  (C) Delegation by head of agency or 
                department.--For purposes of subparagraphs (A) 
                and (B), the head of any agency or department 
                of the United States Government may delegate 
                his or her authorities under this paragraph to 
                an official of such agency or department who 
                has personnel security responsibilities and is 
                a member of the Senior Executive Service or 
                equivalent civilian or military rank.
                  (D) Definitions.--For purposes of this 
                paragraph, the following definitions shall 
                apply:
                          (i) Classified information.--The term 
                        ``classified information'' means 
                        information that is protected from 
                        unauthorized disclosure under Executive 
                        Order No. 12958 or successor orders.
                          (ii) National security 
                        investigation.--The term ``national 
                        security investigation'' means any 
                        official inquiry by an agency or 
                        department of the United States 
                        Government to determine the eligibility 
                        of a consumer to receive access or 
                        continued access to classified 
                        information or to determine whether 
                        classified information has been lost or 
                        compromised.
  (c) Furnishing Reports in Connection With Credit or Insurance 
Transactions That Are Not Initiated by the Consumer.--
          (1) In general.--A consumer reporting agency may 
        furnish a consumer report relating to any consumer 
        pursuant to subparagraph (A) or (C) of subsection 
        (a)(3) in connection with any credit or insurance 
        transaction that is not initiated by the consumer only 
        if--
                  (A) the consumer authorizes the agency to 
                provide such report to such person; or
                  (B)(i) the transaction consists of a firm 
                offer of credit or insurance;
                  (ii) the consumer reporting agency has 
                complied with subsection (e);
                  (iii) there is not in effect an election by 
                the consumer, made in accordance with 
                subsection (e), to have the consumer's name and 
                address excluded from lists of names provided 
                by the agency pursuant to this paragraph; and
                  (iv) the consumer report does not contain a 
                date of birth that shows that the consumer has 
                not attained the age of 21, or, if the date of 
                birth on the consumer report shows that the 
                consumer has not attained the age of 21, such 
                consumer consents to the consumer reporting 
                agency to such furnishing.
          (2) Limits on information received under paragraph 
        (1)(b).--A person may receive pursuant to paragraph 
        (1)(B) only--
                  (A) the name and address of a consumer;
                  (B) an identifier that is not unique to the 
                consumer and that is used by the person solely 
                for the purpose of verifying the identity of 
                the consumer; and
                  (C) other information pertaining to a 
                consumer that does not identify the 
                relationship or experience of the consumer with 
                respect to a particular creditor or other 
                entity.
          (3) Information regarding inquiries.--Except as 
        provided in section 609(a)(5), a consumer reporting 
        agency shall not furnish to any person a record of 
        inquiries in connection with a credit or insurance 
        transaction that is not initiated by a consumer.
  (d) Reserved.--
  (e) Election of Consumer To Be Excluded From Lists.--
          (1) In general.--A consumer may elect to have the 
        consumer's name and address excluded from any list 
        provided by a consumer reporting agency under 
        subsection (c)(1)(B) in connection with a credit or 
        insurance transaction that is not initiated by the 
        consumer by notifying the agency in accordance with 
        paragraph (2) that the consumer does not consent to any 
        use of a consumer report relating to the consumer in 
        connection with any credit or insurance transaction 
        that is not initiated by the consumer.
          (2) Manner of notification.--A consumer shall notify 
        a consumer reporting agency under paragraph (1)--
                  (A) through the notification system 
                maintained by the agency under paragraph (5); 
                or
                  (B) by submitting to the agency a signed 
                notice of election form issued by the agency 
                for purposes of this subparagraph.
          (3) Response of agency after notification through 
        system.--Upon receipt of notification of the election 
        of a consumer under paragraph (1) through the 
        notification system maintained by the agency under 
        paragraph (5), a consumer reporting agency shall--
                  (A) inform the consumer that the election is 
                effective only for the 5-year period following 
                the election if the consumer does not submit to 
                the agency a signed notice of election form 
                issued by the agency for purposes of paragraph 
                (2)(B); and
                  (B) provide to the consumer a notice of 
                election form, if requested by the consumer, 
                not later than 5 business days after receipt of 
                the notification of the election through the 
                system established under paragraph (5), in the 
                case of a request made at the time the consumer 
                provides notification through the system.
          (4) Effectiveness of election.--An election of a 
        consumer under paragraph (1)--
                  (A) shall be effective with respect to a 
                consumer reporting agency beginning 5 business 
                days after the date on which the consumer 
                notifies the agency in accordance with 
                paragraph (2);
                  (B) shall be effective with respect to a 
                consumer reporting agency--
                          (i) subject to subparagraph (C), 
                        during the 5-year period beginning 5 
                        business days after the date on which 
                        the consumer notifies the agency of the 
                        election, in the case of an election 
                        for which a consumer notifies the 
                        agency only in accordance with 
                        paragraph (2)(A); or
                          (ii) until the consumer notifies the 
                        agency under subparagraph (C), in the 
                        case of an election for which a 
                        consumer notifies the agency in 
                        accordance with paragraph (2)(B);
                  (C) shall not be effective after the date on 
                which the consumer notifies the agency, through 
                the notification system established by the 
                agency under paragraph (5), that the election 
                is no longer effective; and
                  (D) shall be effective with respect to each 
                affiliate of the agency.
          (5) Notification system.--
                  (A) In general.--Each consumer reporting 
                agency that, under subsection (c)(1)(B), 
                furnishes a consumer report in connection with 
                a credit or insurance transaction that is not 
                initiated by a consumer shall--
                          (i) establish and maintain a 
                        notification system, including a toll-
                        free telephone number, which permits 
                        any consumer whose consumer report is 
                        maintained by the agency to notify the 
                        agency, with appropriate 
                        identification, of the consumer's 
                        election to have the consumer's name 
                        and address excluded from any such list 
                        of names and addresses provided by the 
                        agency for such a transaction; and
                          (ii) publish by not later than 365 
                        days after the date of enactment of the 
                        Consumer Credit Reporting Reform Act of 
                        1996, and not less than annually 
                        thereafter, in a publication of general 
                        circulation in the area served by the 
                        agency--
                                  (I) a notification that 
                                information in consumer files 
                                maintained by the agency may be 
                                used in connection with such 
                                transactions; and
                                  (II) the address and toll-
                                free telephone number for 
                                consumers to use to notify the 
                                agency of the consumer's 
                                election under clause (i).
                  (B) Establishment and maintenance as 
                compliance.--Establishment and maintenance of a 
                notification system (including a toll-free 
                telephone number) and publication by a consumer 
                reporting agency on the agency's own behalf and 
                on behalf of any of its affiliates in 
                accordance with this paragraph is deemed to be 
                compliance with this paragraph by each of those 
                affiliates.
          (6) Notification system by agencies that operate 
        nationwide.--Each consumer reporting agency that 
        compiles and maintains files on consumers on a 
        nationwide basis shall establish and maintain a 
        notification system for purposes of paragraph (5) 
        jointly with other such consumer reporting agencies.
  (f) Certain Use or Obtaining of Information Prohibited.--A 
person shall not use or obtain a consumer report for any 
purpose unless--
          (1) the consumer report is obtained for a purpose for 
        which the consumer report is authorized to be furnished 
        under this section; and
          (2) the purpose is certified in accordance with 
        section 607 by a prospective user of the report through 
        a general or specific certification.
  (g) Protection of Medical Information.--
          (1) Limitation on consumer reporting agencies.--A 
        consumer reporting agency shall not furnish for 
        employment purposes, or in connection with a credit or 
        insurance transaction, a consumer report that contains 
        medical information (other than medical contact 
        information treated in the manner required under 
        section 605(a)(6)) about a consumer, unless--
                  (A) if furnished in connection with an 
                insurance transaction, the consumer 
                affirmatively consents to the furnishing of the 
                report;
                  (B) if furnished for employment purposes or 
                in connection with a credit transaction--
                          (i) the information to be furnished 
                        is relevant to process or effect the 
                        employment or credit transaction; and
                          (ii) the consumer provides specific 
                        written consent for the furnishing of 
                        the report that describes in clear and 
                        conspicuous language the use for which 
                        the information will be furnished; or
                  (C) the information to be furnished pertains 
                solely to transactions, accounts, or balances 
                relating to debts arising from the receipt of 
                medical services, products, or devises, where 
                such information, other than account status or 
                amounts, is restricted or reported using codes 
                that do not identify, or do not provide 
                information sufficient to infer, the specific 
                provider or the nature of such services, 
                products, or devices, as provided in section 
                605(a)(6).
          (2) Limitation on creditors.--Except as permitted 
        pursuant to paragraph (3)(C) or regulations prescribed 
        under paragraph (5)(A), a creditor shall not obtain or 
        use medical information (other than medical information 
        treated in the manner required under section 605(a)(6)) 
        pertaining to a consumer in connection with any 
        determination of the consumer's eligibility, or 
        continued eligibility, for credit.
          (3) Actions authorized by federal law, insurance 
        activities and regulatory determinations.--Section 
        603(d)(3) shall not be construed so as to treat 
        information or any communication of information as a 
        consumer report if the information or communication is 
        disclosed--
                  (A) in connection with the business of 
                insurance or annuities, including the 
                activities described in section 18B of the 
                model Privacy of Consumer Financial and Health 
                Information Regulation issued by the National 
                Association of Insurance Commissioners (as in 
                effect on January 1, 2003);
                  (B) for any purpose permitted without 
                authorization under the Standards for 
                Individually Identifiable Health Information 
                promulgated by the Department of Health and 
                Human Services pursuant to the Health Insurance 
                Portability and Accountability Act of 1996, or 
                referred to under section 1179 of such Act, or 
                described in section 502(e) of Public Law 106 
                102; or
                  (C) as otherwise determined to be necessary 
                and appropriate, by regulation or order, by the 
                Bureau or the applicable State insurance 
                authority (with respect to any person engaged 
                in providing insurance or annuities).
          (4) Limitation on redisclosure of medical 
        information.--Any person that receives medical 
        information pursuant to paragraph (1) or (3) shall not 
        disclose such information to any other person, except 
        as necessary to carry out the purpose for which the 
        information was initially disclosed, or as otherwise 
        permitted by statute, regulation, or order.
          (5) Regulations and effective date for paragraph 
        (2).--
                  (A) Regulations required.--The Bureau may, 
                after notice and opportunity for comment, 
                prescribe regulations that permit transactions 
                under paragraph (2) that are determined to be 
                necessary and appropriate to protect legitimate 
                operational, transactional, risk, consumer, and 
                other needs (and which shall include permitting 
                actions necessary for administrative 
                verification purposes), consistent with the 
                intent of paragraph (2) to restrict the use of 
                medical information for inappropriate purposes.
          (6) Coordination with other laws.--No provision of 
        this subsection shall be construed as altering, 
        affecting, or superseding the applicability of any 
        other provision of Federal law relating to medical 
        confidentiality.

           *       *       *       *       *       *       *


Sec. 607. Compliance procedures

  (a) Every consumer reporting agency shall maintain reasonable 
procedures designed to avoid violations of section 605 and to 
limit the furnishing of consumer reports to the purposes listed 
under section 604. These procedures shall require that 
prospective users of the information identify themselves, 
certify the purposes for which the information is sought, and 
certify that the information will be used for no other purpose. 
Every consumer reporting agency shall make a reasonable effort 
to verify the identity of a new prospective user and the uses 
certified by such prospective user prior to furnishing such 
user a consumer report. No consumer reporting agency may 
furnish a consumer report to any person if it has reasonable 
grounds for believing that the consumer report will not be used 
for a purpose listed in section 604.
  [(b) Whenever a consumer reporting agency prepares a consumer 
report it shall follow reasonable procedures to assure maximum 
possible accuracy of the information concerning the individual 
about whom the report relates.]
  (b) Ensuring Accuracy.--
          (1) In general.--In preparing a consumer report, each 
        consumer reporting agency shall follow reasonable 
        procedures to assure maximum possible accuracy of the 
        information concerning the consumer to whom the report 
        relates.
          (2) Matching information in a file.--In assuring the 
        maximum possible accuracy under paragraph (1), each 
        consumer reporting agency described in section 603(p) 
        shall ensure that, when including information in the 
        file of a consumer, the consumer reporting agency--
                  (A) matches all 9 digits of the social 
                security number of the consumer with the 
                information that the consumer reporting agency 
                is including in the file; or
                  (B) if a consumer does not have a social 
                security number, matches information that 
                includes the full legal name, date of birth, 
                current address, and at least one former 
                address of the consumer.
          (3) Periodic audits.--Each consumer reporting agency 
        shall perform periodic audits, on a schedule determined 
        by the Bureau, on a representative sample of consumer 
        reports of the agency to check for accuracy.
  (c) Disclosure of Consumer Reports by Users Allowed.--A 
consumer reporting agency may not prohibit a user of a consumer 
report furnished by the agency on a consumer from disclosing 
the contents of the report to the consumer, if adverse action 
against the consumer has been taken by the user based in whole 
or in part on the report.
  (d) Notice to Users and Furnishers of Information.--
          (1) Notice requirement.--A consumer reporting agency 
        shall provide to any person--
                  (A) who regularly and in the ordinary course 
                of business furnishes information to the agency 
                with respect to any consumer; or
                  (B) to whom a consumer report is provided by 
                the agency;
        a notice of such person's responsibilities under this 
        title.
          (2) Content of notice.--The Bureau shall prescribe 
        the content of notices under paragraph (1), and a 
        consumer reporting agency shall be in compliance with 
        this subsection if it provides a notice under paragraph 
        (1) that is substantially similar to the Bureau 
        prescription under this paragraph.
  (e) Procurement of Consumer Report for Resale.--
          (1) Disclosure.--A person may not procure a consumer 
        report for purposes of reselling the report (or any 
        information in the report) unless the person discloses 
        to the consumer reporting agency that originally 
        furnishes the report--
                  (A) the identity of the end-user of the 
                report (or information); and
                  (B) each permissible purpose under section 
                604 for which the report is furnished to the 
                end-user of the report (or information).
          (2) Responsibilities of procurers for resale.--A 
        person who procures a consumer report for purposes of 
        reselling the report (or any information in the report) 
        shall--
                  (A) establish and comply with reasonable 
                procedures designed to ensure that the report 
                (or information) is resold by the person only 
                for a purpose for which the report may be 
                furnished under section 604, including by 
                requiring that each person to which the report 
                (or information) is resold and that resells or 
                provides the report (or information) to any 
                other person--
                          (i) identifies each end user of the 
                        resold report (or information);
                          (ii) certifies each purpose for which 
                        the report (or information) will be 
                        used; and
                          (iii) certifies that the report (or 
                        information) will be used for no other 
                        purpose; and
                  (B) before reselling the report, make 
                reasonable efforts to verify the 
                identifications and certifications made under 
                subparagraph (A).
          (3) Resale of consumer report to a federal agency or 
        department.--Notwithstanding paragraph (1) or (2), a 
        person who procures a consumer report for purposes of 
        reselling the report (or any information in the report) 
        shall not disclose the identity of the end-user of the 
        report under paragraph (1) or (2) if--
                  (A) the end user is an agency or department 
                of the United States Government which procures 
                the report from the person for purposes of 
                determining the eligibility of the consumer 
                concerned to receive access or continued access 
                to classified information (as defined in 
                section 604(b)(4)(E)(i)); and
                  (B) the agency or department certifies in 
                writing to the person reselling the report that 
                nondisclosure is necessary to protect 
                classified information or the safety of persons 
                employed by or contracting with, or undergoing 
                investigation for work or contracting with the 
                agency or department.

           *       *       *       *       *       *       *


Sec. 609. Disclosures to consumers

  (a) Every consumer reporting agency shall, upon request, and 
subject to section 610(a)(1), clearly and accurately disclose 
to the consumer:
          (1) All information in the consumer's file at the 
        time of the request, except that--
                  (A) if the consumer to whom the file relates 
                requests that the first 5 digits of the social 
                security number (or similar identification 
                number) of the consumer not be included in the 
                disclosure and the consumer reporting agency 
                has received appropriate proof of the identity 
                of the requester, the consumer reporting agency 
                shall so truncate such number in such 
                disclosure; and
                  (B) nothing in this paragraph shall be 
                construed to require a consumer reporting 
                agency to disclose to a consumer any 
                information concerning credit scores or any 
                other risk scores or predictors relating to the 
                consumer.
          (2) The sources of the information; except that the 
        sources of information acquired solely for use in 
        preparing an investigative consumer report and actually 
        used for no other purpose need not be disclosed: 
        Provided, That in the event an action is brought under 
        this title, such sources shall be available to the 
        plaintiff under appropriate discovery procedures in the 
        court in which the action is brought.
          (3)(A) Identification of each person (including each 
        end-user identified under section 607(e)(1)) that 
        procured a consumer report--
                  (i) for employment purposes, during the 2-
                year period preceding the date on which the 
                request is made; or
                  (ii) for any other purpose, during the 1-year 
                period preceding the date on which the request 
                is made.
          (B) An identification of a person under subparagraph 
        (A) shall include--
                  (i) the name of the person or, if applicable, 
                the trade name (written in full) under which 
                such person conducts business; [and]
                  [(ii) upon request of the consumer, the 
                address and telephone number of the person.]
                  (ii) the address and telephone number of the 
                person; and
                  (iii) the permissible purpose, as available, 
                of the person for obtaining the consumer 
                report, including the specific type of credit 
                product that is extended, reviewed, or 
                collected, as described in section 
                604(a)(3)(A).
          (C) Subparagraph (A) does not apply if--
                  (i) the end user is an agency or department 
                of the United States Government that procures 
                the report from the person for purposes of 
                determining the eligibility of the consumer to 
                whom the report relates to receive access or 
                continued access to classified information (as 
                defined in section 604(b)(4)(E)(i)); and
                  (ii) the head of the agency or department 
                makes a written finding as prescribed under 
                section 604(b)(4)(A).
          (4) The dates, original payees, and amounts of any 
        checks upon which is based any adverse characterization 
        of the consumer, included in the file at the time of 
        the disclosure.
          (5) A record of all inquiries received by the agency 
        during the 1-year period preceding the request that 
        identified the consumer in connection with a credit or 
        insurance transaction that was not initiated by the 
        consumer.
          (6) If the consumer requests the credit file and not 
        the credit score, a statement that the consumer may 
        request and obtain a credit score.
  (b) The requirements of subsection (a) respecting the 
disclosure of sources of information and the recipients of 
consumer reports do not apply to information received or 
consumer reports furnished prior to the effective date of this 
title except to the extent that the matter involved is 
contained in the files of the consumer reporting agency on that 
date.
  (c) Summary of Rights To Obtain and Dispute Information in 
Consumer Reports and To Obtain Credit Scores.--
          (1) Commission summary of rights required.--
                  (A) In general.--The Commission shall prepare 
                a model summary of the rights of consumers 
                under this title.
                  (B) Content of summary.--The summary of 
                rights prepared under subparagraph (A) shall 
                include a description of--
                          (i) the right of a consumer to obtain 
                        a copy of a consumer report under 
                        subsection (a) from each consumer 
                        reporting agency;
                          (ii) the frequency and circumstances 
                        under which a consumer is entitled to 
                        receive a consumer report without 
                        charge under section 612;
                          (iii) the right of a consumer to 
                        dispute information in the file of the 
                        consumer under section 611;
                          (iv) the right of a consumer to 
                        obtain a credit score from a consumer 
                        reporting agency, and a description of 
                        how to obtain a credit score;
                          (v) the method by which a consumer 
                        can contact, and obtain a consumer 
                        report from, a consumer reporting 
                        agency without charge, as provided in 
                        the regulations of the Bureau 
                        prescribed under section 211(c) of the 
                        Fair and Accurate Credit Transactions 
                        Act of 2003; and
                          (vi) the method by which a consumer 
                        can contact, and obtain a consumer 
                        report from, a consumer reporting 
                        agency described in section 603(w), as 
                        provided in the regulations of the 
                        Bureau prescribed under section 
                        612(a)(1)(C).
                  (C) Availability of summary of rights.--The 
                Commission shall--
                          (i) actively publicize the 
                        availability of the summary of rights 
                        prepared under this paragraph;
                          (ii) conspicuously post on its 
                        Internet website the availability of 
                        such summary of rights; and
                          (iii) promptly make such summary of 
                        rights available to consumers, on 
                        request.
          (2) Summary of rights required to be included with 
        agency disclosures.--A consumer reporting agency shall 
        provide to a consumer, with each written disclosure by 
        the agency to the consumer under this section--
                  (A) the summary of rights prepared by the 
                Bureau under paragraph (1);
                  (B) in the case of a consumer reporting 
                agency described in section 603(p), a toll-free 
                telephone number established by the agency, at 
                which personnel are accessible to consumers 
                during normal business hours;
                  (C) a list of all Federal agencies 
                responsible for enforcing any provision of this 
                title, and the address and any appropriate 
                phone number of each such agency, in a form 
                that will assist the consumer in selecting the 
                appropriate agency;
                  (D) a statement that the consumer may have 
                additional rights under State law, and that the 
                consumer may wish to contact a State or local 
                consumer protection agency or a State attorney 
                general (or the equivalent thereof) to learn of 
                those rights; and
                  (E) a statement that a consumer reporting 
                agency is not required to remove accurate 
                derogatory information from the file of a 
                consumer, unless the information is outdated 
                under section 605 or cannot be verified.
  (d) Summary of Rights of Identity Theft Victims.--
          (1) In general.--The Commission, in consultation with 
        the Federal banking agencies and the National Credit 
        Union Administration, shall prepare a model summary of 
        the rights of consumers under this title with respect 
        to the procedures for remedying the effects of fraud or 
        identity theft involving credit, an electronic fund 
        transfer, or an account or transaction at or with a 
        financial institution or other creditor.
          (2) Summary of rights and contact information.--
        Beginning 60 days after the date on which the model 
        summary of rights is prescribed in final form by the 
        Bureau pursuant to paragraph (1), if any consumer 
        contacts a consumer reporting agency and expresses a 
        belief that the consumer is a victim of fraud or 
        identity theft involving credit, an electronic fund 
        transfer, or an account or transaction at or with a 
        financial institution or other creditor, the consumer 
        reporting agency shall, in addition to any other action 
        that the agency may take, provide the consumer with a 
        summary of rights that contains all of the information 
        required by the Bureau under paragraph (1), and 
        information on how to contact the Bureau to obtain more 
        detailed information.
  (e) Information Available to Victims.--
          (1) In general.--For the purpose of documenting 
        fraudulent transactions resulting from identity theft, 
        not later than 30 days after the date of receipt of a 
        request from a victim in accordance with paragraph (3), 
        and subject to verification of the identity of the 
        victim and the claim of identity theft in accordance 
        with paragraph (2), a business entity that has provided 
        credit to, provided for consideration products, goods, 
        or services to, accepted payment from, or otherwise 
        entered into a commercial transaction for consideration 
        with, a person who has allegedly made unauthorized use 
        of the means of identification of the victim, shall 
        provide a copy of application and business transaction 
        records in the control of the business entity, whether 
        maintained by the business entity or by another person 
        on behalf of the business entity, evidencing any 
        transaction alleged to be a result of identity theft 
        to--
                  (A) the victim;
                  (B) any Federal, State, or local government 
                law enforcement agency or officer specified by 
                the victim in such a request; or
                  (C) any law enforcement agency investigating 
                the identity theft and authorized by the victim 
                to take receipt of records provided under this 
                subsection.
          (2) Verification of identity and claim.--Before a 
        business entity provides any information under 
        paragraph (1), unless the business entity, at its 
        discretion, otherwise has a high degree of confidence 
        that it knows the identity of the victim making a 
        request under paragraph (1), the victim shall provide 
        to the business entity--
                  (A) as proof of positive identification of 
                the victim, at the election of the business 
                entity--
                          (i) the presentation of a government-
                        issued identification card;
                          (ii) personally identifying 
                        information of the same type as was 
                        provided to the business entity by the 
                        unauthorized person; or
                          (iii) personally identifying 
                        information that the business entity 
                        typically requests from new applicants 
                        or for new transactions, at the time of 
                        the victim's request for information, 
                        including any documentation described 
                        in clauses (i) and (ii); and
                  (B) as proof of a claim of identity theft, at 
                the election of the business entity--
                          (i) a copy of a police report 
                        evidencing the claim of the victim of 
                        identity theft; and
                          (ii) a properly completed--
                                  (I) copy of a standardized 
                                affidavit of identity theft 
                                developed and made available by 
                                the Bureau; or
                                  (II) an affidavit of fact 
                                that is acceptable to the 
                                business entity for that 
                                purpose.
          (3) Procedures.--The request of a victim under 
        paragraph (1) shall--
                  (A) be in writing;
                  (B) be mailed to an address specified by the 
                business entity, if any; and
                  (C) if asked by the business entity, include 
                relevant information about any transaction 
                alleged to be a result of identity theft to 
                facilitate compliance with this section 
                including--
                          (i) if known by the victim (or if 
                        readily obtainable by the victim), the 
                        date of the application or transaction; 
                        and
                          (ii) if known by the victim (or if 
                        readily obtainable by the victim), any 
                        other identifying information such as 
                        an account or transaction number.
          (4) No charge to victim.--Information required to be 
        provided under paragraph (1) shall be so provided 
        without charge.
          (5) Authority to decline to provide information.--A 
        business entity may decline to provide information 
        under paragraph (1) if, in the exercise of good faith, 
        the business entity determines that--
                  (A) this subsection does not require 
                disclosure of the information;
                  (B) after reviewing the information provided 
                pursuant to paragraph (2), the business entity 
                does not have a high degree of confidence in 
                knowing the true identity of the individual 
                requesting the information;
                  (C) the request for the information is based 
                on a misrepresentation of fact by the 
                individual requesting the information relevant 
                to the request for information; or
                  (D) the information requested is Internet 
                navigational data or similar information about 
                a person's visit to a website or online 
                service.
          (6) Limitation on liability.--Except as provided in 
        section 621, sections 616 and 617 do not apply to any 
        violation of this subsection.
          (7) Limitation on civil liability.--No business 
        entity may be held civilly liable under any provision 
        of Federal, State, or other law for disclosure, made in 
        good faith pursuant to this subsection.
          (8) No new recordkeeping obligation.--Nothing in this 
        subsection creates an obligation on the part of a 
        business entity to obtain, retain, or maintain 
        information or records that are not otherwise required 
        to be obtained, retained, or maintained in the ordinary 
        course of its business or under other applicable law.
          (9) Rule of construction.--
                  (A) In general.--No provision of subtitle A 
                of title V of Public Law 106 102, prohibiting 
                the disclosure of financial information by a 
                business entity to third parties shall be used 
                to deny disclosure of information to the victim 
                under this subsection.
                  (B) Limitation.--Except as provided in 
                subparagraph (A), nothing in this subsection 
                permits a business entity to disclose 
                information, including information to law 
                enforcement under subparagraphs (B) and (C) of 
                paragraph (1), that the business entity is 
                otherwise prohibited from disclosing under any 
                other applicable provision of Federal or State 
                law.
          (10) Affirmative defense.--In any civil action 
        brought to enforce this subsection, it is an 
        affirmative defense (which the defendant must establish 
        by a preponderance of the evidence) for a business 
        entity to file an affidavit or answer stating that--
                  (A) the business entity has made a reasonably 
                diligent search of its available business 
                records; and
                  (B) the records requested under this 
                subsection do not exist or are not reasonably 
                available.
          (11) Definition of victim.--For purposes of this 
        subsection, the term ``victim'' means a consumer whose 
        means of identification or financial information has 
        been used or transferred (or has been alleged to have 
        been used or transferred) without the authority of that 
        consumer, with the intent to commit, or to aid or abet, 
        an identity theft or a similar crime.
          (12) Effective date.--This subsection shall become 
        effective 180 days after the date of enactment of this 
        subsection.
          (13) Effectiveness study.--Not later than 18 months 
        after the date of enactment of this subsection, the 
        Comptroller General of the United States shall submit a 
        report to Congress assessing the effectiveness of this 
        provision.
  (f) Disclosure of Credit Scores.--
          (1) In general.--Upon the request of a consumer for a 
        credit score, a consumer reporting agency shall supply 
        to the consumer a statement indicating that the 
        information and credit scoring model may be different 
        than the credit score that may be used by the lender, 
        and a notice which shall include--
                  (A) the current credit score of the consumer 
                or the most recent credit score of the consumer 
                that was previously calculated by the credit 
                reporting agency for a purpose related to the 
                extension of credit;
                  (B) the range of possible credit scores under 
                the model used;
                  (C) all of the key factors that adversely 
                affected the credit score of the consumer in 
                the model used, the total number of which shall 
                not exceed 4, subject to paragraph (9);
                  (D) the date on which the credit score was 
                created; and
                  (E) the name of the person or entity that 
                provided the credit score or credit file upon 
                which the credit score was created.
          (2) Definitions.--For purposes of this subsection, 
        the following definitions shall apply:
                  (A) Credit score.--The term ``credit 
                score''--
                          (i) means a numerical value or a 
                        categorization derived from a 
                        statistical tool or modeling system 
                        used by a person who makes or arranges 
                        a loan to predict the likelihood of 
                        certain credit behaviors, including 
                        default (and the numerical value or the 
                        categorization derived from such 
                        analysis may also be referred to as a 
                        ``risk predictor'' or ``risk score''); 
                        and
                          (ii) does not include--
                                  (I) any mortgage score or 
                                rating of an automated 
                                underwriting system that 
                                considers one or more factors 
                                in addition to credit 
                                information, including the loan 
                                to value ratio, the amount of 
                                down payment, or the financial 
                                assets of a consumer; or
                                  (II) any other elements of 
                                the underwriting process or 
                                underwriting decision.
                  (B) Key factors.--The term ``key factors''' 
                means all relevant elements or reasons 
                adversely affecting the credit score for the 
                particular individual, listed in the order of 
                their importance based on their effect on the 
                credit score.
          (3) Timeframe and manner of disclosure.--The 
        information required by this subsection shall be 
        provided in the same timeframe and manner as the 
        information described in subsection (a).
          (4) Applicability to certain uses.--This subsection 
        shall not be construed so as to compel a consumer 
        reporting agency to develop or disclose a score if the 
        agency does not--
                  (A) distribute scores that are used in 
                connection with residential real property 
                loans; or
                  (B) develop scores that assist credit 
                providers in understanding the general credit 
                behavior of a consumer and predicting the 
                future credit behavior of the consumer.
          (5) Applicability to credit scores developed by 
        another person.--
                  (A) In general.--This subsection shall not be 
                construed to require a consumer reporting 
                agency that distributes credit scores developed 
                by another person or entity to provide a 
                further explanation of them, or to process a 
                dispute arising pursuant to section 611, except 
                that the consumer reporting agency shall 
                provide the consumer with the name and address 
                and website for contacting the person or entity 
                who developed the score or developed the 
                methodology of the score.
                  (B) Exception.--This paragraph shall not 
                apply to a consumer reporting agency that 
                develops or modifies scores that are developed 
                by another person or entity.
          (6) Maintenance of credit scores not required.--This 
        subsection shall not be construed to require a consumer 
        reporting agency to maintain credit scores in its 
        files.
          (7) Compliance in certain cases.--In complying with 
        this subsection, a consumer reporting agency shall--
                  [(A) supply the consumer with a credit score 
                that is derived from a credit scoring model 
                that is widely distributed to users by that 
                consumer reporting agency in connection with 
                residential real property loans or with a 
                credit score that assists the consumer in 
                understanding the credit scoring assessment of 
                the credit behavior of the consumer and 
                predictions about the future credit behavior of 
                the consumer; and]
                  (A) supply the consumer with a credit score 
                through the portal established under section 
                612(a)(1)(D) or upon request by the consumer, 
                as applicable, that--
                          (i) is derived from a credit scoring 
                        model that is widely distributed to 
                        users by that consumer reporting agency 
                        for the purpose of any extension of 
                        credit or other transaction designated 
                        by the consumer who is requesting the 
                        credit score; or
                          (ii) is widely distributed to lenders 
                        of common consumer loan products and 
                        predicts the future credit behavior of 
                        the consumer; and
                  (B) a statement indicating that the 
                information and credit scoring model may be 
                different than that used by the lender.
          (8) Fair and reasonable fee.--A consumer reporting 
        agency may charge a fair and reasonable fee, as 
        determined by the Bureau, for providing the information 
        required under this subsection, except that a credit 
        score shall be provided free of charge to the consumer 
        if requested in connection with a free annual consumer 
        report described in section 612(a) or through the 
        online consumer portal landing page established under 
        section 612(a)(1)(D)
          (9) Use of enquiries as a key factor.--If a key 
        factor that adversely affects the credit score of a 
        consumer consists of the number of enquiries made with 
        respect to a consumer report, that factor shall be 
        included in the disclosure pursuant to paragraph (1)(C) 
        without regard to the numerical limitation in such 
        paragraph.
  (g) Disclosure of Credit Scores by Certain Mortgage 
Lenders.--
          (1) In general.--Any person who makes or arranges 
        loans and who uses a consumer credit score, as defined 
        in subsection (f), in connection with an application 
        initiated or sought by a consumer for a closed end loan 
        or the establishment of an open end loan for a consumer 
        purpose that is secured by 1 to 4 units of residential 
        real property (hereafter in this subsection referred to 
        as the ``lender'') shall provide the following to the 
        consumer as soon as reasonably practicable:
                  (A) Information required under subsection 
                (f).--
                          (i) In general.--A copy of the 
                        information identified in subsection 
                        (f) that was obtained from a consumer 
                        reporting agency or was developed and 
                        used by the user of the information.
                          (ii) Notice under [subparagraph (d)] 
                        subparagraph (c).--In addition to the 
                        information provided to it by a third 
                        party that provided the credit score or 
                        scores, a lender is only required to 
                        provide the notice contained in 
                        [subparagraph (D)] subparagraph (C)
                  (B) Disclosures in case of automated 
                underwriting system.--
                          (i) In general.--If a person that is 
                        subject to this subsection uses an 
                        automated underwriting system to 
                        underwrite a loan, that person may 
                        satisfy the obligation to provide a 
                        credit score by disclosing a credit 
                        score and associated key factors 
                        supplied by a consumer reporting 
                        agency.
                          (ii) Numerical credit score.--
                        However, if a numerical credit score is 
                        generated by an automated underwriting 
                        system used by an enterprise, and that 
                        score is disclosed to the person, the 
                        score shall be disclosed to the 
                        consumer [consistent with subparagraph 
                        (C)].
                          (iii) Enterprise defined.--For 
                        purposes of this subparagraph, the term 
                        ``enterprise'' has the same meaning as 
                        in paragraph (6) of section 1303 of the 
                        Federal Housing Enterprises Financial 
                        Safety and Soundness Act of 1992.
                  [(C) Disclosures of credit scores not 
                obtained from a consumer reporting agency.--A 
                person that is subject to the provisions of 
                this subsection and that uses a credit score, 
                other than a credit score provided by a 
                consumer reporting agency, may satisfy the 
                obligation to provide a credit score by 
                disclosing a credit score and associated key 
                factors supplied by a consumer reporting 
                agency.]
                  [(D)] (C) Notice to home loan applicants.--A 
                copy of the following notice, which shall 
                include the name, address, and telephone number 
                of each consumer reporting agency providing a 
                credit score that was used:

                  ``notice to the home loan applicant

  ``In connection with your application for a home loan, the 
lender must disclose to you the score that a consumer reporting 
agency distributed to users and the lender used in connection 
with your home loan, and the key factors affecting your credit 
scores.
   ``The credit score is a computer generated summary 
calculated at the time of the request and based on information 
that a consumer reporting agency or lender has on file. The 
scores are based on data about your credit history and payment 
patterns. Credit scores are important because they are used to 
assist the lender in determining whether you will obtain a 
loan. They may also be used to determine what interest rate you 
may be offered on the mortgage. Credit scores can change over 
time, depending on your conduct, how your credit history and 
payment patterns change, and how credit scoring technologies 
change.
   ``Because the score is based on information in your credit 
history, it is very important that you review the credit-
related information that is being furnished to make sure it is 
accurate. Credit records may vary from one company to another.
   ``If you have questions about your credit score or the 
credit information that is furnished to you, contact the 
consumer reporting agency at the address and telephone number 
provided with this notice, or contact the lender, if the lender 
developed or generated the credit score. The consumer reporting 
agency plays no part in the decision to take any action on the 
loan application and is unable to provide you with specific 
reasons for the decision on a loan application.
   ``If you have questions concerning the terms of the loan, 
contact the lender.''.
                  [(E)] (D) Actions not required under this 
                subsection.--This subsection shall not require 
                any person to--
                          (i) explain the information provided 
                        pursuant to subsection (f);
                          (ii) disclose any information other 
                        than a credit score or key factors, as 
                        defined in subsection (f);
                          (iii) disclose any credit score or 
                        related information obtained by the 
                        user after a loan has closed;
                          (iv) provide more than 1 disclosure 
                        per loan transaction; or
                          (v) provide the disclosure required 
                        by this subsection when another person 
                        has made the disclosure to the consumer 
                        for that loan transaction.
                  [(F)] (E) No obligation for content.--
                          (i) In general.--The obligation of 
                        any person pursuant to this subsection 
                        shall be limited solely to providing a 
                        copy of the information that was 
                        received from the consumer reporting 
                        agency.
                          (ii) Limit on liability.--No person 
                        has liability under this subsection for 
                        the content of that information or for 
                        the omission of any information within 
                        the report provided by the consumer 
                        reporting agency.
                  [(G)] (F) Person defined as excluding 
                enterprise.--As used in this subsection, the 
                term ``person'' does not include an enterprise 
                (as defined in paragraph (6) of section 1303 of 
                the Federal Housing Enterprises Financial 
                Safety and Soundness Act of 1992).
          (2) Prohibition on disclosure clauses null and 
        void.--
                  (A) In general.--Any provision in a contract 
                that prohibits the disclosure of a credit score 
                by a person who makes or arranges loans or a 
                consumer reporting agency is void.
                  (B) No liability for disclosure under this 
                subsection.--A lender shall not have liability 
                under any contractual provision for disclosure 
                of a credit score pursuant to this subsection.

           *       *       *       *       *       *       *


Sec. 611. Procedure in case of disputed 
                    accuracy

  (a) Reinvestigations of Disputed Information.--
          (1) Reinvestigation required.--
                  (A) In general.--Subject to subsection (f) 
                and except as provided in subsection (g), if 
                the completeness or accuracy of any item of 
                information contained in a consumer's file at a 
                consumer reporting agency is disputed by the 
                consumer and the consumer notifies the agency 
                directly, or indirectly through a reseller, of 
                such dispute, the agency shall, free of charge, 
                conduct a reasonable reinvestigation to 
                determine whether the disputed information is 
                inaccurate and record the current status of the 
                disputed information, or delete the item from 
                the file in accordance with paragraph (5), 
                before the end of the 30-day period beginning 
                on the date on which the agency receives the 
                notice of the dispute from the consumer or 
                reseller.
                  (B) Extension of period to reinvestigate.--
                Except as provided in subparagraph (C), the 30-
                day period described in subparagraph (A) may be 
                extended for not more than 15 additional days 
                if the consumer reporting agency receives 
                information from the consumer during that 30-
                day period that is relevant to the 
                reinvestigation.
                  (C) Limitations on extension of period to 
                reinvestigate.--Subparagraph (B) shall not 
                apply to any reinvestigation in which, during 
                the 30-day period described in subparagraph 
                (A), the information that is the subject of the 
                reinvestigation is found to be inaccurate or 
                incomplete or the consumer reporting agency 
                determines that the information cannot be 
                verified.
                  (D) Obligations of consumer reporting 
                agencies relating to reinvestigations.--
                Commensurate with the volume and complexity of 
                disputes about which a consumer reporting 
                agency receives notice, or reasonably 
                anticipates to receive notice, under this 
                paragraph, each consumer reporting agency 
                shall--
                          (i) maintain sufficient personnel to 
                        conduct reinvestigations of those 
                        disputes; and
                          (ii) provide training with respect to 
                        the personnel described in clause (i).
          (2) Prompt notice of dispute to furnisher of 
        information.--
                  (A) In general.--Before the expiration of the 
                5-business-day period beginning on the date on 
                which a consumer reporting agency receives 
                notice of a dispute from any consumer or a 
                reseller in accordance with paragraph (1), the 
                agency shall provide notification of the 
                dispute to any person who provided any item of 
                information in dispute, at the address and in 
                the manner established with the person. The 
                notice shall include all relevant information 
                regarding the dispute that the agency has 
                received from the consumer or reseller.
                  (B) Provision of other information.--The 
                consumer reporting agency shall promptly 
                provide to the person who provided the 
                information in dispute all relevant information 
                regarding the dispute that is received by the 
                agency from the consumer or the reseller after 
                the period referred to in subparagraph (A) and 
                before the end of the period referred to in 
                paragraph (1)(A).
          (3) Determination that dispute is frivolous or 
        irrelevant.--
                  (A) In general.--Notwithstanding paragraph 
                (1), a consumer reporting agency may terminate 
                a reinvestigation of information disputed by a 
                consumer under that paragraph if the agency 
                reasonably determines that the dispute by the 
                consumer is frivolous or irrelevant, including 
                by reason of a failure by a consumer to provide 
                sufficient information to investigate the 
                disputed information.
                  (B) Notice of determination.--Upon making any 
                determination in accordance with subparagraph 
                (A) that a dispute is frivolous or irrelevant, 
                a consumer reporting agency shall notify the 
                consumer of such determination not later than 5 
                business days after making such determination, 
                by mail or, if authorized by the consumer for 
                that purpose, by any other means available to 
                the agency.
                  (C) Contents of notice.--A notice under 
                subparagraph (B) shall include--
                          (i) the reasons for the determination 
                        under subparagraph (A); and
                          (ii) identification of any 
                        information required to investigate the 
                        disputed information, which may consist 
                        of a standardized form describing the 
                        general nature of such information.
          (4) Consideration of consumer information.--In 
        conducting any reinvestigation under paragraph (1) with 
        respect to disputed information in the file of any 
        consumer, the consumer reporting agency shall review 
        and consider all relevant information submitted by the 
        consumer in the period described in paragraph (1)(A) 
        with respect to such disputed information.
          (5) Treatment of inaccurate or unverifiable 
        information.--
                  (A) In general.--If, after any 
                reinvestigation under paragraph (1) of any 
                information disputed by a consumer, an item of 
                the information is found to be inaccurate or 
                incomplete or cannot be verified, the consumer 
                reporting agency shall--
                          (i) promptly delete that item of 
                        information from the file of the 
                        consumer, or modify that item of 
                        information, as appropriate, based on 
                        the results of the reinvestigation; and
                          (ii) promptly notify the furnisher of 
                        that information that the information 
                        has been modified or deleted from the 
                        file of the consumer.
                  (B) Requirements relating to reinsertion of 
                previously deleted material.--
                          (i) Certification of accuracy of 
                        information.--If any information is 
                        deleted from a consumer's file pursuant 
                        to subparagraph (A), the information 
                        may not be reinserted in the file by 
                        the consumer reporting agency unless 
                        the person who furnishes the 
                        information certifies that the 
                        information is complete and accurate.
                          (ii) Notice to consumer.--If any 
                        information that has been deleted from 
                        a consumer's file pursuant to 
                        subparagraph (A) is reinserted in the 
                        file, the consumer reporting agency 
                        shall notify the consumer of the 
                        reinsertion in writing not later than 5 
                        business days after the reinsertion or, 
                        if authorized by the consumer for that 
                        purpose, by any other means available 
                        to the agency.
                          (iii) Additional information.--As 
                        part of, or in addition to, the notice 
                        under clause (ii), a consumer reporting 
                        agency shall provide to a consumer in 
                        writing not later than 5 business days 
                        after the date of the reinsertion--
                                  (I) a statement that the 
                                disputed information has been 
                                reinserted;
                                  (II) the business name and 
                                address of any furnisher of 
                                information contacted and the 
                                telephone number of such 
                                furnisher, if reasonably 
                                available, or of any furnisher 
                                of information that contacted 
                                the consumer reporting agency, 
                                in connection with the 
                                reinsertion of such 
                                information; and
                                  (III) a notice that the 
                                consumer has the right to add a 
                                statement to the consumer's 
                                file disputing the accuracy or 
                                completeness of the disputed 
                                information.
                  (C) Procedures to prevent reappearance.--A 
                consumer reporting agency shall maintain 
                reasonable procedures designed to prevent the 
                reappearance in a consumer's file, and in 
                consumer reports on the consumer, of 
                information that is deleted pursuant to this 
                paragraph (other than information that is 
                reinserted in accordance with subparagraph 
                (B)(i)).
                  (D) Automated reinvestigation system.--Any 
                consumer reporting agency that compiles and 
                maintains files on consumers on a nationwide 
                basis shall implement an automated system 
                through which furnishers of information to that 
                consumer reporting agency may report the 
                results of a reinvestigation that finds 
                incomplete or inaccurate information in a 
                consumer's file to other such consumer 
                reporting agencies.
          (6) Notice of results of reinvestigation.--
                  (A) In general.--A consumer reporting agency 
                shall provide written notice to a consumer of 
                the results of a reinvestigation under this 
                subsection not later than 5 business days after 
                the completion of the reinvestigation, by mail 
                or, if authorized by the consumer for that 
                purpose, by other means available to the 
                agency.
                  (B) Contents.--As part of, or in addition to, 
                the notice under subparagraph (A), a consumer 
                reporting agency shall provide to a consumer in 
                writing before the expiration of the 5-day 
                period referred to in subparagraph (A)--
                          (i) a statement that the 
                        reinvestigation is completed;
                          [(ii) a consumer report that is based 
                        upon the consumer's file as that file 
                        is revised as a result of the 
                        reinvestigation;
                          [(iii) a notice that, if requested by 
                        the consumer, a description of the 
                        procedure used to determine the 
                        accuracy and completeness of the 
                        information shall be provided to the 
                        consumer by the agency, including the 
                        business name and address of any 
                        furnisher of information contacted in 
                        connection with such information and 
                        the telephone number of such furnisher, 
                        if reasonably available;]
                          (ii) a copy of the consumer's file 
                        and a consumer report that is based 
                        upon such file as revised, including a 
                        description of the specific 
                        modification or deletion of 
                        information, as a result of the 
                        reinvestigation;
                          (iii) a description of the actions 
                        taken by the consumer reporting agency 
                        regarding the dispute;
                          (iv) if applicable, contact 
                        information for any furnisher involved 
                        in responding to the dispute and a 
                        description of the role played by the 
                        furnisher in the reinvestigation 
                        process;
                          (v) the options available to the 
                        consumer if the consumer is 
                        dissatisfied with the result of the 
                        reinvestigation, including--
                                  (I) submitting documents in 
                                support of the dispute;
                                  (II) adding a consumer 
                                statement of dispute to the 
                                file of the consumer pursuant 
                                to subsection (b);
                                  (III) filing a dispute with 
                                the furnisher pursuant to 
                                section 623(a)(8); and
                                  (IV) submitting a complaint 
                                against the consumer reporting 
                                agency or furnishers through 
                                the consumer complaint database 
                                of the Bureau or the State 
                                attorney general for the State 
                                in which the consumer resides;
                          [(iv)] (vi) a notice that the 
                        consumer has the right to add a 
                        statement to the consumer's file 
                        disputing the accuracy or completeness 
                        of the information; and
                          [(v)] (vii) a notice that the 
                        consumer has the right to request under 
                        subsection (d) that the consumer 
                        reporting agency furnish notifications 
                        under that subsection.
          [(7) Description of reinvestigation procedure.--A 
        consumer reporting agency shall provide to a consumer a 
        description referred to in paragraph (6)(B)(iii) by not 
        later than 15 days after receiving a request from the 
        consumer for that description.]
          [(8)] (7) Expedited dispute resolution.--If a dispute 
        regarding an item of information in a consumer's file 
        at a consumer reporting agency is resolved in 
        accordance with paragraph (5)(A) by the deletion of the 
        disputed information by not later than 3 business days 
        after the date on which the agency receives notice of 
        the dispute from the consumer in accordance with 
        paragraph (1)(A), then the agency shall not be required 
        to comply with [paragraphs (2), (6), and (7)] 
        paragraphs (2) and (6) with respect to that dispute if 
        the agency--
                  (A) provides prompt notice of the deletion to 
                the consumer by telephone;
                  (B) includes in that notice, or in a written 
                notice that accompanies a confirmation and 
                consumer report provided in accordance with 
                subparagraph (C), a statement of the consumer's 
                right to request under subsection (d) that the 
                agency furnish notifications under that 
                subsection; and
                  (C) provides written confirmation of the 
                deletion and a copy of a consumer report on the 
                consumer that is based on the consumer's file 
                after the deletion, not later than 5 business 
                days after making the deletion.
          (8) Bureau credit reporting ombudsperson.--
                  (A) In general.--Not later than 180 days 
                after the date of enactment of this paragraph, 
                the Bureau shall establish the position of 
                credit reporting ombudsperson, whose specific 
                duties shall include carrying out the Bureau's 
                responsibilities with respect to--
                          (i) resolving persistent errors that 
                        are not resolved in a timely manner by 
                        a consumer reporting agency; and
                          (ii) enhancing oversight of consumer 
                        reporting agencies by--
                                  (I) advising the Director of 
                                the Bureau, in consultation 
                                with the Office of Enforcement 
                                and the Office of Supervision 
                                of the Bureau, on any potential 
                                violations of paragraph (5) or 
                                any other applicable law by a 
                                consumer reporting agency, 
                                including appropriate 
                                corrective action for such a 
                                violation; and
                                  (II) making referrals to the 
                                Office of Supervision for 
                                supervisory action or the 
                                Office of Enforcement for 
                                enforcement action, as 
                                appropriate, in response to 
                                violations of paragraph (5) or 
                                any other applicable law by a 
                                consumer reporting agency.
                  (B) Report.--The ombudsperson shall submit to 
                the Committee on Financial Services of the 
                House of Representatives and the Committee on 
                Banking, Housing, and Urban Affairs of the 
                Senate an annual report including statistics 
                and analysis on consumer complaints the Bureau 
                receives relating to consumer reports, as well 
                as a summary of the supervisory actions and 
                enforcement actions taken with respect to 
                consumer reporting agencies during the year 
                covered by the report.
  (b) If the reinvestigation does not resolve the dispute, the 
consumer may file a brief statement setting forth the nature of 
the dispute. The consumer reporting agency may limit such 
statements to not more than one hundred words if it provides 
the consumer with assistance in writing a clear summary of the 
dispute.
  (c) Whenever a statement of a dispute is filed, unless there 
is reasonable grounds to believe that it is frivolous or 
irrevelant, the consumer reporting agency shall, in any 
subsequent consumer report containing the information in 
question, clearly note that it is disputed by the consumer and 
provide either the consumer's statement or a clear and accurate 
codification or summary thereof.
  (d) Following any deletion of information which is found to 
be inaccurate or whose accuracy can no longer be verified or 
any notation as to disputed information, the consumer reporting 
agency shall, at the request of the consumer, furnish 
notification that the item has been deleted or the statement, 
codification or summary pursuant to subsection (b) or (c) to 
any person specifically designated by the consumer who has 
within two years prior thereto received a consumer report for 
employment purposes, or within six months prior thereto 
received a consumer report for any other purpose, which 
contained the deleted or disputed information.
  (e) Treatment of Complaints and Report to Congress.--
          (1) In general.--The Commission shall--
                  (A) compile all complaints that it receives 
                that a file of a consumer that is maintained by 
                a consumer reporting agency described in 
                section 603(p) contains incomplete or 
                inaccurate information, with respect to which, 
                the consumer appears to have disputed the 
                completeness or accuracy with the consumer 
                reporting agency or otherwise utilized the 
                procedures provided by subsection (a); and
                  (B) transmit each such complaint to each 
                consumer reporting agency involved.
          (2) Exclusion.--Complaints received or obtained by 
        the Bureau pursuant to its investigative authority 
        under the Consumer Financial Protection Act of 2010 
        shall not be subject to paragraph (1).
          (3) Agency responsibilities.--Each consumer reporting 
        agency described in section 603(p) that receives a 
        complaint transmitted by the Bureau pursuant to 
        paragraph (1) shall--
                  (A) review each such complaint to determine 
                whether all legal obligations imposed on the 
                consumer reporting agency under this title 
                (including any obligation imposed by an 
                applicable court or administrative order) have 
                been met with respect to the subject matter of 
                the complaint;
                  (B) provide reports on a regular basis to the 
                Bureau regarding the determinations of and 
                actions taken by the consumer reporting agency, 
                if any, in connection with its review of such 
                complaints; and
                  (C) maintain, for a reasonable time period, 
                records regarding the disposition of each such 
                complaint that is sufficient to demonstrate 
                compliance with this subsection.
          (4) Rulemaking authority.--The Bureau may prescribe 
        regulations, as appropriate to implement this 
        subsection.
          (5) Annual report.--The Bureau shall submit to the 
        Committee on Banking, Housing, and Urban Affairs of the 
        Senate and the Committee on Financial Services of the 
        House of Representatives an annual report regarding 
        information gathered by the Bureau under this 
        subsection.
  (f) Reinvestigation Requirement Applicable to Resellers.--
          (1) Exemption from general reinvestigation 
        requirement.--Except as provided in paragraph (2), a 
        reseller shall be exempt from the requirements of this 
        section.
          (2) Action required upon receiving notice of a 
        dispute.--If a reseller receives a notice from a 
        consumer of a dispute concerning the completeness or 
        accuracy of any item of information contained in a 
        consumer report on such consumer produced by the 
        reseller, the reseller shall, within 5 business days of 
        receiving the notice, and free of charge--
                  (A) determine whether the item of information 
                is incomplete or inaccurate as a result of an 
                act or omission of the reseller; and
                  (B) if--
                          (i) the reseller determines that the 
                        item of information is incomplete or 
                        inaccurate as a result of an act or 
                        omission of the reseller, not later 
                        than 20 days after receiving the 
                        notice, correct the information in the 
                        consumer report or delete it; or
                          (ii) if the reseller determines that 
                        the item of information is not 
                        incomplete or inaccurate as a result of 
                        an act or omission of the reseller, 
                        convey the notice of the dispute, 
                        together with all relevant information 
                        provided by the consumer, to each 
                        consumer reporting agency that provided 
                        the reseller with the information that 
                        is the subject of the dispute, using an 
                        address or a notification mechanism 
                        specified by the consumer reporting 
                        agency for such notices.
          (3) Responsibility of consumer reporting agency to 
        notify consumer through reseller.--Upon the completion 
        of a reinvestigation under this section of a dispute 
        concerning the completeness or accuracy of any 
        information in the file of a consumer by a consumer 
        reporting agency that received notice of the dispute 
        from a reseller under paragraph (2)--
                  (A) the notice by the consumer reporting 
                agency under paragraph (6), (7), or (8) of 
                subsection (a) shall be provided to the 
                reseller in lieu of the consumer; and
                  (B) the reseller shall immediately reconvey 
                such notice to the consumer, including any 
                notice of a deletion by telephone in the manner 
                required under paragraph (8)(A).
          (4) Reseller reinvestigations.--No provision of this 
        subsection shall be construed as prohibiting a reseller 
        from conducting a reinvestigation of a consumer dispute 
        directly.
  (g) Dispute Process for Veteran's Medical Debt.--
          (1) In general.--With respect to a veteran's medical 
        debt, the veteran may submit a notice described in 
        paragraph (2), proof of liability of the Department of 
        Veterans Affairs for payment of that debt, or 
        documentation that the Department of Veterans Affairs 
        is in the process of making payment for authorized 
        hospital care, medical services, or extended care 
        services rendered to a consumer reporting agency or a 
        reseller to dispute the inclusion of that debt on a 
        consumer report of the veteran.
          (2) Notification to veteran.--The Department of 
        Veterans Affairs shall submit to a veteran a notice 
        that the Department of Veterans Affairs has assumed 
        liability for part or all of a veteran's medical debt.
          (3) Deletion of information from file.--If a consumer 
        reporting agency receives notice, proof of liability, 
        or documentation under paragraph (1), the consumer 
        reporting agency shall delete all information relating 
        to the veteran's medical debt from the file of the 
        veteran and notify the furnisher and the veteran of 
        that deletion.
  (h) Notification of Deletion of Information.--A consumer 
reporting agency described in section 603(p) shall communicate 
with other consumer reporting agencies described in section 
603(p) to ensure that a dispute initiated with one consumer 
reporting agency is noted in a file maintained by such other 
consumer reporting agencies.

SEC. 612. CHARGES FOR CERTAIN DISCLOSURES.

  (a) Free Annual Disclosure.--
          (1) Nationwide consumer reporting agencies.--
                  (A) In general.--All consumer reporting 
                agencies described in subsections (p) and (w) 
                of section 603 shall make all disclosures 
                pursuant to section 609 once during any 12-
                month period upon request of the consumer and 
                without charge to the consumer.
                  (B) Centralized source.--Subparagraph (A) 
                shall apply with respect to a consumer 
                reporting agency described in section 603(p) 
                only if the request from the consumer is made 
                using the centralized source established for 
                such purpose in accordance with section 211(c) 
                of the Fair and Accurate Credit Transactions 
                Act of 2003.
                  (C) Nationwide specialty consumer reporting 
                agency.--
                          (i) In general.--The Commission shall 
                        prescribe regulations applicable to 
                        each consumer reporting agency 
                        described in section 603(w) to require 
                        the establishment of a streamlined 
                        process for consumers to request 
                        consumer reports under subparagraph 
                        (A), which shall include, at a minimum, 
                        the establishment by each such agency 
                        of a toll-free telephone number for 
                        such requests.
                          (ii) Considerations.--In prescribing 
                        regulations under clause (i), the 
                        Bureau shall consider--
                                  (I) the significant demands 
                                that may be placed on consumer 
                                reporting agencies in providing 
                                such consumer reports;
                                  (II) appropriate means to 
                                ensure that consumer reporting 
                                agencies can satisfactorily 
                                meet those demands, including 
                                the efficacy of a system of 
                                staggering the availability to 
                                consumers of such consumer 
                                reports; and
                                  (III) the ease by which 
                                consumers should be able to 
                                contact consumer reporting 
                                agencies with respect to access 
                                to such consumer reports.
                          (iii) Date of issuance.--The 
                        Commission shall issue the regulations 
                        required by this subparagraph in final 
                        form not later than 6 months after the 
                        date of enactment of the Fair and 
                        Accurate Credit Transactions Act of 
                        2003.
                          (iv) Consideration of ability to 
                        comply.--The regulations of the Bureau 
                        under this subparagraph shall establish 
                        an effective date by which each 
                        nationwide specialty consumer reporting 
                        agency (as defined in section 603(w)) 
                        shall be required to comply with 
                        subsection (a), which effective date--
                                  (I) shall be established 
                                after consideration of the 
                                ability of each nationwide 
                                specialty consumer reporting 
                                agency to comply with 
                                subsection (a); and
                                  (II) shall be not later than 
                                6 months after the date on 
                                which such regulations are 
                                issued in final form (or such 
                                additional period not to exceed 
                                3 months, as the Bureau 
                                determines appropriate).
                  (D) Online consumer portal landing page.--
                          (i) In general.--Not later than 1 
                        year after the date of enactment of 
                        this subparagraph, each consumer 
                        reporting agency described in section 
                        603(p) shall jointly develop an online 
                        consumer portal landing page that gives 
                        each consumer unlimited free access 
                        to--
                                  (I) the consumer report of 
                                the consumer;
                                  (II) the means by which the 
                                consumer may exercise the 
                                rights of the consumer under 
                                subparagraph (E) and section 
                                604(e);
                                  (III) the ability to initiate 
                                a dispute with the consumer 
                                reporting agency regarding the 
                                accuracy or completeness of any 
                                information in a report in 
                                accordance with section 611(a) 
                                or 623(a)(8);
                                  (IV) the ability to place and 
                                remove a security freeze on a 
                                consumer report for free under 
                                section 605A(i) and (j);
                                  (V) if the consumer reporting 
                                agency offers a product to 
                                consumers to prevent access to 
                                the consumer report of the 
                                consumer for the purpose of 
                                preventing identity theft, a 
                                disclosure to the consumer 
                                regarding the differences 
                                between that product and a 
                                security freeze as defined 
                                under section 605A(i) or (j);
                                  (VI) information on who has 
                                accessed the consumer report of 
                                the consumer over the last 24 
                                months, and, as available, for 
                                what permissible purpose the 
                                consumer report was furnished 
                                in accordance with section 604 
                                and section 609; and
                                  (VII) the credit score of the 
                                consumer in accordance with 
                                section 609(f)(7).
                          (ii) No waiver.--A consumer reporting 
                        agency described in section 603(p) may 
                        not require a consumer to waive any 
                        legal or privacy rights to access--
                                  (I) a portal established 
                                under this subparagraph; or
                                  (II) any of the services 
                                described in clause (i) that 
                                are provided through a portal 
                                established under this 
                                subparagraph.
                          (iii) No advertising or 
                        solicitations.--A portal established 
                        under this subparagraph may not contain 
                        any advertising, marketing offers, or 
                        other solicitations.
                          (iv) Extension.--The Bureau may allow 
                        the consumer reporting agencies an 
                        extension of 1 year to develop the 
                        online consumer portal landing page 
                        required under clause (i).
                          (v) Rule of construction.--Nothing in 
                        this subparagraph may be construed as 
                        requiring a consumer reporting agency 
                        to disclose confidential proprietary 
                        information through the online consumer 
                        portal landing page.
                  (E) Opt-out option.--
                          (i) In general.--If a consumer 
                        reporting agency sells consumer 
                        information in a manner that is not 
                        included in a consumer report, the 
                        consumer reporting agency shall provide 
                        each consumer with a method (through a 
                        website, by phone, or in writing) by 
                        which the consumer may elect, free of 
                        charge, to not have the information of 
                        the consumer so sold.
                          (ii) No expiration.--An election made 
                        by a consumer under clause (i) shall 
                        expire on the date on which the 
                        consumer expressly revokes the election 
                        through a website, by phone, or in 
                        writing.
          (2) Timing.--A consumer reporting agency shall 
        provide a consumer report under paragraph (1) not later 
        than 15 days after the date on which the request is 
        received under paragraph (1).
          (3) Reinvestigations.--Notwithstanding the time 
        periods specified in section 611(a)(1), a 
        reinvestigation under that section by a consumer 
        reporting agency upon a request of a consumer that is 
        made after receiving a consumer report under this 
        subsection shall be completed not later than 45 days 
        after the date on which the request is received.
          (4) Exception for first 12 months of operation.--This 
        subsection shall not apply to a consumer reporting 
        agency that has not been furnishing consumer reports to 
        third parties on a continuing basis during the 12-month 
        period preceding a request under paragraph (1), with 
        respect to consumers residing nationwide.
  [(b) Free Disclosure After Adverse Notice to Consumer.--Each 
consumer reporting agency that maintains a file on a consumer 
shall make all disclosures pursuant to section 609 without 
charge to the consumer if, not later than 60 days after receipt 
by such consumer of a notification pursuant to section 615, or 
of a notification from a debt collection agency affiliated with 
that consumer reporting agency stating that the consumer's 
credit rating may be or has been adversely affected, the 
consumer makes a request under section 609.]
  (b) Free Disclosure After Notice of Adverse Action or Offer 
of Credit on Materially Less Favorable Term.--Not later than 30 
days after the date on which a consumer reporting agency 
receives a notification under subsection (a)(2) or (h)(6) of 
section 615, or from a debt collection agency affiliated with 
the consumer reporting agency, the consumer reporting agency 
shall make to a consumer, without charge to the consumer, all 
disclosures that are made to a user of a consumer report in 
accordance with the rules prescribed by the Bureau.
  (c) Free Disclosure Under Certain Other Circumstances.--Upon 
the request of the consumer, a consumer reporting agency shall 
make all disclosures pursuant to section 609 once during any 
12-month period without charge to that consumer if the consumer 
certifies in writing that the consumer--
          (1) is unemployed and intends to apply for employment 
        in the 60-day period beginning on the date on which the 
        certification is made;
          (2) is a recipient of public welfare assistance; or
          (3) has reason to believe that the file on the 
        consumer at the agency contains inaccurate information 
        due to fraud.
  (d) Free Disclosures in Connection With Fraud Alerts.--Upon 
the request of a consumer, a consumer reporting agency 
described in section 603(p) shall make all disclosures pursuant 
to section 609 without charge to the consumer, as provided in 
subsections (a)(2) and (b)(2) of section 605A, as applicable.
  (e) Other Charges Prohibited.--A consumer reporting agency 
shall not impose any charge on a consumer for providing any 
notification required by this title or making any disclosure 
required by this title, except as authorized by subsection (f).
  (f) Reasonable Charges Allowed for Certain Disclosures.--
          (1) In general.--In the case of a request from a 
        consumer other than a request that is covered by any of 
        subsections (a) through (d), or that is made through 
        the online consumer portal landing page established 
        under subsection (a)(1)(D), a consumer reporting agency 
        may impose a reasonable charge on a consumer--
                  (A) for making a disclosure to the consumer 
                pursuant to section 609, which charge--
                          (i) shall not exceed $8; and
                          (ii) shall be indicated to the 
                        consumer before making the disclosure; 
                        and
                  (B) for furnishing, pursuant to section 
                611(d), following a reinvestigation under 
                section 611(a), a statement, codification, or 
                summary to a person designated by the consumer 
                under that section after the 30-day period 
                beginning on the date of notification of the 
                consumer under paragraph (6) or (8) of section 
                611(a) with respect to the reinvestigation, 
                which charge--
                          (i) shall not exceed the charge that 
                        the agency would impose on each 
                        designated recipient for a consumer 
                        report; and
                          (ii) shall be indicated to the 
                        consumer before furnishing such 
                        information.
          (2) Modification of amount.--The Bureau shall 
        increase the amount referred to in paragraph (1)(A)(i) 
        on January 1 of each year, based proportionally on 
        changes in the Consumer Price Index, with fractional 
        changes rounded to the nearest fifty cents.
  (g) Prevention of Deceptive Marketing of Credit Reports.--
          (1) In general.--Subject to rulemaking pursuant to 
        section 205(b) of the Credit CARD Act of 2009, any 
        advertisement for a free credit report in any medium 
        shall prominently disclose in such advertisement that 
        free credit reports are available under Federal law at: 
        ``AnnualCreditReport.com'' (or such other source as may 
        be authorized under Federal law).
          (2) Television and radio advertisement.--In the case 
        of an advertisement broadcast by television, the 
        disclosures required under paragraph (1) shall be 
        included in the audio and visual part of such 
        advertisement. In the case of an advertisement 
        broadcast by televison or radio, the disclosure 
        required under paragraph (1) shall consist only of the 
        following: ``This is not the free credit report 
        provided for by Federal law''.

           *       *       *       *       *       *       *


Sec. 615. Requirements on users of consumer reports

  (a) Duties of Users Taking Adverse Actions on the Basis of 
Information Contained in Consumer Reports.--If any person takes 
any adverse action with respect to any consumer that is based 
in whole or in part on any information contained in a consumer 
report, the person shall--
          (1) provide oral, written, or electronic notice of 
        the adverse action to the consumer;
          (2) direct the consumer reporting agency that 
        provided the consumer report that was used in the 
        decision to take the adverse action to provide the 
        consumer with the disclosures described in section 
        612(b);
          [(2)] (3) provide to the consumer written or 
        electronic disclosure--
                  (A) of a numerical credit score as defined in 
                section 609(f)(2)(A) used by such person in 
                taking any adverse action based in whole or in 
                part on any information in a consumer report; 
                and
                  (B) of the information set forth in 
                subparagraphs (B) through (E) of section 
                609(f)(1);
          [(3)] (4) provide to the consumer orally, in writing, 
        or electronically--
                  (A) the name, address, and telephone number 
                of the consumer reporting agency (including a 
                toll-free telephone number established by the 
                agency if the agency compiles and maintains 
                files on consumers on a nationwide basis) that 
                furnished the report to the person; and
                  (B) a statement that the consumer reporting 
                agency did not make the decision to take the 
                adverse action and is unable to provide the 
                consumer the specific reasons why the adverse 
                action was taken; and
          [(4)] (5) provide to the consumer an oral, written, 
        or electronic notice [of the consumer's right]--
                  [(A) to obtain, under section 612, a free 
                copy of a consumer report on the consumer from 
                the consumer reporting agency referred to in 
                paragraph (3), which notice shall include an 
                indication of the 60-day period under that 
                section for obtaining such a copy; and]
                  (A) that the consumer shall receive a copy of 
                the consumer report with respect to the 
                consumer, free of charge, from the consumer 
                reporting agency that furnished the consumer 
                report; and
                  (B) of the right of the consumer to dispute, 
                under section 611, with a consumer reporting 
                agency the accuracy or completeness of any 
                information in a consumer report furnished by 
                the agency.
  (b) Adverse Action Based on Information Obtained From Third 
Parties Other Than Consumer Reporting Agencies.--
          (1) In general.--Whenever credit for personal, 
        family, or household purposes involving a consumer is 
        denied or the charge for such credit is increased 
        either wholly or partly because of information obtained 
        from a person other than a consumer reporting agency 
        bearing upon the consumer's credit worthiness, credit 
        standing, credit capacity, character, general 
        reputation, personal characteristics, or mode of 
        living, the user of such information shall, within a 
        reasonable period of time, upon the consumer's written 
        request for the reasons for such adverse action 
        received within sixty days after learning of such 
        adverse action, disclose the nature of the information 
        to the consumer. The user of such information shall 
        clearly and accurately disclose to the consumer his 
        right to make such written request at the time such 
        adverse action is communicated to the consumer.
          (2) Duties of person taking certain actions based on 
        information provided by affiliate.--
                  (A) Duties, generally.--If a person takes an 
                action described in subparagraph (B) with 
                respect to a consumer, based in whole or in 
                part on information described in subparagraph 
                (C), the person shall--
                          (i) notify the consumer of the 
                        action, including a statement that the 
                        consumer may obtain the information in 
                        accordance with clause (ii); and
                          (ii) upon a written request from the 
                        consumer received within 60 days after 
                        transmittal of the notice required by 
                        clause (i), disclose to the consumer 
                        the nature of the information upon 
                        which the action is based by not later 
                        than 30 days after receipt of the 
                        request.
                  (B) Action described.--An action referred to 
                in subparagraph (A) is an adverse action 
                described in section 603(k)(1)(A), taken in 
                connection with a transaction initiated by the 
                consumer, or any adverse action described in 
                clause (i) or (ii) of section 603(k)(1)(B).
                  (C) Information described.--Information 
                referred to in subparagraph (A)--
                          (i) except as provided in clause 
                        (ii), is information that--
                                  (I) is furnished to the 
                                person taking the action by a 
                                person related by common 
                                ownership or affiliated by 
                                common corporate control to the 
                                person taking the action; and
                                  (II) bears on the credit 
                                worthiness, credit standing, 
                                credit capacity, character, 
                                general reputation, personal 
                                characteristics, or mode of 
                                living of the consumer; and
                          (ii) does not include--
                                  (I) information solely as to 
                                transactions or experiences 
                                between the consumer and the 
                                person furnishing the 
                                information; or
                                  (II) information in a 
                                consumer report.
  (c) No person shall be held liable for any violation of this 
section if he shows by a preponderance of the evidence that at 
the time of the alleged violation he maintained reasonable 
procedures to assure compliance with the provisions of this 
section.
  (d) Duties of Users Making Written Credit or Insurance 
Solicitations on the Basis of Information Contained in Consumer 
Files.--
          (1) In general.--Any person who uses a consumer 
        report on any consumer in connection with any credit or 
        insurance transaction that is not initiated by the 
        consumer, that is provided to that person under section 
        604(c)(1)(B), shall provide with each written 
        solicitation made to the consumer regarding the 
        transaction a clear and conspicuous statement that--
                  (A) information contained in the consumer's 
                consumer report was used in connection with the 
                transaction;
                  (B) the consumer received the offer of credit 
                or insurance because the consumer satisfied the 
                criteria for credit worthiness or insurability 
                under which the consumer was selected for the 
                offer;
                  (C) if applicable, the credit or insurance 
                may not be extended if, after the consumer 
                responds to the offer, the consumer does not 
                meet the criteria used to select the consumer 
                for the offer or any applicable criteria 
                bearing on credit worthiness or insurability or 
                does not furnish any required collateral;
                  (D) the consumer has a right to prohibit 
                information contained in the consumer's file 
                with any consumer reporting agency from being 
                used in connection with any credit or insurance 
                transaction that is not initiated by the 
                consumer; and
                  (E) the consumer may exercise the right 
                referred to in subparagraph (D) by notifying a 
                notification system established under section 
                604(e).
          (2) Disclosure of address and telephone number; 
        format.--A statement under paragraph (1) shall--
                  (A) include the address and toll-free 
                telephone number of the appropriate 
                notification system established under section 
                604(e); and
                  (B) be presented in such format and in such 
                type size and manner as to be simple and easy 
                to understand, as established by the Bureau, by 
                rule, in consultation with the Federal Trade 
                Commission, the Federal banking agencies, and 
                the National Credit Union Administration.
          (3) Maintaining criteria on file.--A person who makes 
        an offer of credit or insurance to a consumer under a 
        credit or insurance transaction described in paragraph 
        (1) shall maintain on file the criteria used to select 
        the consumer to receive the offer, all criteria bearing 
        on credit worthiness or insurability, as applicable, 
        that are the basis for determining whether or not to 
        extend credit or insurance pursuant to the offer, and 
        any requirement for the furnishing of collateral as a 
        condition of the extension of credit or insurance, 
        until the expiration of the 3-year period beginning on 
        the date on which the offer is made to the consumer.
          (4) Authority of federal agencies regarding unfair or 
        deceptive acts or practices not affected.--This section 
        is not intended to affect the authority of any Federal 
        or State agency to enforce a prohibition against unfair 
        or deceptive acts or practices, including the making of 
        false or misleading statements in connection with a 
        credit or insurance transaction that is not initiated 
        by the consumer.
  (e) Red Flag Guidelines and Regulations Required.--
          (1) Guidelines.--The Federal banking agencies, the 
        National Credit Union Administration, the Federal Trade 
        Commission, the Commodity Futures Trading Commission, 
        and the Securities and Exchange Commission shall 
        jointly, with respect to the entities that are subject 
        to their respective enforcement authority under section 
        621--
                  (A) establish and maintain guidelines for use 
                by each financial institution and each creditor 
                regarding identity theft with respect to 
                account holders at, or customers of, such 
                entities, and update such guidelines as often 
                as necessary;
                  (B) prescribe regulations requiring each 
                financial institution and each creditor to 
                establish reasonable policies and procedures 
                for implementing the guidelines established 
                pursuant to subparagraph (A), to identify 
                possible risks to account holders or customers 
                or to the safety and soundness of the 
                institution or customers; and
                  (C) prescribe regulations applicable to card 
                issuers to ensure that, if a card issuer 
                receives notification of a change of address 
                for an existing account, and within a short 
                period of time (during at least the first 30 
                days after such notification is received) 
                receives a request for an additional or 
                replacement card for the same account, the card 
                issuer may not issue the additional or 
                replacement card, unless the card issuer, in 
                accordance with reasonable policies and 
                procedures--
                          (i) notifies the cardholder of the 
                        request at the former address of the 
                        cardholder and provides to the 
                        cardholder a means of promptly 
                        reporting incorrect address changes;
                          (ii) notifies the cardholder of the 
                        request by such other means of 
                        communication as the cardholder and the 
                        card issuer previously agreed to; or
                          (iii) uses other means of assessing 
                        the validity of the change of address, 
                        in accordance with reasonable policies 
                        and procedures established by the card 
                        issuer in accordance with the 
                        regulations prescribed under 
                        subparagraph (B).
          (2) Criteria.--
                  (A) In general.--In developing the guidelines 
                required by paragraph (1)(A), the agencies 
                described in paragraph (1) shall identify 
                patterns, practices, and specific forms of 
                activity that indicate the possible existence 
                of identity theft.
                  (B) Inactive accounts.--In developing the 
                guidelines required by paragraph (1)(A), the 
                agencies described in paragraph (1) shall 
                consider including reasonable guidelines 
                providing that when a transaction occurs with 
                respect to a credit or deposit account that has 
                been inactive for more than 2 years, the 
                creditor or financial institution shall follow 
                reasonable policies and procedures that provide 
                for notice to be given to a consumer in a 
                manner reasonably designed to reduce the 
                likelihood of identity theft with respect to 
                such account.
          (3) Consistency with verification requirements.--
        Guidelines established pursuant to paragraph (1) shall 
        not be inconsistent with the policies and procedures 
        required under section 5318(l) of title 31, United 
        States Code.
          (4) Definitions.--As used in this subsection, the 
        term ``creditor''--
                  (A) means a creditor, as defined in section 
                702 of the Equal Credit Opportunity Act (15 
                U.S.C. 1691a), that regularly and in the 
                ordinary course of business--
                          (i) obtains or uses consumer reports, 
                        directly or indirectly, in connection 
                        with a credit transaction;
                          (ii) furnishes information to 
                        consumer reporting agencies, as 
                        described in section 623, in connection 
                        with a credit transaction; or
                          (iii) advances funds to or on behalf 
                        of a person, based on an obligation of 
                        the person to repay the funds or 
                        repayable from specific property 
                        pledged by or on behalf of the person;
                  (B) does not include a creditor described in 
                subparagraph (A)(iii) that advances funds on 
                behalf of a person for expenses incidental to a 
                service provided by the creditor to that 
                person; and
                  (C) includes any other type of creditor, as 
                defined in that section 702, as the agency 
                described in paragraph (1) having authority 
                over that creditor may determine appropriate by 
                rule promulgated by that agency, based on a 
                determination that such creditor offers or 
                maintains accounts that are subject to a 
                reasonably foreseeable risk of identity theft.
  (f) Prohibition on Sale or Transfer of Debt Caused by 
Identity Theft.--
          (1) In general.--No person shall sell, transfer for 
        consideration, or place for collection a debt that such 
        person has been notified under section 605B has 
        resulted from identity theft.
          (2) Applicability.--The prohibitions of this 
        subsection shall apply to all persons collecting a debt 
        described in paragraph (1) after the date of a 
        notification under paragraph (1).
          (3) Rule of construction.--Nothing in this subsection 
        shall be construed to prohibit--
                  (A) the repurchase of a debt in any case in 
                which the assignee of the debt requires such 
                repurchase because the debt has resulted from 
                identity theft;
                  (B) the securitization of a debt or the 
                pledging of a portfolio of debt as collateral 
                in connection with a borrowing; or
                  (C) the transfer of debt as a result of a 
                merger, acquisition, purchase and assumption 
                transaction, or transfer of substantially all 
                of the assets of an entity.
  (g) Debt Collector Communications Concerning Identity 
Theft.--If a person acting as a debt collector (as that term is 
defined in title VIII) on behalf of a third party that is a 
creditor or other user of a consumer report is notified that 
any information relating to a debt that the person is 
attempting to collect may be fraudulent or may be the result of 
identity theft, that person shall--
          (1) notify the third party that the information may 
        be fraudulent or may be the result of identity theft; 
        and
          (2) upon request of the consumer to whom the debt 
        purportedly relates, provide to the consumer all 
        information to which the consumer would otherwise be 
        entitled if the consumer were not a victim of identity 
        theft, but wished to dispute the debt under provisions 
        of law applicable to that person.
  (h) Duties of Users in Certain Credit Transactions.--
          (1) In general.--Subject to rules prescribed as 
        provided in [paragraph (6)] paragraph (7), if any 
        person uses a consumer report in connection with an 
        application for, or a grant, extension, or other 
        provision of, credit on material terms that are 
        materially less favorable than the most favorable terms 
        available to a substantial proportion of consumers from 
        or through that person, based in whole or in part on a 
        consumer report, the person shall provide an oral, 
        written, or electronic notice to the consumer in the 
        form and manner required by regulations prescribed in 
        accordance with this subsection.
          (2) Timing.--The notice required under paragraph (1) 
        may be provided at the time of an application for, or a 
        grant, extension, or other provision of, credit or the 
        time of communication of an approval of an application 
        for, or grant, extension, or other provision of, 
        credit, except as provided in the regulations 
        prescribed under [paragraph (6)] paragraph (7)
          (3) Exceptions.--No notice shall be required from a 
        person under this subsection if--
                  (A) the consumer applied for specific 
                material terms and was granted those terms, 
                unless those terms were initially specified by 
                the person after the transaction was initiated 
                by the consumer and after the person obtained a 
                consumer report; or
                  (B) the person has provided or will provide a 
                notice to the consumer under subsection (a) in 
                connection with the transaction.
          (4) Other notice not sufficient.--A person that is 
        required to provide a notice under subsection (a) 
        cannot meet that requirement by providing a notice 
        under this subsection.
          (5) Content and delivery of notice.--A notice under 
        this subsection shall, at a minimum--
                  (A) include a statement informing the 
                consumer that the terms offered to the consumer 
                are set based on information from a consumer 
                report;
                  (B) identify the consumer reporting agency 
                furnishing the report;
                  (C) include a statement informing the 
                consumer that the consumer [may obtain] shall 
                receive a copy of a consumer report from that 
                consumer reporting agency without charge;
                  (D) include the contact information specified 
                by that consumer reporting agency for obtaining 
                such consumer reports (including a toll-free 
                telephone number established by the agency in 
                the case of a consumer reporting agency 
                described in section 603(p)); and
                  (E) include a statement informing the 
                consumer of--
                          (i) a numerical credit score as 
                        defined in section 609(f)(2)(A), used 
                        by such person in making the credit 
                        decision described in paragraph (1) 
                        based in whole or in part on any 
                        information in a consumer report; and
                          (ii) the information set forth in 
                        subparagraphs (B) through (E) of 
                        section 609(f)(1).
          (6) Reports provided to consumers.--A person who uses 
        a consumer report as described in paragraph (1) shall 
        notify and direct the consumer reporting agency that 
        provided the consumer report to provide the consumer 
        with the disclosures described in section 612(b).
          [(6)] (7) Rulemaking.--
                  (A) Rules required.--The Bureau shall 
                prescribe rules to carry out this subsection.
                  (B) Content.--Rules required by subparagraph 
                (A) shall address, but are not limited to--
                          (i) the form, content, time, and 
                        manner of delivery of any notice under 
                        this subsection;
                          (ii) clarification of the meaning of 
                        terms used in this subsection, 
                        including what credit terms are 
                        material, and when credit terms are 
                        materially less favorable;
                          (iii) exceptions to the notice 
                        requirement under this subsection for 
                        classes of persons or transactions 
                        regarding which the agencies determine 
                        that notice would not significantly 
                        benefit consumers;
                          (iv) a model notice that may be used 
                        to comply with this subsection; and
                          (v) the timing of the notice required 
                        under paragraph (1), including the 
                        circumstances under which the notice 
                        must be provided after the terms 
                        offered to the consumer were set based 
                        on information from a consumer report.
          [(7)] (8) Compliance.--A person shall not be liable 
        for failure to perform the duties required by this 
        section if, at the time of the failure, the person 
        maintained reasonable policies and procedures to comply 
        with this section.
          [(8)] (9) Enforcement.--
                  (A) No civil actions.--Sections 616 and 617 
                shall not apply to any failure by any person to 
                comply with this [section] subsection
                  (B) Administrative enforcement.--[This 
                section] This subsection shall be enforced 
                exclusively under section 621 by the Federal 
                agencies and officials identified in that 
                section.

Sec. 616. Civil liability for willful noncompliance

  (a)  [In General.--] Damages._Any person who willfully fails 
to comply with any requirement imposed under this title with 
respect to any consumer is liable to that consumer in an amount 
equal to the sum of--
          (1)(A) any actual damages sustained by the consumer 
        as a result of the failure or damages of not less than 
        $100 and not more than $1,000; or
          (B) in the case of liability of a natural person for 
        obtaining a consumer report under false pretenses or 
        knowingly without a permissible purpose, actual damages 
        sustained by the consumer as a result of the failure or 
        $1,000, whichever is greater;
          (2) such amount of punitive damages as the court may 
        allow; and
          (3) in the case of any successful action to enforce 
        any liability under this section, the costs of the 
        action together with reasonable attorney's fees as 
        determined by the court.
  (b) Civil Liability for Knowing Noncompliance.--Any person 
who obtains a consumer report from a consumer reporting agency 
under false pretenses or knowingly without a permissible 
purpose shall be liable to the consumer reporting agency for 
actual damages sustained by the consumer reporting agency or 
$1,000, whichever is greater.
  (c) Injunctive Relief.--
          (1) In general.--In addition to any other remedy 
        under this section, a court may award injunctive relief 
        to require compliance with the requirements imposed 
        under this title with respect to any consumer.
          (2) Attorney's fees.--In the event of any successful 
        action for injunctive relief under this subsection, a 
        court may award to the prevailing party reasonable 
        attorney's fees (as determined by the court) incurred 
        by the prevailing party during the action.
  [(c)] (d) Attorney's Fees.--Upon a finding by the court that 
an unsuccessful pleading, motion, or other paper filed in 
connection with an action under this section was filed in bad 
faith or for purposes of harassment, the court shall award to 
the prevailing party attorney's fees reasonable in relation to 
the work expended in responding to the pleading, motion, or 
other paper.
  [(d)] (e) Clarification of Willful Noncompliance.--For the 
purposes of this section, any person who printed an expiration 
date on any receipt provided to a consumer cardholder at a 
point of sale or transaction between December 4, 2004, and the 
date of the enactment of this subsection but otherwise complied 
with the requirements of section 605(g) for such receipt shall 
not be in willful noncompliance with section 605(g) by reason 
of printing such expiration date on the receipt.

Sec. 617. Civil liability for negligent noncompliance

  [(a) In General.--]
  (a) Damages._
    Any person who is negligent in failing to comply with any 
requirement imposed under this title with respect to any 
consumer is liable to that consumer in an amount equal to the 
sum of--
          (1) any actual damages sustained by the consumer as a 
        result of the failure; and
          (2) in the case of any successful action to enforce 
        any liability under this section, the costs of the 
        action together with reasonable attorney's fees as 
        determined by the court.
  (b) Injunctive Relief.--
          (1) In general.--In addition to any other remedy 
        under this section, a court may award injunctive relief 
        to require compliance with the requirements imposed 
        under this title with respect to any consumer.
          (2) Attorney's fees.--In the event of any successful 
        action for injunctive relief under this subsection, a 
        court may award to the prevailing party reasonable 
        attorney's fees (as determined by the court) incurred 
        by the prevailing party during the action.
  [(b)] (c) Attorney's Fees.--On a finding by the court that an 
unsuccessful pleading, motion, or other paper filed in 
connection with an action under this section was filed in bad 
faith or for purposes of harassment, the court shall award to 
the prevailing party attorney's fees reasonable in relation to 
the work expended in responding to the pleading, motion, or 
other paper.

           *       *       *       *       *       *       *


           *       *       *       *       *       *       *


Sec. 621. Administrative enforcement

  (a) Enforcement by Federal Trade Commission.--
          (1) In general.--The Federal Trade Commission shall 
        be authorized to enforce compliance with the 
        requirements imposed by this title under the Federal 
        Trade Commission Act (15 U.S.C. 41 et seq.), with 
        respect to consumer reporting agencies and all other 
        persons subject thereto, except to the extent that 
        enforcement of the requirements imposed under this 
        title is specifically committed to some other 
        Government agency under any of subparagraphs (A) 
        through (G) of subsection (b)(1), and subject to 
        subtitle B of the Consumer Financial Protection Act of 
        2010, subsection (b). For the purpose of the exercise 
        by the Federal Trade Commission of its functions and 
        powers under the Federal Trade Commission Act, a 
        violation of any requirement or prohibition imposed 
        under this title shall constitute an unfair or 
        deceptive act or practice in commerce, in violation of 
        section 5(a) of the Federal Trade Commission Act (15 
        U.S.C. 45(a)), and shall be subject to enforcement by 
        the Federal Trade Commission under section 5(b) of that 
        Act with respect to any consumer reporting agency or 
        person that is subject to enforcement by the Federal 
        Trade Commission pursuant to this subsection, 
        irrespective of whether that person is engaged in 
        commerce or meets any other jurisdictional tests under 
        the Federal Trade Commission Act. The Federal Trade 
        Commission shall have such procedural, investigative, 
        and enforcement powers, including the power to issue 
        procedural rules in enforcing compliance with the 
        requirements imposed under this title and to require 
        the filing of reports, the production of documents, and 
        the appearance of witnesses, as though the applicable 
        terms and conditions of the Federal Trade Commission 
        Act were part of this title. Any person violating any 
        of the provisions of this title shall be subject to the 
        penalties and entitled to the privileges and immunities 
        provided in the Federal Trade Commission Act as though 
        the applicable terms and provisions of such Act are 
        part of this title.
          (2) Penalties.--
                  (A) Knowing violations.--Except as otherwise 
                provided by subtitle B of the Consumer 
                Financial Protection Act of 2010, in the event 
                of a knowing violation, which constitutes a 
                pattern or practice of violations of this 
                title, the Federal Trade Commission may 
                commence a civil action to recover a civil 
                penalty in a district court of the United 
                States against any person that violates this 
                title. In such action, such person shall be 
                liable for a civil penalty of not more than 
                $2,500 per violation.
                  (B) Determining penalty amount.--In 
                determining the amount of a civil penalty under 
                subparagraph (A), the court shall take into 
                account the degree of culpability, any history 
                of such prior conduct, ability to pay, effect 
                on ability to continue to do business, and such 
                other matters as justice may require.
                  (C) Limitation.--Notwithstanding paragraph 
                (2), a court may not impose any civil penalty 
                on a person for a violation of section 
                623(a)(1), unless the person has been enjoined 
                from committing the violation, or ordered not 
                to commit the violation, in an action or 
                proceeding brought by or on behalf of the 
                Federal Trade Commission, and has violated the 
                injunction or order, and the court may not 
                impose any civil penalty for any violation 
                occurring before the date of the violation of 
                the injunction or order.
  (b) Enforcement by Other Agencies.--
          (1) In general.--Subject to subtitle B of the 
        Consumer Financial Protection Act of 2010, compliance 
        with the requirements imposed under this title with 
        respect to consumer reporting agencies, persons who use 
        consumer reports from such agencies, persons who 
        furnish information to such agencies, and users of 
        information that are subject to section 615(d) shall be 
        enforced under--
                  (A) section 8 of the Federal Deposit 
                Insurance Act (12 U.S.C. 1818), by the 
                appropriate Federal banking agency, as defined 
                in section 3(q) of the Federal Deposit 
                Insurance Act (12 U.S.C. 1813(q)), with respect 
                to--
                          (i) any national bank or State 
                        savings association, and any Federal 
                        branch or Federal agency of a foreign 
                        bank;
                          (ii) any member bank of the Federal 
                        Reserve System (other than a national 
                        bank), a branch or agency of a foreign 
                        bank (other than a Federal branch, 
                        Federal agency, or insured State branch 
                        of a foreign bank), a commercial 
                        lending company owned or controlled by 
                        a foreign bank, and any organization 
                        operating under section 25 or 25A of 
                        the Federal Reserve Act; and
                          (iii) any bank or Federal savings 
                        association insured by the Federal 
                        Deposit Insurance Corporation (other 
                        than a member of the Federal Reserve 
                        System) and any insured State branch of 
                        a foreign bank;
                  (B) the Federal Credit Union Act (12 U.S.C. 
                1751 et seq.), by the Administrator of the 
                National Credit Union Administration with 
                respect to any Federal credit union;
                  (C) subtitle IV of title 49, United States 
                Code, by the Secretary of Transportation, with 
                respect to all carriers subject to the 
                jurisdiction of the Surface Transportation 
                Board;
                  (D) the Federal Aviation Act of 1958 (49 
                U.S.C. App. 1301 et seq.), by the Secretary of 
                Transportation, with respect to any air carrier 
                or foreign air carrier subject to that Act;
                  (E) the Packers and Stockyards Act, 1921 (7 
                U.S.C. 181 et seq.) (except as provided in 
                section 406 of that Act), by the Secretary of 
                Agriculture, with respect to any activities 
                subject to that Act;
                  (F) the Commodity Exchange Act, with respect 
                to a person subject to the jurisdiction of the 
                Commodity Futures Trading Commission;
                  (G) the Federal securities laws, and any 
                other laws that are subject to the jurisdiction 
                of the Securities and Exchange Commission, with 
                respect to a person that is subject to the 
                jurisdiction of the Securities and Exchange 
                Commission; and
                  (H) subtitle E of the Consumer Financial 
                Protection Act of 2010, by the Bureau, with 
                respect to any person subject to this title.
          (2) Incorporated definitions.--The terms used in 
        paragraph (1) that are not defined in this title or 
        otherwise defined in section 3(s) of the Federal 
        Deposit Insurance Act (12 U.S.C. 1813(s)) have the same 
        meanings as in section 1(b) of the International 
        Banking Act of 1978 (12 U.S.C. 3101).
  (c) State Action for Violations.--
          (1) Authority of states.--In addition to such other 
        remedies as are provided under State law, if the chief 
        law enforcement officer of a State, or an official or 
        agency designated by a State, has reason to believe 
        that any person has violated or is violating this 
        title, the State--
                  (A) may bring an action to enjoin such 
                violation in any appropriate United States 
                district court or in any other court of 
                competent jurisdiction;
                  (B) subject to paragraph (5), may bring an 
                action on behalf of the residents of the State 
                to recover--
                          (i) damages for which the person is 
                        liable to such residents under sections 
                        616 and 617 as a result of the 
                        violation;
                          (ii) in the case of a violation 
                        described in any of paragraphs (1) 
                        through (3) of section 623(c), damages 
                        for which the person would, but for 
                        section 623(c), be liable to such 
                        residents as a result of the violation; 
                        or
                          (iii) damages of not more than $1,000 
                        for each willful or negligent 
                        violation; and
                  (C) in the case of any successful action 
                under subparagraph (A) or (B), shall be awarded 
                the costs of the action and reasonable attorney 
                fees as determined by the court.
          (2) Rights of federal regulators.--The State shall 
        serve prior written notice of any action under 
        paragraph (1) upon the Bureau and the Federal Trade 
        Commission or the appropriate Federal regulator 
        determined under subsection (b) and provide the Bureau 
        and the Federal Trade Commission or appropriate Federal 
        regulator with a copy of its complaint, except in any 
        case in which such prior notice is not feasible, in 
        which case the State shall serve such notice 
        immediately upon instituting such action. The Bureau 
        and the Federal Trade Commission or appropriate Federal 
        regulator shall have the right--
                  (A) to intervene in the action;
                  (B) upon so intervening, to be heard on all 
                matters arising therein;
                  (C) to remove the action to the appropriate 
                United States district court; and
                  (D) to file petitions for appeal.
          (3) Investigatory powers.--For purposes of bringing 
        any action under this subsection, nothing in this 
        subsection shall prevent the chief law enforcement 
        officer, or an official or agency designated by a 
        State, from exercising the powers conferred on the 
        chief law enforcement officer or such official by the 
        laws of such State to conduct investigations or to 
        administer oaths or affirmations or to compel the 
        attendance of witnesses or the production of 
        documentary and other evidence.
          (4) Limitation on state action while federal action 
        pending.--If the Bureau, the Federal Trade Commission, 
        or the appropriate Federal regulator has instituted a 
        civil action or an administrative action under section 
        8 of the Federal Deposit Insurance Act for a violation 
        of this title, no State may, during the pendency of 
        such action, bring an action under this section against 
        any defendant named in the complaint of the Bureau, the 
        Federal Trade Commission, or the appropriate Federal 
        regulator for any violation of this title that is 
        alleged in that complaint.
          (5) Limitations on state actions for certain 
        violations.--
                  (A) Violation of injunction required.--A 
                State may not bring an action against a person 
                under paragraph (1)(B) for a violation 
                described in any of paragraphs (1) through (3) 
                of section 623(c), unless--
                          (i) the person has been enjoined from 
                        committing the violation, in an action 
                        brought by the State under paragraph 
                        (1)(A); and
                          (ii) the person has violated the 
                        injunction.
                  (B) Limitation on damages recoverable.--In an 
                action against a person under paragraph (1)(B) 
                for a violation described in any of paragraphs 
                (1) through (3) of section 623(c), a State may 
                not recover any damages incurred before the 
                date of the violation of an injunction on which 
                the action is based.
  (d) For the purpose of the exercise by any agency referred to 
in subsection (b) of its powers under any Act referred to in 
that subsection, a violation of any requirement imposed under 
this title shall be deemed to be a violation of a requirement 
imposed under that Act. In addition to its powers under any 
provision of law specifically referred to in subsection (b), 
each of the agencies referred to in that subsection may 
exercise, for the purpose of enforcing compliance with any 
requirement imposed under this title any other authority 
conferred on it by law.
  (e) Regulatory Authority.--
          (1) In general.--The Bureau shall prescribe such 
        regulations as are necessary to carry out the purposes 
        of this title, except with respect to sections 615(e) 
        and 628. The Bureau may prescribe regulations as may be 
        necessary or appropriate to administer and carry out 
        the purposes and objectives of this title, and to 
        prevent evasions thereof or to facilitate compliance 
        therewith. Except as provided in section 1029(a) of the 
        Consumer Financial Protection Act of 2010, the 
        regulations prescribed by the Bureau under this title 
        shall apply to any person that is subject to this 
        title, notwithstanding the enforcement authorities 
        granted to other agencies under this section.
          (2) Deference.--Notwithstanding any power granted to 
        any Federal agency under this title, the deference that 
        a court affords to a Federal agency with respect to a 
        determination made by such agency relating to the 
        meaning or interpretation of any provision of this 
        title that is subject to the jurisdiction of such 
        agency shall be applied as if that agency were the only 
        agency authorized to apply, enforce, interpret, or 
        administer the provisions of this title The regulations 
        prescribed by the Bureau under this title shall apply 
        to any person that is subject to this title, 
        notwithstanding the enforcement authorities granted to 
        other agencies under this section.
  (f) Coordination of Consumer Complaint Investigations.--
          (1) In general.--Each consumer reporting agency 
        described in section 603(p) shall develop and maintain 
        procedures for the referral to each other such agency 
        of any consumer complaint received by the agency 
        alleging identity theft, or requesting a fraud alert 
        under section 605A or a block under section 605B.
          (2) Model form and procedure for reporting identity 
        theft.--The Commission, in consultation with the 
        Federal Trade Commission, the Federal banking agencies, 
        and the National Credit Union Administration, shall 
        develop a model form and model procedures to be used by 
        consumers who are victims of identity theft for 
        contacting and informing creditors and consumer 
        reporting agencies of the fraud.
          (3) Annual summary reports.--Each consumer reporting 
        agency described in section 603(p) shall submit an 
        annual summary report to the Bureau on consumer 
        complaints received by the agency on identity theft or 
        fraud alerts.
  (g) Bureau Regulation of Coding of Trade Names.--If the 
Bureau determines that a person described in paragraph (9) of 
section 623(a) has not met the requirements of such paragraph, 
the Bureau shall take action to ensure the person's compliance 
with such paragraph, which may include issuing model guidance 
or prescribing reasonable policies and procedures, as necessary 
to ensure that such person complies with such paragraph.
  (h) Consumer Reporting Agency Registry.--
          (1) Establishment of registry.--Not later than 180 
        days after the date of enactment of this subsection, 
        the Bureau shall establish a publicly available 
        registry of consumer reporting agencies that includes--
                  (A) each consumer reporting agency that 
                compiles and maintains files on consumers on a 
                nationwide basis;
                  (B) each nationwide specialty consumer 
                reporting agency;
                  (C) all other consumer reporting agencies 
                that are not included under section 603(p) or 
                603(x); and
                  (D) links to any relevant websites of a 
                consumer reporting agency described under 
                subparagraphs (A) through (C).
          (2) Registration requirement.--The Bureau shall 
        establish a deadline, which shall be not later than 270 
        days after the date of the enactment of this 
        subsection, by which each consumer reporting agency 
        described in paragraph (1) shall be required to 
        register in the registry established under such 
        paragraph.

           *       *       *       *       *       *       *


SEC. 623. RESPONSIBILITIES OF FURNISHERS OF INFORMATION TO CONSUMER 
                    REPORTING AGENCIES.

  (a) Duty of Furnishers of Information To Provide Accurate 
Information.--
          (1) Prohibition.--
                  (A) Reporting information with actual 
                knowledge of errors.--A person shall not 
                furnish any information relating to a consumer 
                to any consumer reporting agency if the person 
                knows or has reasonable cause to believe that 
                the information is inaccurate.
                  (B) Reporting information after notice and 
                confirmation of errors.--A person shall not 
                furnish information relating to a consumer to 
                any consumer reporting agency if--
                          (i) the person has been notified by 
                        the consumer, at the address specified 
                        by the person for such notices, that 
                        specific information is inaccurate; and
                          (ii) the information is, in fact, 
                        inaccurate.
                  (C) No address requirement.--A person who 
                clearly and conspicuously specifies to the 
                consumer an address for notices referred to in 
                subparagraph (B) shall not be subject to 
                subparagraph (A); however, nothing in 
                subparagraph (B) shall require a person to 
                specify such an address.
                  (D) Definition.--For purposes of subparagraph 
                (A), the term ``reasonable cause to believe 
                that the information is inaccurate'' means 
                having specific knowledge, other than solely 
                allegations by the consumer, that would cause a 
                reasonable person to have substantial doubts 
                about the accuracy of the information.
                  (E) Rehabilitation of private education 
                loans.--
                          (i) In general.--Notwithstanding any 
                        other provision of this section, a 
                        consumer may request a financial 
                        institution to remove from a consumer 
                        report a reported default regarding a 
                        private education loan, and such 
                        information shall not be considered 
                        inaccurate, if--
                                  (I) the financial institution 
                                chooses to offer a loan 
                                rehabilitation program which 
                                includes, without limitation, a 
                                requirement of the consumer to 
                                make consecutive on-time 
                                monthly payments in a number 
                                that demonstrates, in the 
                                assessment of the financial 
                                institution offering the loan 
                                rehabilitation program, a 
                                renewed ability and willingness 
                                to repay the loan; and
                                  (II) the requirements of the 
                                loan rehabilitation program 
                                described in subclause (I) are 
                                successfully met.
                          (ii) Banking agencies.--
                                  (I) In general.--If a 
                                financial institution is 
                                supervised by a Federal banking 
                                agency, the financial 
                                institution shall seek written 
                                approval concerning the terms 
                                and conditions of the loan 
                                rehabilitation program 
                                described in clause (i) from 
                                the appropriate Federal banking 
                                agency.
                                  (II) Feedback.--An 
                                appropriate Federal banking 
                                agency shall provide feedback 
                                to a financial institution 
                                within 120 days of a request 
                                for approval under subclause 
                                (I).
                          (iii) Limitation.--
                                  (I) In general.--A consumer 
                                may obtain the benefits 
                                available under this subsection 
                                with respect to rehabilitating 
                                a loan only 1 time per loan.
                                  (II) Rule of construction.--
                                Nothing in this subparagraph 
                                may be construed to require a 
                                financial institution to offer 
                                a loan rehabilitation program 
                                or to remove any reported 
                                default from a consumer report 
                                as a consideration of a loan 
                                rehabilitation program, except 
                                as described in clause (i).
                          (iv) Definitions.--For purposes of 
                        this subparagraph--
                                  (I) the term ``appropriate 
                                Federal banking agency'' has 
                                the meaning given the term in 
                                section 3 of the Federal 
                                Deposit Insurance Act (12 
                                U.S.C. 1813); and
                                  (II) the term ``private 
                                education loan'' has the 
                                meaning given the term in 
                                section 140(a) of the Truth in 
                                Lending Act (15 U.S.C. 
                                1650(a)).
          (2) Duty to correct and update information.--A person 
        who--
                  (A) regularly and in the ordinary course of 
                business furnishes information to one or more 
                consumer reporting agencies about the person's 
                transactions or experiences with any consumer; 
                and
                  (B) has furnished to a consumer reporting 
                agency information that the person determines 
                is not complete or accurate,
        shall promptly notify the consumer reporting agency of 
        that determination and provide to the agency any 
        corrections to that information, or any additional 
        information, that is necessary to make the information 
        provided by the person to the agency complete and 
        accurate, and shall not thereafter furnish to the 
        agency any of the information that remains not complete 
        or accurate.
          (3) Duty to provide notice of dispute.--If the 
        completeness or accuracy of any information furnished 
        by any person to any consumer reporting agency is 
        disputed to such person by a consumer, the person may 
        not furnish the information to any consumer reporting 
        agency without notice that such information is disputed 
        by the consumer.
          (4) Duty to provide notice of closed accounts.--A 
        person who regularly and in the ordinary course of 
        business furnishes information to a consumer reporting 
        agency regarding a consumer who has a credit account 
        with that person shall notify the agency of the 
        voluntary closure of the account by the consumer, in 
        information regularly furnished for the period in which 
        the account is closed.
          (5) Duty to provide notice of delinquency of 
        accounts.--(A) In general.--A person who furnishes 
        information to a consumer reporting agency regarding a 
        delinquent account being placed for collection, charged 
        to profit or loss, or subjected to any similar action 
        shall, not later than 90 days after furnishing the 
        information, notify the agency of the date of 
        delinquency on the account, which shall be the month 
        and year of the commencement of the delinquency on the 
        account that immediately preceded the action.
                  (B) Rule of construction.--For purposes of 
                this paragraph only, and provided that the 
                consumer does not dispute the information, a 
                person that furnishes information on a 
                delinquent account that is placed for 
                collection, charged for profit or loss, or 
                subjected to any similar action, complies with 
                this paragraph, if--
                          (i) the person reports the same date 
                        of delinquency as that provided by the 
                        creditor to which the account was owed 
                        at the time at which the commencement 
                        of the delinquency occurred, if the 
                        creditor previously reported that date 
                        of delinquency to a consumer reporting 
                        agency;
                          (ii) the creditor did not previously 
                        report the date of delinquency to a 
                        consumer reporting agency, and the 
                        person establishes and follows 
                        reasonable procedures to obtain the 
                        date of delinquency from the creditor 
                        or another reliable source and reports 
                        that date to a consumer reporting 
                        agency as the date of delinquency; or
                          (iii) the creditor did not previously 
                        report the date of delinquency to a 
                        consumer reporting agency and the date 
                        of delinquency cannot be reasonably 
                        obtained as provided in clause (ii), 
                        the person establishes and follows 
                        reasonable procedures to ensure the 
                        date reported as the date of 
                        delinquency precedes the date on which 
                        the account is placed for collection, 
                        charged to profit or loss, or subjected 
                        to any similar action, and reports such 
                        date to the credit reporting agency.
          (6) Duties of furnishers upon notice of identity 
        theft-related information.--
                  (A) Reasonable procedures.--A person that 
                furnishes information to any consumer reporting 
                agency shall have in place reasonable 
                procedures to respond to any notification that 
                it receives from a consumer reporting agency 
                under section 605B relating to information 
                resulting from identity theft, to prevent that 
                person from refurnishing such blocked 
                information.
                  (B) Information alleged to result from 
                identity theft.--If a consumer submits an 
                identity theft report to a person who furnishes 
                information to a consumer reporting agency at 
                the address specified by that person for 
                receiving such reports stating that information 
                maintained by such person that purports to 
                relate to the consumer resulted from identity 
                theft, the person may not furnish such 
                information that purports to relate to the 
                consumer to any consumer reporting agency, 
                unless the person subsequently knows or is 
                informed by the consumer that the information 
                is correct.
          (7) Negative information.--
                  (A) Notice to consumer required.--
                          (i) In general.--If any financial 
                        institution that extends credit and 
                        regularly and in the ordinary course of 
                        business furnishes information to a 
                        consumer reporting agency described in 
                        section 603(p) furnishes negative 
                        information to such an agency regarding 
                        credit extended to a customer, the 
                        financial institution shall provide a 
                        notice of such furnishing of negative 
                        information, in writing, to the 
                        customer.
                          (ii) Notice effective for subsequent 
                        submissions.--After providing such 
                        notice, the financial institution may 
                        submit additional negative information 
                        to a consumer reporting agency 
                        described in section 603(p) [with 
                        respect to the same transaction, 
                        extension of credit, account, or 
                        customer without providing additional 
                        notice to the customer.] without 
                        providing additional notice to the 
                        consumer, unless another person 
                        acquires the right to repayment 
                        connected to the additional negative 
                        information. The acquiring person shall 
                        be subject to the requirements of this 
                        paragraph and shall be required to send 
                        consumers the written notices described 
                        in this paragraph, if applicable.
                  (B) Time of notice.--
                          (i) In general.--The notice required 
                        under subparagraph (A) shall be 
                        provided to the customer prior to, or 
                        no later than 30 days after, furnishing 
                        the negative information to a consumer 
                        reporting agency described in section 
                        603(p).
                          (ii) Coordination with new account 
                        disclosures.--If the notice is provided 
                        to the customer prior to furnishing the 
                        negative information to a consumer 
                        reporting agency, the notice may not be 
                        included in the initial disclosures 
                        provided under section 127(a) of the 
                        Truth in Lending Act.
                  (C) Coordination with other disclosures.--The 
                notice required under subparagraph (A)--
                          (i) may be included on or with any 
                        notice of default, any billing 
                        statement, or any other materials 
                        provided to the customer; and
                          (ii) must be clear and conspicuous.
                  (D) Model disclosure.--
                          (i) Duty of bureau.--The Bureau shall 
                        prescribe a brief model disclosure that 
                        a financial institution may use to 
                        comply with subparagraph (A), which 
                        shall not exceed 30 words.
                          (ii) Use of model not required.--No 
                        provision of this paragraph may be 
                        construed to require a financial 
                        institution to use any such model form 
                        prescribed by the Bureau.
                          (iii) Compliance using model.--A 
                        financial institution shall be deemed 
                        to be in compliance with subparagraph 
                        (A) if the financial institution uses 
                        any model form prescribed by the Bureau 
                        under this subparagraph, or the 
                        financial institution uses any such 
                        model form and rearranges its format.
                  (E) Use of notice without submitting negative 
                information.--No provision of this paragraph 
                shall be construed as requiring a financial 
                institution that has provided a customer with a 
                notice described in subparagraph (A) to furnish 
                negative information about the customer to a 
                consumer reporting agency.
                  (F) Safe harbor.--A financial institution 
                shall not be liable for failure to perform the 
                duties required by this paragraph if, at the 
                time of the failure, the financial institution 
                maintained reasonable policies and procedures 
                to comply with this paragraph or the financial 
                institution reasonably believed that the 
                institution is prohibited, by law, from 
                contacting the consumer.
                  (G) Definitions.--For purposes of this 
                paragraph, the following definitions shall 
                apply:
                          (i) Negative information.--The term 
                        ``negative information'' means 
                        information concerning a customer's 
                        delinquencies, late payments, 
                        insolvency, or any form of default.
                          (ii) Customer; financial 
                        institution.--The terms ``customer''and 
                        ``financial institution'' have the same 
                        meanings as in section 509 Public Law 
                        106 102.
          (8) Ability of consumer to dispute information 
        directly with furnisher.--
                  (A) In general.--The Bureau shall, in 
                consultation with the Federal Trade Commission, 
                the Federal banking agencies, and the National 
                Credit Union Administration, prescribe 
                regulations that shall identify the 
                circumstances under which a furnisher shall be 
                required to reinvestigate a dispute concerning 
                the accuracy of information contained in a 
                consumer report on the consumer, based on a 
                direct request of a consumer.
                  (B) Considerations.--In prescribing 
                regulations under subparagraph (A), the 
                agencies shall weigh--
                          (i) the benefits to consumers with 
                        the costs on furnishers and the credit 
                        reporting system;
                          (ii) the impact on the overall 
                        accuracy and integrity of consumer 
                        reports of any such requirements;
                          (iii) whether direct contact by the 
                        consumer with the furnisher would 
                        likely result in the most expeditious 
                        resolution of any such dispute; and
                          (iv) the potential impact on the 
                        credit reporting process if credit 
                        repair organizations, as defined in 
                        section 403(3), including entities that 
                        would be a credit repair organization, 
                        but for section 403(3)(B)(i), are able 
                        to circumvent the prohibition in 
                        subparagraph (G).
                  (C) Applicability.--Subparagraphs (D) through 
                (G) shall apply in any circumstance identified 
                under the regulations promulgated under 
                subparagraph (A).
                  (D) Submitting a notice of dispute.--A 
                consumer who seeks to dispute the accuracy of 
                information shall provide a dispute notice 
                directly to such person at the address 
                specified by the person for such notices that--
                          (i) identifies the specific 
                        information that is being disputed;
                          (ii) explains the basis for the 
                        dispute; and
                          (iii) includes all supporting 
                        documentation required by the furnisher 
                        to substantiate the basis of the 
                        dispute.
                  (E) Duty of person after receiving notice of 
                dispute.--After receiving a notice of dispute 
                from a consumer pursuant to subparagraph (D), 
                the person that provided the information in 
                dispute to a consumer reporting agency shall--
                          (i) conduct an investigation with 
                        respect to the disputed information;
                          (ii) review and consider all relevant 
                        information provided by the consumer 
                        with the notice;
                          (iii) complete such person's 
                        investigation of the dispute and report 
                        the results of the investigation to the 
                        consumer before the expiration of the 
                        period under section 611(a)(1) within 
                        which a consumer reporting agency would 
                        be required to complete its action if 
                        the consumer had elected to dispute the 
                        information under that section; and
                          (iv) if the investigation finds that 
                        the information reported was 
                        inaccurate, promptly notify each 
                        consumer reporting agency to which the 
                        person furnished the inaccurate 
                        information of that determination and 
                        provide to the agency any correction to 
                        that information that is necessary to 
                        make the information provided by the 
                        person accurate.
                  (F) Frivolous or irrelevant dispute.--
                          (i) In general.--This paragraph shall 
                        not apply if the person receiving a 
                        notice of a dispute from a consumer 
                        reasonably determines that the dispute 
                        is frivolous or irrelevant, including--
                                  (I) by reason of the failure 
                                of a consumer to provide 
                                sufficient information to 
                                investigate the disputed 
                                information; or
                                  (II) the submission by a 
                                consumer of a dispute that is 
                                substantially the same as a 
                                dispute previously submitted by 
                                or for the consumer, either 
                                directly to the person or 
                                through a consumer reporting 
                                agency under subsection (b), 
                                with respect to which the 
                                person has already performed 
                                the person's duties under this 
                                paragraph or subsection (b), as 
                                applicable, and does not 
                                include any new or additional 
                                information that would be 
                                relevant to a reinvestigation
                          (ii) Notice of determination.--Upon 
                        making any determination under clause 
                        (i) that a dispute is frivolous or 
                        irrelevant, the person shall notify the 
                        consumer of such determination not 
                        later than 5 business days after making 
                        such determination, by mail or, if 
                        authorized by the consumer for that 
                        purpose, by any other means available 
                        to the person.
                          (iii) Contents of notice.--A notice 
                        under clause (ii) shall include--
                                  (I) the reasons for the 
                                determination under clause (i); 
                                and
                                  (II) identification of any 
                                information required to 
                                investigate the disputed 
                                information, which may consist 
                                of a standardized form 
                                describing the general nature 
                                of such information.
                          (iv) New or additional information.--
                        For purposes of clause (i)(II), the 
                        term ``new or additional 
                        information''--
                                  (I) means information of a 
                                type designated by the Bureau; 
                                and
                                  (II) does not include 
                                information previously provided 
                                to the person.
                  (G) Exclusion of credit repair 
                organizations.--This paragraph shall not apply 
                if the notice of the dispute is submitted by, 
                is prepared on behalf of the consumer by, or is 
                submitted on a form supplied to the consumer 
                by, a credit repair organization, as defined in 
                section 403(3), or an entity that would be a 
                credit repair organization, but for section 
                403(3)(B)(i).
          (9) Duty to provide notice of status as medical 
        information furnisher.--A person whose primary business 
        is providing medical services, products, or devices, or 
        the person's agent or assignee, who furnishes 
        information to a consumer reporting agency on a 
        consumer shall be considered a medical information 
        furnisher for purposes of this title, and shall notify 
        the agency of such status.
  (b) Duties of Furnishers of Information Upon Notice of 
Dispute.--
          (1) In general.--After receiving notice pursuant to 
        section 611(a)(2) of a dispute with regard to the 
        completeness or accuracy of any information provided by 
        a person to a consumer reporting agency, the person 
        shall--
                  (A) conduct an investigation with respect to 
                the disputed information;
                  (B) review and consider all relevant 
                information provided by the consumer reporting 
                agency pursuant to section 611(a)(2);
                  (C) report the results of the investigation 
                to the consumer reporting agency;
                  (D) if the investigation finds that the 
                information is incomplete or inaccurate, report 
                those results to all other consumer reporting 
                agencies to which the person furnished the 
                information and that compile and maintain files 
                on consumers on a nationwide basis; and
                  (E) if an item of information disputed by a 
                consumer is found to be inaccurate or 
                incomplete or cannot be verified after any 
                reinvestigation under paragraph (1), for 
                purposes of reporting to a consumer reporting 
                agency only, as appropriate, based on the 
                results of the reinvestigation promptly--
                          (i) modify that item of information;
                          (ii) delete that item of information; 
                        or
                          (iii) permanently block the reporting 
                        of that item of information.
          (2) Deadline.--A person shall complete all 
        investigations, reviews, and reports required under 
        paragraph (1) regarding information provided by the 
        person to a consumer reporting agency, before the 
        expiration of the period under section 611(a)(1) within 
        which the consumer reporting agency is required to 
        complete actions required by that section regarding 
        that information.
  (c) Limitation on Liability.--Except as provided in section 
621(c)(1)(B), sections 616 and 617 do not apply to any 
violation of--
          (1) subsection (a) of this section, including any 
        regulations issued thereunder;
          (2) subsection (e) of this section, except that 
        nothing in this paragraph shall limit, expand, or 
        otherwise affect liability under section 616 or 617, as 
        applicable, for violations of subsection (b) of this 
        section; or
          (3) subsection (e) of section 615.
  (d) Limitation on Enforcement.--The provisions of law 
described in paragraphs (1) through (3) of subsection (c) 
(other than with respect to the exception described in 
paragraph (2) of subsection (c)) shall be enforced exclusively 
as provided under section 621 by the Federal agencies and 
officials and the State officials identified in section 621.
  (e) Accuracy Guidelines and Regulations Required.--
          (1) Guidelines.--The Bureau shall, with respect to 
        persons or entities that are subject to the enforcement 
        authority of the Bureau under section 621--
                  (A) establish and maintain guidelines for use 
                by each person that furnishes information to a 
                consumer reporting agency regarding the 
                accuracy and integrity of the information 
                relating to consumers that such entities 
                furnish to consumer reporting agencies, and 
                update such guidelines as often as necessary; 
                and
                  (B) prescribe regulations requiring each 
                person that furnishes information to a consumer 
                reporting agency to establish reasonable 
                policies and procedures for implementing the 
                guidelines established pursuant to subparagraph 
                (A).
          (2) Criteria.--In developing the guidelines required 
        by paragraph (1)(A), the Bureau shall--
                  (A) identify patterns, practices, and 
                specific forms of activity that can compromise 
                the accuracy and integrity of information 
                furnished to consumer reporting agencies;
                  (B) review the methods (including 
                technological means) used to furnish 
                information relating to consumers to consumer 
                reporting agencies;
                  (C) determine whether persons that furnish 
                information to consumer reporting agencies 
                maintain and enforce policies to ensure the 
                accuracy and integrity of information furnished 
                to consumer reporting agencies; and
                  (D) examine the policies and processes that 
                persons that furnish information to consumer 
                reporting agencies employ to conduct 
                reinvestigations and correct inaccurate 
                information relating to consumers that has been 
                furnished to consumer reporting agencies.

           *       *       *       *       *       *       *

                              ----------                              


       DODD-FRANK WALL STREET REFORM AND CONSUMER PROTECTION ACT



           *       *       *       *       *       *       *
TITLE X--BUREAU OF CONSUMER FINANCIAL PROTECTION

           *       *       *       *       *       *       *


Subtitle B--General Powers of the Bureau

           *       *       *       *       *       *       *


SEC. 1024. SUPERVISION OF NONDEPOSITORY COVERED PERSONS.

  (a) Scope of Coverage.--
          (1) Applicability.--Notwithstanding any other 
        provision of this title, and except as provided in 
        paragraph (3), this section shall apply to any covered 
        person who--
                  (A) offers or provides origination, 
                brokerage, or servicing of loans secured by 
                real estate for use by consumers primarily for 
                personal, family, or household purposes, or 
                loan modification or foreclosure relief 
                services in connection with such loans;
                  (B) is a larger participant of a market for 
                other consumer financial products or services, 
                as defined by rule in accordance with paragraph 
                (2);
                  (C) the Bureau has reasonable cause to 
                determine, by order, after notice to the 
                covered person and a reasonable opportunity for 
                such covered person to respond, based on 
                complaints collected through the system under 
                section 1013(b)(3) or information from other 
                sources, that such covered person is engaging, 
                or has engaged, in conduct that poses risks to 
                consumers with regard to the offering or 
                provision of consumer financial products or 
                services;
                  (D) offers or provides to a consumer any 
                private education loan, as defined in section 
                140 of the Truth in Lending Act (15 U.S.C. 
                1650), notwithstanding section 1027(a)(2)(A) 
                and subject to section 1027(a)(2)(C); [or]
                  (E) offers or provides to a consumer a payday 
                loan[.]; or
                  (F) is a consumer reporting agency described 
                under section 603(p) of the Fair Credit 
                Reporting Act.
          (2) Rulemaking to define covered persons subject to 
        this section.--The Bureau shall consult with the 
        Federal Trade Commission prior to issuing a rule, in 
        accordance with paragraph (1)(B), to define covered 
        persons subject to this section. The Bureau shall issue 
        its initial rule not later than 1 year after the 
        designated transfer date.
          (3) Rules of construction.--
                  (A) Certain persons excluded.--This section 
                shall not apply to persons described in section 
                1025(a) or 1026(a).
                  (B) Activity levels.--For purposes of 
                computing activity levels under paragraph (1) 
                or rules issued thereunder, activities of 
                affiliated companies (other than insured 
                depository institutions or insured credit 
                unions) shall be aggregated.
  (b) Supervision.--
          (1) In general.--The Bureau shall require reports and 
        conduct examinations on a periodic basis of persons 
        described in subsection (a)(1) for purposes of--
                  (A) assessing compliance with the 
                requirements of Federal consumer financial law;
                  (B) obtaining information about the 
                activities and compliance systems or procedures 
                of such person; and
                  (C) detecting and assessing risks to 
                consumers and to markets for consumer financial 
                products and services.
          (2) Risk-based supervision program.--The Bureau shall 
        exercise its authority under paragraph (1) in a manner 
        designed to ensure that such exercise, with respect to 
        persons described in subsection (a)(1), is based on the 
        assessment by the Bureau of the risks posed to 
        consumers in the relevant product markets and 
        geographic markets, and taking into consideration, as 
        applicable--
                  (A) the asset size of the covered person;
                  (B) the volume of transactions involving 
                consumer financial products or services in 
                which the covered person engages;
                  (C) the risks to consumers created by the 
                provision of such consumer financial products 
                or services;
                  (D) the extent to which such institutions are 
                subject to oversight by State authorities for 
                consumer protection; and
                  (E) any other factors that the Bureau 
                determines to be relevant to a class of covered 
                persons.
          (3) Coordination.--To minimize regulatory burden, the 
        Bureau shall coordinate its supervisory activities with 
        the supervisory activities conducted by prudential 
        regulators, the State bank regulatory authorities, and 
        the State agencies that licence, supervise, or examine 
        the offering of consumer financial products or 
        services, including establishing their respective 
        schedules for examining persons described in subsection 
        (a)(1) and requirements regarding reports to be 
        submitted by such persons. The sharing of information 
        with such regulators, authorities, and agencies shall 
        not be construed as waiving, destroying, or otherwise 
        affecting any privilege or confidentiality such person 
        may claim with respect to such information under 
        Federal or State law as to any person or entity other 
        than such Bureau, agency, supervisor, or authority.
          (4) Use of existing reports.--The Bureau shall, to 
        the fullest extent possible, use--
                  (A) reports pertaining to persons described 
                in subsection (a)(1) that have been provided or 
                required to have been provided to a Federal or 
                State agency; and
                  (B) information that has been reported 
                publicly.
          (5) Preservation of authority.--Nothing in this title 
        may be construed as limiting the authority of the 
        Director to require reports from persons described in 
        subsection (a)(1), as permitted under paragraph (1), 
        regarding information owned or under the control of 
        such person, regardless of whether such information is 
        maintained, stored, or processed by another person.
          (6) Reports of tax law noncompliance.--The Bureau 
        shall provide the Commissioner of Internal Revenue with 
        any report of examination or related information 
        identifying possible tax law noncompliance.
          (7) Registration, recordkeeping and other 
        requirements for certain persons.--
                  (A) In general.--The Bureau shall prescribe 
                rules to facilitate supervision of persons 
                described in subsection (a)(1) and assessment 
                and detection of risks to consumers.
                  (B) Recordkeeping.--The Bureau may require a 
                person described in subsection (a)(1), to 
                generate, provide, or retain records for the 
                purposes of facilitating supervision of such 
                persons and assessing and detecting risks to 
                consumers.
                  (C) Requirements concerning obligations.--The 
                Bureau may prescribe rules regarding a person 
                described in subsection (a)(1), to ensure that 
                such persons are legitimate entities and are 
                able to perform their obligations to consumers. 
                Such requirements may include background checks 
                for principals, officers, directors, or key 
                personnel and bonding or other appropriate 
                financial requirements.
                  (D) Consultation with state agencies.--In 
                developing and implementing requirements under 
                this paragraph, the Bureau shall consult with 
                State agencies regarding requirements or 
                systems (including coordinated or combined 
                systems for registration), where appropriate.
  (c) Enforcement Authority.--
          (1) The bureau to have enforcement authority.--Except 
        as provided in paragraph (3) and section 1061, with 
        respect to any person described in subsection (a)(1), 
        to the extent that Federal law authorizes the Bureau 
        and another Federal agency to enforce Federal consumer 
        financial law, the Bureau shall have exclusive 
        authority to enforce that Federal consumer financial 
        law.
          (2) Referral.--Any Federal agency authorized to 
        enforce a Federal consumer financial law described in 
        paragraph (1) may recommend in writing to the Bureau 
        that the Bureau initiate an enforcement proceeding, as 
        the Bureau is authorized by that Federal law or by this 
        title.
          (3) Coordination with the federal trade commission.--
                  (A) In general.--The Bureau and the Federal 
                Trade Commission shall negotiate an agreement 
                for coordinating with respect to enforcement 
                actions by each agency regarding the offering 
                or provision of consumer financial products or 
                services by any covered person that is 
                described in subsection (a)(1), or service 
                providers thereto. The agreement shall include 
                procedures for notice to the other agency, 
                where feasible, prior to initiating a civil 
                action to enforce any Federal law regarding the 
                offering or provision of consumer financial 
                products or services.
                  (B) Civil actions.--Whenever a civil action 
                has been filed by, or on behalf of, the Bureau 
                or the Federal Trade Commission for any 
                violation of any provision of Federal law 
                described in subparagraph (A), or any 
                regulation prescribed under such provision of 
                law--
                          (i) the other agency may not, during 
                        the pendency of that action, institute 
                        a civil action under such provision of 
                        law against any defendant named in the 
                        complaint in such pending action for 
                        any violation alleged in the complaint; 
                        and
                          (ii) the Bureau or the Federal Trade 
                        Commission may intervene as a party in 
                        any such action brought by the other 
                        agency, and, upon intervening--
                                  (I) be heard on all matters 
                                arising in such enforcement 
                                action; and
                                  (II) file petitions for 
                                appeal in such actions.
                  (C) Agreement terms.--The terms of any 
                agreement negotiated under subparagraph (A) may 
                modify or supersede the provisions of 
                subparagraph (B).
                  (D) Deadline.--The agencies shall reach the 
                agreement required under subparagraph (A) not 
                later than 6 months after the designated 
                transfer date.
  (d) Exclusive Rulemaking and Examination Authority.--
Notwithstanding any other provision of Federal law and except 
as provided in section 1061, to the extent that Federal law 
authorizes the Bureau and another Federal agency to issue 
regulations or guidance, conduct examinations, or require 
reports from a person described in subsection (a)(1) under such 
law for purposes of assuring compliance with Federal consumer 
financial law and any regulations thereunder, the Bureau shall 
have the exclusive authority to prescribe rules, issue 
guidance, conduct examinations, require reports, or issue 
exemptions with regard to a person described in subsection 
(a)(1), subject to those provisions of law.
  (e) Service Providers.--A service provider to a person 
described in subsection (a)(1) shall be subject to the 
authority of the Bureau under this section, to the same extent 
as if such service provider were engaged in a service 
relationship with a bank, and the Bureau were an appropriate 
Federal banking agency under section 7(c) of the Bank Service 
Company Act (12 U.S.C. 1867(c)). In conducting any examination 
or requiring any report from a service provider subject to this 
subsection, the Bureau shall coordinate with the appropriate 
prudential regulator, as applicable.
  (f) Preservation of Farm Credit Administration Authority.--No 
provision of this title may be construed as modifying, 
limiting, or otherwise affecting the authority of the Farm 
Credit Administration.

           *       *       *       *       *       *       *

                              ----------                              


                         GRAMM-LEACH-BLILEY ACT



           *       *       *       *       *       *       *
                            TITLE V--PRIVACY

        Subtitle A--Disclosure of Nonpublic Personal Information

SEC. 501. PROTECTION OF NONPUBLIC PERSONAL INFORMATION.

  (a) Privacy Obligation Policy.--It is the policy of the 
Congress that each financial institution has an affirmative and 
continuing obligation to respect the privacy of its customers 
and to protect the security and confidentiality of those 
customers' nonpublic personal information.
  (b) Financial Institutions Safeguards.--In furtherance of the 
policy in subsection (a), each agency or authority described in 
section 505(a), other than the Bureau of Consumer Financial 
Protection, shall establish appropriate standards for the 
financial institutions subject to their jurisdiction relating 
to administrative, technical, and physical safeguards--
          (1) to insure the security and confidentiality of 
        customer records and information;
          (2) to protect against any anticipated threats or 
        hazards to the security or integrity of such records; 
        and
          (3) to protect against unauthorized access to or use 
        of such records or information which could result in 
        substantial harm or inconvenience to any customer.
  (c) Consumer Reporting Agency Safeguards.--The Bureau of 
Consumer Financial Protection shall establish, by rule, 
appropriate standards for consumer reporting agencies described 
under section 603(p) of the Fair Credit Reporting Act relating 
to administrative, technical, and physical safeguards to 
protect records and information as described in paragraphs (1) 
through (3) of subsection (b).

           *       *       *       *       *       *       *


SEC. 504. RULEMAKING.

  (a) Regulatory Authority.--
          (1) Rulemaking.--
                  (A) In general.--Except as provided in 
                subparagraph (C), the Bureau of Consumer 
                Financial Protection and the Securities and 
                Exchange Commission shall have authority to 
                prescribe such regulations as may be necessary 
                to carry out the purposes of this subtitle with 
                respect to financial institutions and other 
                persons subject to their respective 
                jurisdiction under section 505 (and 
                notwithstanding subtitle B of the Consumer 
                Financial Protection Act of 2010)[, except that 
                the Bureau of Consumer Financial Protection 
                shall not have authority to prescribe 
                regulations with respect to the standards under 
                section 501].
                  (B) CFTC.--The Commodity Futures Trading 
                Commission shall have authority to prescribe 
                such regulations as may be necessary to carry 
                out the purposes of this subtitle with respect 
                to financial institutions and other persons 
                subject to the jurisdiction of the Commodity 
                Futures Trading Commission under section 5g of 
                the Commodity Exchange Act.
                  (C) Federal trade commission authority.--
                Notwithstanding the authority of the Bureau of 
                Consumer Financial Protection under 
                subparagraph (A), the Federal Trade Commission 
                shall have authority to prescribe such 
                regulations as may be necessary to carry out 
                the purposes of this subtitle with respect to 
                any financial institution that is a person 
                described in section 1029(a) of the Consumer 
                Financial Protection Act of 2010.
                  (D) Rule of construction.--Nothing in this 
                paragraph shall be construed to alter, affect, 
                or otherwise limit the authority of a State 
                insurance authority to adopt regulations to 
                carry out this subtitle.
          (2) Coordination, consistency, and comparability.--
        Each of the agencies authorized under paragraph (1) to 
        prescribe regulations shall consult and coordinate with 
        the other such agencies and, as appropriate, and with 
        representatives of State insurance authorities 
        designated by the National Association of Insurance 
        Commissioners, for the purpose of assuring, to the 
        extent possible, that the regulations prescribed by 
        each such agency are consistent and comparable with the 
        regulations prescribed by the other such agencies.
          (3) Procedures and deadline.--Such regulations shall 
        be prescribed in accordance with applicable 
        requirements of title 5, United States Code.
  (b) Authority To Grant Exceptions.--The regulations 
prescribed under subsection (a) may include such additional 
exceptions to subsections (a) through (d) of section 502 as are 
deemed consistent with the purposes of this subtitle.

SEC. 505. ENFORCEMENT.

  (a) In General.--Subject to subtitle B of the Consumer 
Financial Protection Act of 2010, this subtitle and the 
regulations prescribed thereunder shall be enforced by the 
Bureau of Consumer Financial Protection, the Federal functional 
regulators, the State insurance authorities, and the Federal 
Trade Commission with respect to financial institutions and 
other persons subject to their jurisdiction under applicable 
law, as follows:
          (1) Under section 8 of the Federal Deposit Insurance 
        Act, by the appropriate Federal banking agency, as 
        defined in section 3(q) of the Federal Deposit 
        Insurance Act, in the case of--
                  (A) national banks, Federal branches and 
                Federal agencies of foreign banks, and any 
                subsidiaries of such entities (except brokers, 
                dealers, persons providing insurance, 
                investment companies, and investment advisers);
                  (B) member banks of the Federal Reserve 
                System (other than national banks), branches 
                and agencies of foreign banks (other than 
                Federal branches, Federal agencies, and insured 
                State branches of foreign banks), commercial 
                lending companies owned or controlled by 
                foreign banks, organizations operating under 
                section 25 or 25A of the Federal Reserve Act, 
                and bank holding companies and their nonbank 
                subsidiaries or affiliates (except brokers, 
                dealers, persons providing insurance, 
                investment companies, and investment advisers);
                  (C) banks insured by the Federal Deposit 
                Insurance Corporation (other than members of 
                the Federal Reserve System), insured State 
                branches of foreign banks, and any subsidiaries 
                of such entities (except brokers, dealers, 
                persons providing insurance, investment 
                companies, and investment advisers); and
                  (D) savings associations the deposits of 
                which are insured by the Federal Deposit 
                Insurance Corporation, and any subsidiaries of 
                such savings associations (except brokers, 
                dealers, persons providing insurance, 
                investment companies, and investment advisers).
          (2) Under the Federal Credit Union Act, by the Board 
        of the National Credit Union Administration with 
        respect to any federally insured credit union, and any 
        subsidiaries of such an entity.
          (3) Under the Securities Exchange Act of 1934, by the 
        Securities and Exchange Commission with respect to any 
        broker or dealer.
          (4) Under the Investment Company Act of 1940, by the 
        Securities and Exchange Commission with respect to 
        investment companies.
          (5) Under the Investment Advisers Act of 1940, by the 
        Securities and Exchange Commission with respect to 
        investment advisers registered with the Commission 
        under such Act.
          (6) Under State insurance law, in the case of any 
        person engaged in providing insurance, by the 
        applicable State insurance authority of the State in 
        which the person is domiciled, subject to section 104 
        of this Act.
          (7) Under the Federal Trade Commission Act, by the 
        Federal Trade Commission for any other financial 
        institution or other person that is not subject to the 
        jurisdiction of any agency or authority under 
        paragraphs (1) through (6) of this subsection.
          (8) Under subtitle E of the Consumer Financial 
        Protection Act of 2010, by the Bureau of Consumer 
        Financial Protection, in the case of any financial 
        institution and other covered person or service 
        provider that is subject to the jurisdiction of the 
        Bureau and any person subject to this subtitle, but not 
        with respect to the standards under section 501, other 
        than under subsection (c) of section 501
  (b) Enforcement of Section 501.--
          (1) In general.--Except as provided in paragraph (2), 
        the agencies and authorities described in subsection 
        (a), other than the Bureau of Consumer Financial 
        Protection, shall implement the standards prescribed 
        under section 501(b) in the same manner, to the extent 
        practicable, as standards prescribed pursuant to 
        section 39(a) of the Federal Deposit Insurance Act are 
        implemented pursuant to such section.
          (2) Exception.--The agencies and authorities 
        described in paragraphs (3), (4), (5), (6), and (7) of 
        subsection (a) shall implement the standards prescribed 
        under section 501(b) by rule with respect to the 
        financial institutions and other persons subject to 
        their respective jurisdictions under subsection (a).
  (c) Absence of State Action.--If a State insurance authority 
fails to adopt regulations to carry out this subtitle, such 
State shall not be eligible to override, pursuant to section 
47(g)(2)(B)(iii) of the Federal Deposit Insurance Act, the 
insurance customer protection regulations prescribed by a 
Federal banking agency under section 47(a) of such Act.
  (d) Definitions.--The terms used in subsection (a)(1) that 
are not defined in this subtitle or otherwise defined in 
section 3(s) of the Federal Deposit Insurance Act shall have 
the same meaning as given in section 1(b) of the International 
Banking Act of 1978.

           *       *       *       *       *       *       *


                             MINORITY VIEWS

    American families should have the very best in modern 
technology to protect their consumer data and personal 
information. H.R. 5332 is a step backward. This bill is overly 
prescriptive and has the potential to jeopardize a consumer's 
personal information through the bill's reliance on Social 
Security numbers (SSNs) and lack of strong cybersecurity 
protections.
    Committee Republicans have consistently expressed concern 
that the private sector and government rely on SSNs for 
identity verification. H.R. 5332 expands reliance on SSNs, 
which are no longer wholly confidential.
           H.R. 5332 requires credit reporting agencies 
        to match all nine digits of a consumer's SSN before 
        including any information in a consumer credit report--
        prohibiting valuable and otherwise accurate information 
        from being included in a consumer's credit file and 
        creating additional pressure to expand the collection 
        of consumer SSNs.
    The bill also continues the Democrats' goal of expanding 
the Consumer Financial Protection Bureau's (CFPB) unchecked 
power.
           This bill directs the CFPB to establish 
        ``administrative, technical, and physical safeguards,'' 
        for all credit reporting agencies. This responsibility 
        is currently directed to prudential regulators under 
        the Gramm-Leach-Bliley Act.\1\
---------------------------------------------------------------------------
    \1\https://docs.house.gov/meetings/BA/BA00/20191210/110323/BILLS-
116-HR_-G000583-Amdt-6.pdf.
---------------------------------------------------------------------------
           The Democrats would create a new ombudsman 
        within the CFPB allowing that person to make 
        recommendations directly to the Bureau's Office of 
        Enforcement and Office of Supervision for enforcement 
        action.
    During Committee consideration of the bill, Ranking Member 
Patrick McHenry (R-NC) offered an amendment which would have 
subjected the nationwide credit reporting agencies to 
cybersecurity supervision and examination by the CFPB.
           The amendment would have prohibited the use 
        of SSNs in credit reports or as a method of verifying a 
        consumer's identity.
           Democrats rejected this amendment on a 
        party-line vote of 24-31.
    H.R. 5332 is another attempt by Committee Democrats to 
expand the power of an unaccountable unconstitutional agency. 
Moreover, the bill jeopardizes consumers' personal information 
by expanding reliance on SSNs. Finally, the bill does nothing 
to address the longstanding cybersecurity concerns with credit 
reporting.
    For these reasons, Committee Republicans oppose H.R. 5332.

                                   Roger Williams.
                                   Barry Loudermilk.
                                   Trey Hollingsworth.
                                   Lance Gooden.
                                   David Kustoff.
                                   William R. Timmons, IV.
                                   Scott R. Tipton.
                                   Warren Davidson.
                                   Denver Riggleman.
                                   Andy Barr.
                                   Ann Wagner.
                                   Blaine Luetkemeyer.
                                   Alexander X. Mooney.
                                   John W. Rose.
                                   Steve Stivers.
                                   J. French Hill.
                                   Van Taylor.
                                   Tom Emmer.
                                   Ted Budd.
                                   Bryan Steil.
                                   Anthony Gonzalez.
                                   Frank D. Lucas.
                                   Lee M. Zeldin.
                                   Bill Huizenga.
                                   Bill Posey.
                                   Patrick T. McHenry.

                                  [all]