[House Report 116-635]
[From the U.S. Government Publishing Office]


116th Congress }                                          { Report
                        HOUSE OF REPRESENTATIVES
  2d Session   }                                          { 116-635

======================================================================
 
       PROTECTING INNOCENT CONSUMERS AFFECTED BY A SHUTDOWN ACT

                                _______
                                

December 8, 2020.--Committed to the Committee of the Whole House on the 
              State of the Union and ordered to be printed

                                _______
                                

  Ms. Waters, from the Committee on Financial Services, submitted the 
                               following

                              R E P O R T

                             together with

                             MINORITY VIEWS

                        [To accompany H.R. 4328]

      [Including cost estimate of the Congressional Budget Office]

    The Committee on Financial Services, to whom was referred 
the bill (H.R. 4328) to amend the Fair Credit Reporting Act to 
protect certain consumers affected by a shutdown, and for other 
purposes, having considered the same, reports favorably thereon 
with an amendment and recommends that the bill as amended do 
pass.

                                CONTENTS

                                                                   Page
Purpose and Summary..............................................     3
Background and Need for Legislation..............................     3
Section-by-Section Analysis......................................     4
Hearings.........................................................     6
Committee Consideration..........................................     6
Committee Votes..................................................     6
Statement of Oversight Findings and Recommendations of the 
  Committee......................................................    10
Statement of Performance Goals and Objectives....................    10
New Budget Authority and CBO Cost Estimate.......................    10
Committee Cost Estimate..........................................    13
Unfunded Mandate Statement.......................................    13
Advisory Committee...............................................    13
Application of Law to the Legislative Branch.....................    13
Earmark Statement................................................    13
Duplication of Federal Programs..................................    13
Changes to Existing Law..........................................    14

    The amendment is as follows:
  Strike all after the enacting clause and insert the 
following:

SECTION 1. SHORT TITLE.

  This Act may be cited as the ``Protecting Innocent Consumers Affected 
by a Shutdown Act''.

SEC. 2. DEFINITIONS.

  Section 603 of the Fair Credit Reporting Act (15 U.S.C. 1681a), as 
amended by section 302(b)(1) of the Economic Growth, Regulatory Relief, 
and Consumer Protection Act (Public Law 115-174), is amended by adding 
at the end the following:
  ``(bb) Employee Affected by a Shutdown.--With respect to a shutdown, 
the term `employee affected by a shutdown' means a consumer who--
          ``(1) is an employee of--
                  ``(A) the Federal Government, and who is furloughed 
                or excepted from a furlough during the shutdown;
                  ``(B) the District of Columbia, and who is not 
                receiving pay because of the shutdown; or
                  ``(C) a Federal contractor (as defined under section 
                7101 of title 41, United States Code) or other 
                business, and who has experienced a substantial 
                reduction in pay (directly or indirectly) due to the 
                shutdown; and
          ``(2) who--
                  ``(A) is listed in the database established under 
                section 630; or
                  ``(B) has self-certified pursuant to such section.
  ``(cc) Shutdown.--The term `shutdown' means any period in which there 
is more than a 24-hour lapse in appropriations as a result of a failure 
to enact a regular appropriations bill or continuing resolution.
  ``(dd) Covered Shutdown Period.--The term `covered shutdown period' 
means, with respect to a shutdown, the period beginning on the first 
day of the shutdown and ending on the date that is 90 days after the 
last day of the shutdown.''.

SEC. 3. EXCLUSION FOR EMPLOYEES AFFECTED BY A SHUTDOWN.

  Section 605(a) of the Fair Credit Reporting Act (15 U.S.C. 1681c(a)), 
as amended by section 302(b)(2) of the Economic Growth, Regulatory 
Relief, and Consumer Protection Act (Public Law 115-174), is amended by 
adding at the end the following:
          ``(9) Any adverse item of information with respect to an 
        action or inaction taken during a covered shutdown period by an 
        employee affected by a shutdown.''.

SEC. 4. AMENDMENT TO SUMMARY OF RIGHTS FOR EMPLOYEES AFFECTED BY A 
                    SHUTDOWN.

  Section 609(a) of the Fair Credit Reporting Act (15 U.S.C. 1681g(a)) 
is amended by adding at the end the following:
          ``(7) Information on the rights of an employee affected by a 
        shutdown, including which consumers may be an employee affected 
        by a shutdown and the process for a consumer to self-certify as 
        an employee affected by a shutdown under section 630.''.

SEC. 5. DATABASE AND SELF-CERTIFICATION FOR EMPLOYEES AFFECTED BY A 
                    SHUTDOWN.

  (a) In General.--The Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.) is amended by adding at the end the following new section:

``Sec. 630. Database and self-certification for employees affected by a 
                    shutdown

  ``(a) Database.--
          ``(1) In general.--With respect to each shutdown, the 
        consumer reporting agencies described in section 603(p) shall 
        jointly establish a database that includes employees affected 
        by the shutdown as reported pursuant to paragraph (2).
          ``(2) Contents of database.--
                  ``(A) Furloughed employees and contractors.--Each 
                authority of the executive, legislative, or judicial 
                branch of the Federal Government or District of 
                Columbia shall provide to the consumer reporting 
                agencies described in section 603(p) a list 
                identifying--
                          ``(i) employees of such authority that are 
                        furloughed, excepted from furlough, or not 
                        receiving pay because of a shutdown; and
                          ``(ii) to the extent practicable, employees 
                        of contractors of such authority.
                  ``(B) Self-certified consumers.--A consumer that 
                self-certifies as an employee affected by a shutdown 
                pursuant to subsection (b) shall be included in the 
                database, unless the Bureau determines such consumer is 
                not an employee affected by a shutdown.
          ``(3) Access to database.--The consumer reporting agencies 
        described in section 603(p) shall make the database established 
        under this subsection available to the Bureau, other consumer 
        reporting agencies, furnishers of information to consumer 
        reporting agencies, and users of consumer reports. A consumer 
        reporting agency described in section 603(x) shall periodically 
        access the database to confirm the accuracy of information such 
        an agency has that identifies a consumer as an employee 
        affected by a shutdown.
  ``(b) Self-certification Process.--A consumer shall be deemed to be a 
employee affected by a shutdown if such consumer self-certifies 
through--
          ``(1) the website established under subsection (c); or
          ``(2) a toll-free telephone number established by a consumer 
        reporting agency.
  ``(c) Website.--The consumer reporting agencies described in section 
603(p) shall jointly establish a website for a consumer to self-certify 
as an employee affected by a shutdown. Such website may not include any 
advertisement or other solicitation.''.
  (b) Table of Contents Amendment.--The table of contents of the Fair 
Credit Reporting Act is amended by adding at the end the following new 
item:

``630. Database and self-certification for employees affected by a 
shutdown.''.

SEC. 6. PROHIBITION ON ADVERSE ACTIONS AGAINST EMPLOYEES AFFECTED BY A 
                    SHUTDOWN.

  Section 604 of the Fair Credit Reporting Act (15 U.S.C. 1681b) is 
amended by adding at the end the following:
  ``(h) Prohibition on Adverse Actions Against Employees Affected by a 
Shutdown.--If a user of a consumer report knows that a consumer is an 
employee affected by a shutdown, such user may not take an adverse 
action based on--
          ``(1) any adverse item of information contained in such 
        report with respect to an action or inaction taken during a 
        covered shutdown period by the employee; or
          ``(2) information on the consumer included in the database 
        established under section 630.''.

SEC. 7. BUREAU REGULATIONS OR GUIDANCE.

  Not later than 30 days after the date of the enactment of this Act, 
the Bureau of Consumer Financial Protection shall issue rules or 
guidance, as appropriate, to carry out the requirements of this Act.

                          Purpose and Summary

    On September 13, 2019, Chairwoman Maxine Waters introduced 
H.R. 4328, the ``Protecting Innocent Consumers Affected by a 
Shutdown Act,'' which amends the Fair Credit Reporting Act to 
protect government employees, contractors, and other consumers 
affected by a Federal government shutdown. H.R. 4328 restricts 
``furnishers'' and the credit rating agencies from including 
any adverse financial information resulting from a government 
shutdown in the affected consumers' credit profiles for the 
duration of a shutdown, plus 90 days. H.R. 4328 also prohibits 
banks, employers and other users of consumer reports from 
considering adverse credit information regarding such consumers 
from the applicable period.

                  Background and Need for Legislation

    At the end of last Congress, President Trump shut the 
government down for 35 days, the longest shutdown in U.S. 
history, resulting in missed paychecks for countless government 
employees, as well as contractors and businesses that rely on 
the government. During that time, approximately 800,000 
federally employees were partially or fully furloughed and 
about four million federal contractors were affected. Many of 
these consumers found it hard to make essential housing or 
consumer payments when their income was temporarily limited. 
The shutdown directly affecting nearly 3 percent of the entire 
U.S. labor force. The Congressional Budget Office estimated the 
shutdown cost the American economy $11 billion, and delayed 
approximately $18 billion in federal discretionary spending for 
compensation and purchases of goods and services.
    During the shutdown, Chairwoman Maxine Waters wrote to the 
heads of financial services industry trade associations and the 
largest credit reporting agencies to ask them to describe what 
their institutions and member companies were doing to help 
consumers affected by the Trump shutdown. Rep. Waters reminded 
these companies that these affected employees, contractors, and 
other individuals did not cause the shutdown and should not 
suffer any adverse consequences from these circumstances. These 
individuals who experienced a loss of income during the 
government shutdown may have been unable to make payments on 
debts such as mortgages, student loans, car loans, business 
loans, or credit cards. And, as a result, their credit scores 
and reports, which are increasingly relied upon by creditors, 
employers, insurers, and even law enforcement would be 
negatively affected through no fault of their own.
    Current law does not provide for assistance to Federal 
employees, contractors and other consumers negatively affected 
by a Federal government shutdown. H.R. 4328, by establishing a 
mechanism to prevent credit reporting agencies from including 
any adverse financial information that occurs during the 
shutdown or within 90 days thereafter, would provide consumer 
relief and certainty to affected workers. To help affected 
consumers, H.R. 4328 restricts the persons and companies who 
provide financial information, known as ``furnishers'' and the 
credit rating agencies from including adverse financial 
information resulting from a government shutdown in the 
affected consumers' credit profiles for the duration of a 
shutdown plus 90 days. This bill would prohibit banks, 
employers and other users of consumer reports from considering 
adverse information regarding such consumers.
    H.R. 4328 also restricts any user of consumer reports, 
including creditors, potential employers, and others, from 
considering adverse information regarding a consumer affected 
by a shutdown. Once negative information is reported to 
consumer reporting agencies, affected employees are likely to 
see a reduction in their credit scores, thereby negatively 
affecting their ability to access credit in the future. At the 
September 18, 2019 Committee mark-up, Representative Axne 
suggested adding a provision to H.R. 4328 that would allow any 
employee to opt-out of being included in the database as either 
a government employee or contractor if they wished to do so for 
privacy reasons.
    H.R. 4328 is supported by the American Federation of 
Government Employees (AFGE), the largest Federal employee union 
representing 700,000 Federal and D.C. government workers, and 
the National Treasury Employees Union, which represents 150,000 
workers in 33 departments and agencies.

                      Section-by-Section Analysis


Section 1. Short title

    This section states that the title of the bill is the 
``Protecting Innocent Consumers Affected by a Shutdown Act''.

Section 2. Definition of employee affected by a shutdown

    Section 2 amends Section 603 of the Fair Credit Reporting 
Act to define employees affected by a shutdown as an employee 
of the Federal Government, an employee of the District of 
Columbia, a Federal contractor, or as someone who has self-
certified as an affected worker in a database created by 
consumer reporting agencies. Furthermore, this section defines 
a ``shutdown'' as any period with more than a 24-hour lapse in 
appropriations, and defines the term ``covered shutdown 
period'' as the period beginning on the first day of the 
shutdown and ending on the date that is 90 days after the last 
day of the shutdown.
    Section 2 further requires the Securities and Exchange 
Commission (SEC), within 270 days of the enactment of this 
bill, to issue final rules requiring disclosure of: workforce 
demographic information; workforce stability information; 
workforce composition, including data on diversity; workforce 
skills and capabilities; workforce empowerment; workforce 
health and safety, and workforce compensation and incentives.

Section 3. Exclusion for employees affected by a shutdown

    Section 3 amends Section 605(a) of the Fair Credit 
Reporting Act to require that no consumer reporting agency may 
make a consumer report containing adverse information of an 
employee affected by the shutdown taken during the covered 
shutdown period.

Section 4. Amendment to summary of rights for employees affected by a 
        shutdown

    Section 4 amends Section 609(a) of the Fair Credit 
Reporting Act to require consumer reporting agencies, if 
requested, to clearly and accurately disclose to consumers 
information on the rights of an employee affected by a 
shutdown.

Section 5. Database and self-certification for employees affected by a 
        shutdown

    Section 5 amends the Fair Credit Reporting Act to create a 
database and self-certification procedure for employees 
affected by a shutdown. It stipulates that credit reporting 
agencies shall jointly establish this database, which will be 
comprised of furloughed employees and contractors sent by the 
Federal Government or District of Columbia. Self-certified 
consumers may include themselves in the database through a 
website or toll-free number, but the Consumer Bureau has the 
authority to determine whether they are an affected consumer.

Section 6. Prohibition on adverse actions against employees affected by 
        a shutdown

    Section 6 amends Section 604 of the Fair Credit Reporting 
Act to prohibit any user of a consumer report from adversely 
acting against an eligible employee affected by a shutdown.

Section 7. Bureau regulations or guidance

    Section 7 grants the Consumer Financial Protection Bureau 
(CFPB) the authority to issue rules or guidance, as 
appropriate, to carry out the requirements of this Act.

                                Hearings

    For the purposes of section 103(i) of H. Res. 6 for the 
116th Congress--
    (1) On February 26, 2019, the Committee on Financial 
Services held a hearing to consider a discussion draft of H.R. 
4328 entitled ``Who's Keeping Score? Holding Credit Bureaus 
Accountable and Repairing a Broken System'' to consider two 
discussion drafts, specifically the ``Protecting Innocent 
Consumers Affected by a Shutdown Act'' as well as the 
``Comprehensive Consumer Credit Reporting Reform Act of 2019.'' 
The first panel of the two-panel hearing consisted of the three 
CEOs of the three largest Credit Reporting Agencies: Equifax, 
TransUnion, and Experian. Witnesses on the second panel 
included representatives from the National Fair Housing 
Alliance, the National Consumer Law Center, UnidosUS, U.S. 
Public Interest Research Group (PIRG), and a Paul Hastings 
partner and attorney. The hearing allowed Members of the 
Financial Services Committee to hear from witnesses about the 
challenges to modernizing the Fair Credit Reporting Act to 
better protect consumers and their data, including those 
affected by a government shutdown.
    (2) The House Financial Services Committee's taskforce on 
Financial Technology held a hearing, entitled ``Examining the 
Use of Alternative Data in Underwriting and Credit Scoring to 
Expand Access to Credit'' on July 25, 2019 to discuss emerging 
technologies and how they impact access to credit, and their 
impact across communities. The panel consisted of 
representatives from the National Consumer Law Center, Tulane 
University Law School, The Government Accountability Office 
(GAO), Upstart, and Upturn.

                        Committee Consideration

    The Committee on Financial Services met in open session on 
September 18, 2019, and ordered H.R. 4328 to be reported 
favorably to the House without an amendment in the nature of a 
substitute by a recorded vote of 32 yeas and 22 neas, a quorum 
being present.

                  Committee Votes and Roll Call Votes

    In compliance with clause 3(b) of rule XIII of the Rules of 
the House of Representatives, the Committee advises that the 
following roll call votes occurred during the Committee's 
consideration of H.R. 4328:


  Statement of Oversight Findings and Recommendations of the Committee

    In compliance with clause 3(c)(1) of rule XIII and clause 
2(b)(1) of rule X of the Rules of the House of Representatives, 
the Committee's oversight findings and recommendations are 
reflected in the descriptive portions of this report.

             Statement of Performance Goals and Objectives

    Pursuant to clause (3)(c) of rule XIII of the Rules of the 
House of Representatives, the goals of H.R. 4328 are to ensure 
that government employees, contractors, and other consumers 
affected by a Federal government shutdown.

               New Budget Authority and CBO Cost Estimate

    Pursuant to clause 3(c)(2) of rule XIII of the Rules of the 
House of Representatives and section 308(a) of the 
Congressional Budget Act of 1974, and pursuant to clause 
3(c)(3) of rule XIII of the Rules of the House of 
Representatives and section 402 of the Congressional Budget Act 
of 1974, the Committee has received the following estimate for 
H.R. 4328 from the Director of the Congressional Budget Office:

                                     U.S. Congress,
                               Congressional Budget Office,
                                                    Washington, DC.
Hon. Maxine Waters,
Chairwoman, Committee on Financial Services,
House of Representatives, Washington, DC.
    Dear Madam Chairwoman: The Congressional Budget Office has 
prepared the enclosed cost estimate for H.R. 4328, the 
Protecting Innocent Consumers Affected by a Shutdown Act.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contacts are Matthew 
Pickford and David Hughes.
            Sincerely,
                                         Phillip L. Swagel,
                                                          Director.
    Enclosure.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
    

    H.R. 4328 would prohibit consumer reporting agencies (CRAs) 
from assembling any consumer report that includes adverse 
information about any action or inaction taken by a furloughed 
federal employee during a government shutdown and for 90 days 
following a shutdown. Some federal contractors and District of 
Columbia employees whose compensation is affected by a shutdown 
would receive the same protections. Under the bill, users of 
consumer reports would be prohibited from taking adverse action 
against those employees and contractors based on adverse 
information collected during a shutdown period.
    In the event of a government shutdown, H.R. 4328 would 
require nationwide CRAs to establish and maintain a database of 
federal employees and contractors whose compensation is 
affected by the shutdown. Federal agencies would be required to 
provide the CRA industry with a list of furloughed federal 
employees and affected contractors. That database would be 
shared with the Consumer Financial Protection Bureau (CFPB), 
entities that provide information to CRAs, and users of 
consumer reports.
    Federal Cost: The ability of the federal government to 
share information about employees and contractors is 
constrained by existing privacy laws. The Privacy Act of 1974, 
5 U.S.C. 552, prevents government agencies from sharing any 
personally identifiable information it maintains about an 
individual with other agencies or private sources unless the 
agency obtains the individual's consent.
    CBO estimates that creating the electric authorization 
process would be similar to the effort that was required to 
develop another federal system known as Login.gov. The cost of 
developing Login.gov--a system that offers 14 million users 
secure access to 18 federal agencies and more than 30 
applications--was $30 million over a four year period. CBO 
anticipates that obtaining consent from all furloughed federal 
employees and contractors under H.R. 4328 would require a 
system with a single application and fewer users. On that 
basis, CBO estimates that creating the new database would cost 
$15 million over the 2020-2025 period, or less than $1 million 
per major federal agency. Most of those costs would be subject 
to the availability of appropriated funds.
    Enacting H.R. 4328 could affect direct spending by some 
agencies that are allowed to use fees, receipts from the sale 
of goods, and other collections to cover operating costs. CBO 
estimates that any net changes in direct spending by those 
agencies would be negligible because most of them can adjust 
amounts collected to reflect changes in operating costs.
    Based on information from the CFPB, CBO estimates that CFPB 
would need the services of two full-time employees at a cost of 
$200,000 per employee to issue regulations and establish 
processes to implement the bill's requirements in 2020. On that 
basis, CBO estimates that enacting H.R. 4328 would increase 
direct spending by less than $500,000 over the 2020-2030 
period. The CFPB is permanently authorized to receive funding 
from the Federal Reserve in an amount necessary to carry out 
its operations and can spend those amounts without further 
appropriation.
    Mandates: H.R. 4328 contains intergovernmental and private-
sector mandates as defined in the Unfunded Mandates Reform Act 
(UMRA). CBO estimates that the cost of the mandates would not 
exceed UMRA's intergovernmental or private-sector threshold 
($84 million and $168 million in 2020, respectively, adjusted 
annually for inflation).
    The bill would impose private-sector mandates by placing 
new requirements and prohibitions on consumer reporting 
agencies. Using industry data, CBO estimates that CRAs would 
spend roughly $80 million to comply with those mandates.
    Specifically, CRAs would be required to:
           Create a shared database for each shutdown 
        of the federal government to log federal employees and 
        contractors affected by the shutdown,
           Access the new database periodically to 
        ensure the accuracy of information it holds,
           Create a website and a toll-free telephone 
        number for use by consumers to self-certify as an 
        employee affected by a shutdown, and
           Disclose to consumers, upon request, the 
        rights of employees affected by a shutdown.
    The bill also would prohibit CRAs from including adverse 
information in consumer reports, and users of those reports 
from knowingly taking an adverse action against an employee 
based on information contained in their consumer report about 
actions that occurred during the period of a federal government 
shutdown. That prohibition would impose an intergovernmental 
and private-sector mandate because individuals in the public 
and private sector use consumer reports for background checks 
and personnel decisions. The incremental cost for users to 
disregard adverse information in a consumer report would be 
small.
    Finally, the bill would impose an additional 
intergovernmental mandate by requiring the District of Columbia 
to disclose a list to CRAs identifying employees affected by a 
shutdown of the federal government. The cost to supply the list 
would be small because the District of Columbia already 
possesses the information to be reported under the bill.
    The CBO staff contacts for this estimate are Matthew 
Pickford and David Hughes (for federal costs) and Rachel Austin 
(for mandates). This estimate was reviewed by H. Samuel 
Papenfuss, Deputy Director of Budget Analysis.

                        Committee Cost Estimate

    Clause 3(d)(1) of rule XIII of the Rules of the House of 
Representatives requires an estimate and a comparison of the 
costs that would be incurred in carrying out H.R. 4328. 
However, clause 3(d)(2)(B) of that rule provides that this 
requirement does not apply when the committee has included in 
its report a timely submitted cost estimate of the bill 
prepared by the Director of the Congressional Budget Office 
under section 402 of the Congressional Budget Act, which is 
attached.

                       Unfunded Mandate Statement

    Pursuant to Section 423 of the Congressional Budget and 
Impoundment Control Act (as amended by Section 101(a)(2) of the 
Unfunded Mandates Reform Act, Pub. L. 104-4), the Committee 
adopts as its own the estimate of federal mandates regarding 
H.R. 4328, as amended, prepared by the Director of the 
Congressional Budget Office.

                           Advisory Committee

    No advisory committees within the meaning of section 5(b) 
of the Federal Advisory Committee Act were created by this 
legislation.

              Application of Law to the Legislative Branch

    Pursuant to section 102(b)(3) of the Congressional 
Accountability Act, Pub. L. No. 104-1, H.R. 4328, as amended, 
does not apply to terms and conditions of employment or to 
access to public services or accommodations within the 
legislative branch.

                           Earmark Statement

    In accordance with clause 9 of rule XXI of the Rules of the 
House of Representatives, H.R. 4328 does not contain any 
congressional earmarks, limited tax benefits, or limited tariff 
benefits as described in clauses 9(e), 9(f), and 9(g) of rule 
XXI.

                    Duplication of Federal Programs

    Pursuant to clause 3(c)(5) of rule XIII of the Rules of the 
House of Representatives, the Committee states that no 
provision of H.R. 4328 establishes or reauthorizes a program of 
the Federal Government known to be duplicative of another 
federal program, a program that was included in any report from 
the Government Accountability Office to Congress pursuant to 
section 21 of Public Law 111-139, or a program related to a 
program identified in the most recent Catalog of Federal 
Domestic Assistance.

                        Changes to Existing Law

    In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, H.R. 5930, as reported, are shown as follows:

         Changes in Existing Law Made by the Bill, as Reported

  In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (new matter is 
printed in italics and existing law in which no change is 
proposed is shown in roman):

                       FAIR CREDIT REPORTING ACT


                  TITLE VI--CONSUMER CREDIT REPORTING

Sec.
601. Short title.
     * * * * * * *
629. Corporate and technological circumvention prohibited.
630. Database and self-certification for employees affected by a 
          shutdown.

           *       *       *       *       *       *       *


Sec. 603. Definitions and rules of construction

  (a) Definitions and rules of construction set forth in this 
section are applicable for the purposes of this title.
  (b) The term ``person'' means any individual, partnership, 
corporation, trust, estate, cooperative, association, 
government or governmental subdivision or agency, or other 
entity.
  (c) The term ``consumer'' means an individual.
  (d) Consumer Report.--
          (1) In general.--The term ``consumer report'' means 
        any written, oral, or other communication of any 
        information by a consumer reporting agency bearing on a 
        consumer's credit worthiness, credit standing, credit 
        capacity, character, general reputation, personal 
        characteristics, or mode of living which is used or 
        expected to be used or collected in whole or in part 
        for the purpose of serving as a factor in establishing 
        the consumer's eligibility for--
                  (A) credit or insurance to be used primarily 
                for personal, family, or household purposes;
                  (B) employment purposes; or
                  (C) any other purpose authorized under 
                section 604.
          (2) Exclusions.--Except as provided in paragraph (3), 
        the term ``consumer report'' does not include--
                  (A) subject to section 624, any--
                          (i) report containing information 
                        solely as to transactions or 
                        experiences between the consumer and 
                        the person making the report;
                          (ii) communication of that 
                        information among persons related by 
                        common ownership or affiliated by 
                        corporate control; or
                          (iii) communication of other 
                        information among persons related by 
                        common ownership or affiliated by 
                        corporate control, if it is clearly and 
                        conspicuously disclosed to the consumer 
                        that the information may be 
                        communicated among such persons and the 
                        consumer is given the opportunity, 
                        before the time that the information is 
                        initially communicated, to direct that 
                        such information not be communicated 
                        among such persons;
                  (B) any authorization or approval of a 
                specific extension of credit directly or 
                indirectly by the issuer of a credit card or 
                similar device;
                  (C) any report in which a person who has been 
                requested by a third party to make a specific 
                extension of credit directly or indirectly to a 
                consumer conveys his or her decision with 
                respect to such request, if the third party 
                advises the consumer of the name and address of 
                the person to whom the request was made, and 
                such person makes the disclosures to the 
                consumer required under section 615; or
                  (D) a communication described in subsection 
                (o) or (x).
          (3) Restriction on sharing of medical information.--
        Except for information or any communication of 
        information disclosed as provided in section 604(g)(3), 
        the exclusions in paragraph (2) shall not apply with 
        respect to information disclosed to any person related 
        by common ownership or affiliated by corporate control, 
        if the information is--
                  (A) medical information;
                  (B) an individualized list or description 
                based on the payment transactions of the 
                consumer for medical products or services; or
                  (C) an aggregate list of identified consumers 
                based on payment transactions for medical 
                products or services.
  (e) The term ``investigative consumer report'' means a 
consumer report or portion thereof in which information on a 
consumer's character, general reputation, personal 
characteristics, or mode of living is obtained through personal 
interviews with neighbors, friends, or associates of the 
consumer reported on or with others with whom he is acquainted 
or who may have knowledge concerning any such items of 
information. However, such information shall not include 
specific factual information on a consumer's credit record 
obtained directly from a creditor of the consumer or from a 
consumer reporting agency when such information was obtained 
directly from a creditor of the consumer or from the consumer.
  (f) The term ``consumer reporting agency'' means any person 
which, for monetary fees, dues, or on a cooperative nonprofit 
basis, regularly engages in whole or in part in the practice of 
assembling or evaluating consumer credit information or other 
information on consumers for the purpose of furnishing consumer 
reports to third parties, and which uses any means or facility 
of interstate commerce for the purpose of preparing or 
furnishing consumer reports.
  (g) The term ``file'', when used in connection with 
information on any consumer, means all of the information on 
that consumer recorded and retained by a consumer reporting 
agency regardless of how the information is stored.
  (h) The term ``employment purposes'' when used in connection 
with a consumer report means a report used for the purpose of 
evaluating a consumer for employment, promotion, reassignment 
or retention as an employee.
  (i) Medical Information.--The term ``medical information''--
          (1) means information or data, whether oral or 
        recorded, in any form or medium, created by or derived 
        from a health care provider or the consumer, that 
        relates to--
                  (A) the past, present, or future physical, 
                mental, or behavioral health or condition of an 
                individual;
                  (B) the provision of health care to an 
                individual; or
                  (C) the payment for the provision of health 
                care to an individual.
          (2) does not include the age or gender of a consumer, 
        demographic information about the consumer, including a 
        consumer's residence address or e-mail address, or any 
        other information about a consumer that does not relate 
        to the physical, mental, or behavioral health or 
        condition of a consumer, including the existence or 
        value of any insurance policy.
  (j) Definitions Relating to Child Support Obligations.--
          (1) Overdue support.--The term ``overdue support'' 
        has the meaning given to such term in section 466(e) of 
        the Social Security Act.
          (2) State or local child support enforcement 
        agency.--The term ``State or local child support 
        enforcement agency'' means a State or local agency 
        which administers a State or local program for 
        establishing and enforcing child support obligations.
  (k) Adverse Action.--
          (1) Actions included.--The term ``adverse action''--
                  (A) has the same meaning as in section 
                701(d)(6) of the Equal Credit Opportunity Act; 
                and
                  (B) means--
                          (i) a denial or cancellation of, an 
                        increase in any charge for, or a 
                        reduction or other adverse or 
                        unfavorable change in the terms of 
                        coverage or amount of, any insurance, 
                        existing or applied for, in connection 
                        with the underwriting of insurance;
                          (ii) a denial of employment or any 
                        other decision for employment purposes 
                        that adversely affects any current or 
                        prospective employee;
                          (iii) a denial or cancellation of, an 
                        increase in any charge for, or any 
                        other adverse or unfavorable change in 
                        the terms of, any license or benefit 
                        described in section 604(a)(3)(D); and
                          (iv) an action taken or determination 
                        that is--
                                  (I) made in connection with 
                                an application that was made 
                                by, or a transaction that was 
                                initiated by, any consumer, or 
                                in connection with a review of 
                                an account under section 
                                604(a)(3)(F)(ii); and
                                  (II) adverse to the interests 
                                of the consumer.
          (2) Applicable findings, decisions, commentary, and 
        orders.--For purposes of any determination of whether 
        an action is an adverse action under paragraph (1)(A), 
        all appropriate final findings, decisions, commentary, 
        and orders issued under section 701(d)(6) of the Equal 
        Credit Opportunity Act by the Bureau or any court shall 
        apply.
  (l) Firm Offer of Credit or Insurance.--The term ``firm offer 
of credit or insurance'' means any offer of credit or insurance 
to a consumer that will be honored if the consumer is 
determined, based on information in a consumer report on the 
consumer, to meet the specific criteria used to select the 
consumer for the offer, except that the offer may be further 
conditioned on one or more of the following:
          (1) The consumer being determined, based on 
        information in the consumer's application for the 
        credit or insurance, to meet specific criteria bearing 
        on credit worthiness or insurability, as applicable, 
        that are established--
                  (A) before selection of the consumer for the 
                offer; and
                  (B) for the purpose of determining whether to 
                extend credit or insurance pursuant to the 
                offer.
          (2) Verification--
                  (A) that the consumer continues to meet the 
                specific criteria used to select the consumer 
                for the offer, by using information in a 
                consumer report on the consumer, information in 
                the consumer's application for the credit or 
                insurance, or other information bearing on the 
                credit worthiness or insurability of the 
                consumer; or
                  (B) of the information in the consumer's 
                application for the credit or insurance, to 
                determine that the consumer meets the specific 
                criteria bearing on credit worthiness or 
                insurability.
          (3) The consumer furnishing any collateral that is a 
        requirement for the extension of the credit or 
        insurance that was--
                  (A) established before selection of the 
                consumer for the offer of credit or insurance; 
                and
                  (B) disclosed to the consumer in the offer of 
                credit or insurance.
  (m) Credit or Insurance Transaction That Is Not Initiated by 
the Consumer.--The term ``credit or insurance transaction that 
is not initiated by the consumer'' does not include the use of 
a consumer report by a person with which the consumer has an 
account or insurance policy, for purposes of--
          (1) reviewing the account or insurance policy; or
          (2) collecting the account.
  (n) State.--The term ``State'' means any State, the 
Commonwealth of Puerto Rico, the District of Columbia, and any 
territory or possession of the United States.
  (o) Excluded Communications.--A communication is described in 
this subsection if it is a communication--
          (1) that, but for subsection (d)(2)(D), would be an 
        investigative consumer report;
          (2) that is made to a prospective employer for the 
        purpose of--
                  (A) procuring an employee for the employer; 
                or
                  (B) procuring an opportunity for a natural 
                person to work for the employer;
          (3) that is made by a person who regularly performs 
        such procurement;
          (4) that is not used by any person for any purpose 
        other than a purpose described in subparagraph (A) or 
        (B) of paragraph (2); and
          (5) with respect to which--
                  (A) the consumer who is the subject of the 
                communication--
                          (i) consents orally or in writing to 
                        the nature and scope of the 
                        communication, before the collection of 
                        any information for the purpose of 
                        making the communication;
                          (ii) consents orally or in writing to 
                        the making of the communication to a 
                        prospective employer, before the making 
                        of the communication; and
                          (iii) in the case of consent under 
                        clause (i) or (ii) given orally, is 
                        provided written confirmation of that 
                        consent by the person making the 
                        communication, not later than 3 
                        business days after the receipt of the 
                        consent by that person;
                  (B) the person who makes the communication 
                does not, for the purpose of making the 
                communication, make any inquiry that if made by 
                a prospective employer of the consumer who is 
                the subject of the communication would violate 
                any applicable Federal or State equal 
                employment opportunity law or regulation; and
                  (C) the person who makes the communication--
                          (i) discloses in writing to the 
                        consumer who is the subject of the 
                        communication, not later than 5 
                        business days after receiving any 
                        request from the consumer for such 
                        disclosure, the nature and substance of 
                        all information in the consumer's file 
                        at the time of the request, except that 
                        the sources of any information that is 
                        acquired solely for use in making the 
                        communication and is actually used for 
                        no other purpose, need not be disclosed 
                        other than under appropriate discovery 
                        procedures in any court of competent 
                        jurisdiction in which an action is 
                        brought; and
                          (ii) notifies the consumer who is the 
                        subject of the communication, in 
                        writing, of the consumer's right to 
                        request the information described in 
                        clause (i).
  (p) Consumer Reporting Agency That Compiles and Maintains 
Files on Consumers on a Nationwide Basis.--The term ``consumer 
reporting agency that compiles and maintains files on consumers 
on a nationwide basis'' means a consumer reporting agency that 
regularly engages in the practice of assembling or evaluating, 
and maintaining, for the purpose of furnishing consumer reports 
to third parties bearing on a consumer's credit worthiness, 
credit standing, or credit capacity, each of the following 
regarding consumers residing nationwide:
          (1) Public record information.
          (2) Credit account information from persons who 
        furnish that information regularly and in the ordinary 
        course of business.
  (q) Definitions Relating to Fraud Alerts.--
          (1) Active duty military consumer.--The term ``active 
        duty military consumer'' means a consumer in military 
        service who--
                  (A) is on active duty (as defined in section 
                101(d)(1) of title 10, United States Code) or 
                is a reservist performing duty under a call or 
                order to active duty under a provision of law 
                referred to in section 101(a)(13) of title 10, 
                United States Code; and
                  (B) is assigned to service away from the 
                usual duty station of the consumer.
          (2) Fraud alert; active duty alert.--The terms 
        ``fraud alert'' and ``active duty alert'' mean a 
        statement in the file of a consumer that--
                  (A) notifies all prospective users of a 
                consumer report relating to the consumer that 
                the consumer may be a victim of fraud, 
                including identity theft, or is an active duty 
                military consumer, as applicable; and
                  (B) is presented in a manner that facilitates 
                a clear and conspicuous view of the statement 
                described in subparagraph (A) by any person 
                requesting such consumer report.
          (3) Identity theft.--The term ``identity theft'' 
        means a fraud committed using the identifying 
        information of another person, subject to such further 
        definition as the Bureau may prescribe, by regulation.
          (4) Identity theft report.--The term ``identity theft 
        report'' has the meaning given that term by rule of the 
        Bureau, and means, at a minimum, a report--
                  (A) that alleges an identity theft;
                  (B) that is a copy of an official, valid 
                report filed by a consumer with an appropriate 
                Federal, State, or local law enforcement 
                agency, including the United States Postal 
                Inspection Service, or such other government 
                agency deemed appropriate by the Bureau; and
                  (C) the filing of which subjects the person 
                filing the report to criminal penalties 
                relating to the filing of false information if, 
                in fact, the information in the report is 
                false.
          (5) New credit plan.--The term ``new credit plan'' 
        means a new account under an open end credit plan (as 
        defined in section 103(i) of the Truth in Lending Act) 
        or a new credit transaction not under an open end 
        credit plan.
  (r) Credit and Debit Related Terms--
          (1) Card issuer.--The term ``card issuer'' means--
                  (A) a credit card issuer, in the case of a 
                credit card; and
                  (B) a debit card issuer, in the case of a 
                debit card.
          (2) Credit card.--The term ``credit card'' has the 
        same meaning as in section 103 of the Truth in Lending 
        Act.
          (3) Debit card.--The term ``debit card'' means any 
        card issued by a financial institution to a consumer 
        for use in initiating an electronic fund transfer from 
        the account of the consumer at such financial 
        institution, for the purpose of transferring money 
        between accounts or obtaining money, property, labor, 
        or services.
          (4) Account and electronic fund transfer.--The terms 
        ``account'' and ``electronic fund transfer'' have the 
        same meanings as in section 903 of the Electronic Fund 
        Transfer Act.
          (5) Credit and creditor.--The terms ``credit'' and 
        ``creditor'' have the same meanings as in section 702 
        of the Equal Credit Opportunity Act.
  (s) Federal Banking Agency.--The term ``Federal banking 
agency'' has the same meaning as in section 3 of the Federal 
Deposit Insurance Act.
  (t) Financial Institution.--The term ``financial 
institution'' means a State or National bank, a State or 
Federal savings and loan association, a mutual savings bank, a 
State or Federal credit union, or any other person that, 
directly or indirectly, holds a transaction account (as defined 
in section 19(b) of the Federal Reserve Act) belonging to a 
consumer.
  (u) Reseller.--The term ``reseller'' means a consumer 
reporting agency that--
          (1) assembles and merges information contained in the 
        database of another consumer reporting agency or 
        multiple consumer reporting agencies concerning any 
        consumer for purposes of furnishing such information to 
        any third party, to the extent of such activities; and
          (2) does not maintain a database of the assembled or 
        merged information from which new consumer reports are 
        produced.
  (v) Commission.--The term ``Commission'' means the Bureau.
  (w) The term ``Bureau'' means the Bureau of Consumer 
Financial Protection.
  (x) Nationwide Specialty Consumer Reporting Agency.--The term 
``nationwide specialty consumer reporting agency'' means a 
consumer reporting agency that compiles and maintains files on 
consumers on a nationwide basis relating to--
          (1) medical records or payments;
          (2) residential or tenant history;
          (3) check writing history;
          (4) employment history; or
          (5) insurance claims.
  (y) Exclusion of Certain Communications for Employee 
Investigations.--
          (1) Communications described in this subsection.--A 
        communication is described in this subsection if--
                  (A) but for subsection (d)(2)(D), the 
                communication would be a consumer report;
                  (B) the communication is made to an employer 
                in connection with an investigation of--
                          (i) suspected misconduct relating to 
                        employment; or
                          (ii) compliance with Federal, State, 
                        or local laws and regulations, the 
                        rules of a self-regulatory 
                        organization, or any preexisting 
                        written policies of the employer;
                  (C) the communication is not made for the 
                purpose of investigating a consumer's credit 
                worthiness, credit standing, or credit 
                capacity; and
                  (D) the communication is not provided to any 
                person except--
                          (i) to the employer or an agent of 
                        the employer;
                          (ii) to any Federal or State officer, 
                        agency, or department, or any officer, 
                        agency, or department of a unit of 
                        general local government;
                          (iii) to any self-regulatory 
                        organization with regulatory authority 
                        over the activities of the employer or 
                        employee;
                          (iv) as otherwise required by law; or
                          (v) pursuant to section 608.
          (2) Subsequent disclosure.--After taking any adverse 
        action based in whole or in part on a communication 
        described in paragraph (1), the employer shall disclose 
        to the consumer a summary containing the nature and 
        substance of the communication upon which the adverse 
        action is based, except that the sources of information 
        acquired solely for use in preparing what would be but 
        for subsection (d)(2)(D) an investigative consumer 
        report need not be disclosed.
          (3) Self-regulatory organization defined.--For 
        purposes of this subsection, the term ``self-regulatory 
        organization'' includes any self-regulatory 
        organization (as defined in section 3(a)(26) of the 
        Securities Exchange Act of 1934), any entity 
        established under title I of the Sarbanes-Oxley Act of 
        2002, any board of trade designated by the Commodity 
        Futures Trading Commission, and any futures association 
        registered with such Commission.
  (z) Veteran.--The term ``veteran'' has the meaning given the 
term in section 101 of title 38, United States Code.
  (aa) Veteran's Medical Debt.--The term ``veteran's medical 
debt''--
          (1) means a medical collection debt of a veteran owed 
        to a non-Department of Veterans Affairs health care 
        provider that was submitted to the Department for 
        payment for health care authorized by the Department of 
        Veterans Affairs; and
          (2) includes medical collection debt that the 
        Department of Veterans Affairs has wrongfully charged a 
        veteran.
  (bb) Employee Affected by a Shutdown.--With respect to a 
shutdown, the term ``employee affected by a shutdown'' means a 
consumer who--
          (1) is an employee of--
                  (A) the Federal Government, and who is 
                furloughed or excepted from a furlough during 
                the shutdown;
                  (B) the District of Columbia, and who is not 
                receiving pay because of the shutdown; or
                  (C) a Federal contractor (as defined under 
                section 7101 of title 41, United States Code) 
                or other business, and who has experienced a 
                substantial reduction in pay (directly or 
                indirectly) due to the shutdown; and
          (2) who--
                  (A) is listed in the database established 
                under section 630; or
                  (B) has self-certified pursuant to such 
                section.
  (cc) Shutdown.--The term ``shutdown'' means any period in 
which there is more than a 24-hour lapse in appropriations as a 
result of a failure to enact a regular appropriations bill or 
continuing resolution.
  (dd) Covered Shutdown Period.--The term ``covered shutdown 
period'' means, with respect to a shutdown, the period 
beginning on the first day of the shutdown and ending on the 
date that is 90 days after the last day of the shutdown.

Sec. 604. Permissible purposes of reports

  (a) In General.--Subject to subsection (c), any consumer 
reporting agency may furnish a consumer report under the 
following circumstances and no other:
          (1) In response to the order of a court having 
        jurisdiction to issue such an order, or a subpoena 
        issued in connection with proceedings before a Federal 
        grand jury.
          (2) In accordance with the written instructions of 
        the consumer to whom it relates.
          (3) To a person which it has reason to believe--
                  (A) intends to use the information in 
                connection with a credit transaction involving 
                the consumer on whom the information is to be 
                furnished and involving the extension of credit 
                to, or review or collection of an account of, 
                the consumer; or
                  (B) intends to use the information for 
                employment purposes; or
                  (C) intends to use the information in 
                connection with the underwriting of insurance 
                involving the consumer; or
                  (D) intends to use the information in 
                connection with a determination of the 
                consumer's eligibility for a license or other 
                benefit granted by a governmental 
                instrumentality required by law to consider an 
                applicant's financial responsibility or status; 
                or
                  (E) intends to use the information, as a 
                potential investor or servicer, or current 
                insurer, in connection with a valuation of, or 
                an assessment of the credit or prepayment risks 
                associated with, an existing credit obligation; 
                or
                  (F) otherwise has a legitimate business need 
                for the information--
                          (i) in connection with a business 
                        transaction that is initiated by the 
                        consumer; or
                          (ii) to review an account to 
                        determine whether the consumer 
                        continues to meet the terms of the 
                        account.
                  (G) executive departments and agencies in 
                connection with the issuance of government-
                sponsored individually-billed travel charge 
                cards.
          (4) In response to a request by the head of a State 
        or local child support enforcement agency (or a State 
        or local government official authorized by the head of 
        such an agency), if the person making the request 
        certifies to the consumer reporting agency that--
                  (A) the consumer report is needed for the 
                purpose of establishing an individual's 
                capacity to make child support payments, 
                determining the appropriate level of such 
                payments, or enforcing a child support order, 
                award, agreement, or judgment;
                  (B) the parentage of the consumer for the 
                child to which the obligation relates has been 
                established or acknowledged by the consumer in 
                accordance with State laws under which the 
                obligation arises (if required by those laws); 
                and
                  (C) the consumer report will be kept 
                confidential, will be used solely for a purpose 
                described in subparagraph (A), and will not be 
                used in connection with any other civil, 
                administrative, or criminal proceeding, or for 
                any other purpose.
          (5) To an agency administering a State plan under 
        section 454 of the Social Security Act (42 U.S.C. 654) 
        for use to set an initial or modified child support 
        award.
          (6) To the Federal Deposit Insurance Corporation or 
        the National Credit Union Administration as part of its 
        preparation for its appointment or as part of its 
        exercise of powers, as conservator, receiver, or 
        liquidating agent for an insured depository institution 
        or insured credit union under the Federal Deposit 
        Insurance Act or the Federal Credit Union Act, or other 
        applicable Federal or State law, or in connection with 
        the resolution or liquidation of a failed or failing 
        insured depository institution or insured credit union, 
        as applicable.
  (b) Conditions for Furnishing and Using Consumer Reports for 
Employment Purposes.--
          (1) Certification from user.--A consumer reporting 
        agency may furnish a consumer report for employment 
        purposes only if--
                  (A) the person who obtains such report from 
                the agency certifies to the agency that--
                          (i) the person has complied with 
                        paragraph (2) with respect to the 
                        consumer report, and the person will 
                        comply with paragraph (3) with respect 
                        to the consumer report if paragraph (3) 
                        becomes applicable; and
                          (ii) information from the consumer 
                        report will not be used in violation of 
                        any applicable Federal or State equal 
                        employment opportunity law or 
                        regulation; and
                  (B) the consumer reporting agency provides 
                with the report, or has previously provided, a 
                summary of the consumer's rights under this 
                title, as prescribed by the Bureau under 
                section 609(c)(3).
          (2) Disclosure to consumer.--
                  (A) In general.--Except as provided in 
                subparagraph (B), a person may not procure a 
                consumer report, or cause a consumer report to 
                be procured, for employment purposes with 
                respect to any consumer, unless--
                          (i) a clear and conspicuous 
                        disclosure has been made in writing to 
                        the consumer at any time before the 
                        report is procured or caused to be 
                        procured, in a document that consists 
                        solely of the disclosure, that a 
                        consumer report may be obtained for 
                        employment purposes; and
                          (ii) the consumer has authorized in 
                        writing (which authorization may be 
                        made on the document referred to in 
                        clause (i)) the procurement of the 
                        report by that person.
                  (B) Application by mail, telephone, computer, 
                or other similar means.--If a consumer 
                described in subparagraph (C) applies for 
                employment by mail, telephone, computer, or 
                other similar means, at any time before a 
                consumer report is procured or caused to be 
                procured in connection with that application--
                          (i) the person who procures the 
                        consumer report on the consumer for 
                        employment purposes shall provide to 
                        the consumer, by oral, written, or 
                        electronic means, notice that a 
                        consumer report may be obtained for 
                        employment purposes, and a summary of 
                        the consumer's rights under section 
                        615(a)(3); and
                          (ii) the consumer shall have 
                        consented, orally, in writing, or 
                        electronically to the procurement of 
                        the report by that person.
                  (C) Scope.--Subparagraph (B) shall apply to a 
                person procuring a consumer report on a 
                consumer in connection with the consumer's 
                application for employment only if--
                          (i) the consumer is applying for a 
                        position over which the Secretary of 
                        Transportation has the power to 
                        establish qualifications and maximum 
                        hours of service pursuant to the 
                        provisions of section 31502 of title 
                        49, or a position subject to safety 
                        regulation by a State transportation 
                        agency; and
                          (ii) as of the time at which the 
                        person procures the report or causes 
                        the report to be procured the only 
                        interaction between the consumer and 
                        the person in connection with that 
                        employment application has been by 
                        mail, telephone, computer, or other 
                        similar means.
          (3) Conditions on use for adverse actions.--
                  (A) In general.--Except as provided in 
                subparagraph (B), in using a consumer report 
                for employment purposes, before taking any 
                adverse action based in whole or in part on the 
                report, the person intending to take such 
                adverse action shall provide to the consumer to 
                whom the report relates--
                          (i) a copy of the report; and
                          (ii) a description in writing of the 
                        rights of the consumer under this 
                        title, as prescribed by the Bureau 
                        under section 609(c)(3).
                  (B) Application by mail, telephone, computer, 
                or other similar means.--
                          (i) If a consumer described in 
                        subparagraph (C) applies for employment 
                        by mail, telephone, computer, or other 
                        similar means, and if a person who has 
                        procured a consumer report on the 
                        consumer for employment purposes takes 
                        adverse action on the employment 
                        application based in whole or in part 
                        on the report, then the person must 
                        provide to the consumer to whom the 
                        report relates, in lieu of the notices 
                        required under subparagraph (A) of this 
                        section and under section 615(a), 
                        within 3 business days of taking such 
                        action, an oral, written or electronic 
                        notification--
                                  (I) that adverse action has 
                                been taken based in whole or in 
                                part on a consumer report 
                                received from a consumer 
                                reporting agency;
                                  (II) of the name, address and 
                                telephone number of the 
                                consumer reporting agency that 
                                furnished the consumer report 
                                (including a toll-free 
                                telephone number established by 
                                the agency if the agency 
                                compiles and maintains files on 
                                consumers on a nationwide 
                                basis);
                                  (III) that the consumer 
                                reporting agency did not make 
                                the decision to take the 
                                adverse action and is unable to 
                                provide to the consumer the 
                                specific reasons why the 
                                adverse action was taken; and
                                  (IV) that the consumer may, 
                                upon providing proper 
                                identification, request a free 
                                copy of a report and may 
                                dispute with the consumer 
                                reporting agency the accuracy 
                                or completeness of any 
                                information in a report.
                          (ii) If, under clause (B)(i)(IV), the 
                        consumer requests a copy of a consumer 
                        report from the person who procured the 
                        report, then, within 3 business days of 
                        receiving the consumer's request, 
                        together with proper identification, 
                        the person must send or provide to the 
                        consumer a copy of a report and a copy 
                        of the consumer's rights as prescribed 
                        by the Bureau under section 609(c)(3).
                  (C) Scope.--Subparagraph (B) shall apply to a 
                person procuring a consumer report on a 
                consumer in connection with the consumer's 
                application for employment only if--
                          (i) the consumer is applying for a 
                        position over which the Secretary of 
                        Transportation has the power to 
                        establish qualifications and maximum 
                        hours of service pursuant to the 
                        provisions of section 31502 of title 
                        49, or a position subject to safety 
                        regulation by a State transportation 
                        agency; and
                          (ii) as of the time at which the 
                        person procures the report or causes 
                        the report to be procured the only 
                        interaction between the consumer and 
                        the person in connection with that 
                        employment application has been by 
                        mail, telephone, computer, or other 
                        similar means.
          (4) Exception for national security investigations.--
                  (A) In general.--In the case of an agency or 
                department of the United States Government 
                which seeks to obtain and use a consumer report 
                for employment purposes, paragraph (3) shall 
                not apply to any adverse action by such agency 
                or department which is based in part on such 
                consumer report, if the head of such agency or 
                department makes a written finding that--
                          (i) the consumer report is relevant 
                        to a national security investigation of 
                        such agency or department;
                          (ii) the investigation is within the 
                        jurisdiction of such agency or 
                        department;
                          (iii) there is reason to believe that 
                        compliance with paragraph (3) will--
                                  (I) endanger the life or 
                                physical safety of any person;
                                  (II) result in flight from 
                                prosecution;
                                  (III) result in the 
                                destruction of, or tampering 
                                with, evidence relevant to the 
                                investigation;
                                  (IV) result in the 
                                intimidation of a potential 
                                witness relevant to the 
                                investigation;
                                  (V) result in the compromise 
                                of classified information; or
                                  (VI) otherwise seriously 
                                jeopardize or unduly delay the 
                                investigation or another 
                                official proceeding.
                  (B) Notification of consumer upon conclusion 
                of investigation.--Upon the conclusion of a 
                national security investigation described in 
                subparagraph (A), or upon the determination 
                that the exception under subparagraph (A) is no 
                longer required for the reasons set forth in 
                such subparagraph, the official exercising the 
                authority in such subparagraph shall provide to 
                the consumer who is the subject of the consumer 
                report with regard to which such finding was 
                made--
                          (i) a copy of such consumer report 
                        with any classified information 
                        redacted as necessary;
                          (ii) notice of any adverse action 
                        which is based, in part, on the 
                        consumer report; and
                          (iii) the identification with 
                        reasonable specificity of the nature of 
                        the investigation for which the 
                        consumer report was sought.
                  (C) Delegation by head of agency or 
                department.--For purposes of subparagraphs (A) 
                and (B), the head of any agency or department 
                of the United States Government may delegate 
                his or her authorities under this paragraph to 
                an official of such agency or department who 
                has personnel security responsibilities and is 
                a member of the Senior Executive Service or 
                equivalent civilian or military rank.
                  (D) Definitions.--For purposes of this 
                paragraph, the following definitions shall 
                apply:
                          (i) Classified information.--The term 
                        ``classified information'' means 
                        information that is protected from 
                        unauthorized disclosure under Executive 
                        Order No. 12958 or successor orders.
                          (ii) National security 
                        investigation.--The term ``national 
                        security investigation'' means any 
                        official inquiry by an agency or 
                        department of the United States 
                        Government to determine the eligibility 
                        of a consumer to receive access or 
                        continued access to classified 
                        information or to determine whether 
                        classified information has been lost or 
                        compromised.
  (c) Furnishing Reports in Connection With Credit or Insurance 
Transactions That Are Not Initiated by the Consumer.--
          (1) In general.--A consumer reporting agency may 
        furnish a consumer report relating to any consumer 
        pursuant to subparagraph (A) or (C) of subsection 
        (a)(3) in connection with any credit or insurance 
        transaction that is not initiated by the consumer only 
        if--
                  (A) the consumer authorizes the agency to 
                provide such report to such person; or
                  (B)(i) the transaction consists of a firm 
                offer of credit or insurance;
                  (ii) the consumer reporting agency has 
                complied with subsection (e);
                  (iii) there is not in effect an election by 
                the consumer, made in accordance with 
                subsection (e), to have the consumer's name and 
                address excluded from lists of names provided 
                by the agency pursuant to this paragraph; and
                  (iv) the consumer report does not contain a 
                date of birth that shows that the consumer has 
                not attained the age of 21, or, if the date of 
                birth on the consumer report shows that the 
                consumer has not attained the age of 21, such 
                consumer consents to the consumer reporting 
                agency to such furnishing.
          (2) Limits on information received under paragraph 
        (1)(b).--A person may receive pursuant to paragraph 
        (1)(B) only--
                  (A) the name and address of a consumer;
                  (B) an identifier that is not unique to the 
                consumer and that is used by the person solely 
                for the purpose of verifying the identity of 
                the consumer; and
                  (C) other information pertaining to a 
                consumer that does not identify the 
                relationship or experience of the consumer with 
                respect to a particular creditor or other 
                entity.
          (3) Information regarding inquiries.--Except as 
        provided in section 609(a)(5), a consumer reporting 
        agency shall not furnish to any person a record of 
        inquiries in connection with a credit or insurance 
        transaction that is not initiated by a consumer.
  (d) Reserved.--
  (e) Election of Consumer To Be Excluded From Lists.--
          (1) In general.--A consumer may elect to have the 
        consumer's name and address excluded from any list 
        provided by a consumer reporting agency under 
        subsection (c)(1)(B) in connection with a credit or 
        insurance transaction that is not initiated by the 
        consumer by notifying the agency in accordance with 
        paragraph (2) that the consumer does not consent to any 
        use of a consumer report relating to the consumer in 
        connection with any credit or insurance transaction 
        that is not initiated by the consumer.
          (2) Manner of notification.--A consumer shall notify 
        a consumer reporting agency under paragraph (1)--
                  (A) through the notification system 
                maintained by the agency under paragraph (5); 
                or
                  (B) by submitting to the agency a signed 
                notice of election form issued by the agency 
                for purposes of this subparagraph.
          (3) Response of agency after notification through 
        system.--Upon receipt of notification of the election 
        of a consumer under paragraph (1) through the 
        notification system maintained by the agency under 
        paragraph (5), a consumer reporting agency shall--
                  (A) inform the consumer that the election is 
                effective only for the 5-year period following 
                the election if the consumer does not submit to 
                the agency a signed notice of election form 
                issued by the agency for purposes of paragraph 
                (2)(B); and
                  (B) provide to the consumer a notice of 
                election form, if requested by the consumer, 
                not later than 5 business days after receipt of 
                the notification of the election through the 
                system established under paragraph (5), in the 
                case of a request made at the time the consumer 
                provides notification through the system.
          (4) Effectiveness of election.--An election of a 
        consumer under paragraph (1)--
                  (A) shall be effective with respect to a 
                consumer reporting agency beginning 5 business 
                days after the date on which the consumer 
                notifies the agency in accordance with 
                paragraph (2);
                  (B) shall be effective with respect to a 
                consumer reporting agency--
                          (i) subject to subparagraph (C), 
                        during the 5-year period beginning 5 
                        business days after the date on which 
                        the consumer notifies the agency of the 
                        election, in the case of an election 
                        for which a consumer notifies the 
                        agency only in accordance with 
                        paragraph (2)(A); or
                          (ii) until the consumer notifies the 
                        agency under subparagraph (C), in the 
                        case of an election for which a 
                        consumer notifies the agency in 
                        accordance with paragraph (2)(B);
                  (C) shall not be effective after the date on 
                which the consumer notifies the agency, through 
                the notification system established by the 
                agency under paragraph (5), that the election 
                is no longer effective; and
                  (D) shall be effective with respect to each 
                affiliate of the agency.
          (5) Notification system.--
                  (A) In general.--Each consumer reporting 
                agency that, under subsection (c)(1)(B), 
                furnishes a consumer report in connection with 
                a credit or insurance transaction that is not 
                initiated by a consumer shall--
                          (i) establish and maintain a 
                        notification system, including a toll-
                        free telephone number, which permits 
                        any consumer whose consumer report is 
                        maintained by the agency to notify the 
                        agency, with appropriate 
                        identification, of the consumer's 
                        election to have the consumer's name 
                        and address excluded from any such list 
                        of names and addresses provided by the 
                        agency for such a transaction; and
                          (ii) publish by not later than 365 
                        days after the date of enactment of the 
                        Consumer Credit Reporting Reform Act of 
                        1996, and not less than annually 
                        thereafter, in a publication of general 
                        circulation in the area served by the 
                        agency--
                                  (I) a notification that 
                                information in consumer files 
                                maintained by the agency may be 
                                used in connection with such 
                                transactions; and
                                  (II) the address and toll-
                                free telephone number for 
                                consumers to use to notify the 
                                agency of the consumer's 
                                election under clause (i).
                  (B) Establishment and maintenance as 
                compliance.--Establishment and maintenance of a 
                notification system (including a toll-free 
                telephone number) and publication by a consumer 
                reporting agency on the agency's own behalf and 
                on behalf of any of its affiliates in 
                accordance with this paragraph is deemed to be 
                compliance with this paragraph by each of those 
                affiliates.
          (6) Notification system by agencies that operate 
        nationwide.--Each consumer reporting agency that 
        compiles and maintains files on consumers on a 
        nationwide basis shall establish and maintain a 
        notification system for purposes of paragraph (5) 
        jointly with other such consumer reporting agencies.
  (f) Certain Use or Obtaining of Information Prohibited.--A 
person shall not use or obtain a consumer report for any 
purpose unless--
          (1) the consumer report is obtained for a purpose for 
        which the consumer report is authorized to be furnished 
        under this section; and
          (2) the purpose is certified in accordance with 
        section 607 by a prospective user of the report through 
        a general or specific certification.
  (g) Protection of Medical Information.--
          (1) Limitation on consumer reporting agencies.--A 
        consumer reporting agency shall not furnish for 
        employment purposes, or in connection with a credit or 
        insurance transaction, a consumer report that contains 
        medical information (other than medical contact 
        information treated in the manner required under 
        section 605(a)(6)) about a consumer, unless--
                  (A) if furnished in connection with an 
                insurance transaction, the consumer 
                affirmatively consents to the furnishing of the 
                report;
                  (B) if furnished for employment purposes or 
                in connection with a credit transaction--
                          (i) the information to be furnished 
                        is relevant to process or effect the 
                        employment or credit transaction; and
                          (ii) the consumer provides specific 
                        written consent for the furnishing of 
                        the report that describes in clear and 
                        conspicuous language the use for which 
                        the information will be furnished; or
                  (C) the information to be furnished pertains 
                solely to transactions, accounts, or balances 
                relating to debts arising from the receipt of 
                medical services, products, or devises, where 
                such information, other than account status or 
                amounts, is restricted or reported using codes 
                that do not identify, or do not provide 
                information sufficient to infer, the specific 
                provider or the nature of such services, 
                products, or devices, as provided in section 
                605(a)(6).
          (2) Limitation on creditors.--Except as permitted 
        pursuant to paragraph (3)(C) or regulations prescribed 
        under paragraph (5)(A), a creditor shall not obtain or 
        use medical information (other than medical information 
        treated in the manner required under section 605(a)(6)) 
        pertaining to a consumer in connection with any 
        determination of the consumer's eligibility, or 
        continued eligibility, for credit.
          (3) Actions authorized by federal law, insurance 
        activities and regulatory determinations.--Section 
        603(d)(3) shall not be construed so as to treat 
        information or any communication of information as a 
        consumer report if the information or communication is 
        disclosed--
                  (A) in connection with the business of 
                insurance or annuities, including the 
                activities described in section 18B of the 
                model Privacy of Consumer Financial and Health 
                Information Regulation issued by the National 
                Association of Insurance Commissioners (as in 
                effect on January 1, 2003);
                  (B) for any purpose permitted without 
                authorization under the Standards for 
                Individually Identifiable Health Information 
                promulgated by the Department of Health and 
                Human Services pursuant to the Health Insurance 
                Portability and Accountability Act of 1996, or 
                referred to under section 1179 of such Act, or 
                described in section 502(e) of Public Law 106-
                102; or
                  (C) as otherwise determined to be necessary 
                and appropriate, by regulation or order, by the 
                Bureau or the applicable State insurance 
                authority (with respect to any person engaged 
                in providing insurance or annuities).
          (4) Limitation on redisclosure of medical 
        information.--Any person that receives medical 
        information pursuant to paragraph (1) or (3) shall not 
        disclose such information to any other person, except 
        as necessary to carry out the purpose for which the 
        information was initially disclosed, or as otherwise 
        permitted by statute, regulation, or order.
          (5) Regulations and effective date for paragraph 
        (2).--
                  (A) Regulations required.--The Bureau may, 
                after notice and opportunity for comment, 
                prescribe regulations that permit transactions 
                under paragraph (2) that are determined to be 
                necessary and appropriate to protect legitimate 
                operational, transactional, risk, consumer, and 
                other needs (and which shall include permitting 
                actions necessary for administrative 
                verification purposes), consistent with the 
                intent of paragraph (2) to restrict the use of 
                medical information for inappropriate purposes.
          (6) Coordination with other laws.--No provision of 
        this subsection shall be construed as altering, 
        affecting, or superseding the applicability of any 
        other provision of Federal law relating to medical 
        confidentiality.
  (h) Prohibition on Adverse Actions Against Employees Affected 
by a Shutdown.--If a user of a consumer report knows that a 
consumer is an employee affected by a shutdown, such user may 
not take an adverse action based on--
          (1) any adverse item of information contained in such 
        report with respect to an action or inaction taken 
        during a covered shutdown period by the employee; or
          (2) information on the consumer included in the 
        database established under section 630.

Sec. 605. Requirements relating to information contained in consumer 
                    reports

  (a) Information Excluded From Consumer Reports.--Except as 
authorized under subsection (b), no consumer reporting agency 
may make any consumer report containing any of the following 
items of information:
          (1) Cases under title 11 of the United States Code or 
        under the Bankruptcy Act that, from the date of entry 
        of the order for relief or the date of adjudication, as 
        the case may be, antedate the report by more than 10 
        years.
          (2) Civil suits, civil judgments, and records of 
        arrest that, from date of entry, antedate the report by 
        more than seven years or until the governing statute of 
        limitations has expired, whichever is the longer 
        period.
          (3) Paid tax liens which, from date of payment, 
        antedate the report by more than seven years.
          (4) Accounts placed for collection or charged to 
        profit and loss which antedate the report by more than 
        seven years.
          (5) Any other adverse item of information, other than 
        records of convictions of crimes which antedates the 
        report by more than seven years.
          (6) The name, address, and telephone number of any 
        medical information furnisher that has notified the 
        agency of its status, unless--
                  (A) such name, address, and telephone number 
                are restricted or reported using codes that do 
                not identify, or provide information sufficient 
                to infer, the specific provider or the nature 
                of such services, products, or devices to a 
                person other than the consumer; or
                  (B) the report is being provided to an 
                insurance company for a purpose relating to 
                engaging in the business of insurance other 
                than property and casualty insurance.
          (7) With respect to a consumer reporting agency 
        described in section 603(p), any information related to 
        a veteran's medical debt if the date on which the 
        hospital care, medical services, or extended care 
        services was rendered relating to the debt antedates 
        the report by less than 1 year if the consumer 
        reporting agency has actual knowledge that the 
        information is related to a veteran's medical debt and 
        the consumer reporting agency is in compliance with its 
        obligation under section 302(c)(5) of the Economic 
        Growth, Regulatory Relief, and Consumer Protection Act.
          (8) With respect to a consumer reporting agency 
        described in section 603(p), any information related to 
        a fully paid or settled veteran's medical debt that had 
        been characterized as delinquent, charged off, or in 
        collection if the consumer reporting agency has actual 
        knowledge that the information is related to a 
        veteran's medical debt and the consumer reporting 
        agency is in compliance with its obligation under 
        section 302(c)(5) of the Economic Growth, Regulatory 
        Relief, and Consumer Protection Act.
          (9) Any adverse item of information with respect to 
        an action or inaction taken during a covered shutdown 
        period by an employee affected by a shutdown.
  (b) The provisions of paragraphs (1) through (5) of 
subsection (a) are not applicable in the case of any consumer 
credit report to be used in connection with--
          (1) a credit transaction involving, or which may 
        reasonably be expected to involve, a principal amount 
        of $150,000 or more;
          (2) the underwriting of life insurance involving, or 
        which may reasonably be expected to involve, a face 
        amount of $150,000 or more; or
          (3) the employment of any individual at an annual 
        salary which equals, or which may reasonably be 
        expected to equal $75,000, or more.
  (c) Running of Reporting Period.--
          (1) In general.--The 7-year period referred to in 
        paragraphs (4) and (6) of subsection (a) shall begin, 
        with respect to any delinquent account that is placed 
        for collection (internally or by referral to a third 
        party, whichever is earlier), charged to profit and 
        loss, or subjected to any similar action, upon the 
        expiration of the 180-day period beginning on the date 
        of the commencement of the delinquency which 
        immediately preceded the collection activity, charge to 
        profit and loss, or similar action.
          (2) Effective date.--Paragraph (1) shall apply only 
        to items of information added to the file of a consumer 
        on or after the date that is 455 days after the date of 
        enactment of the Consumer Credit Reporting Reform Act 
        of 1996.
  (d) Information Required To Be Disclosed.--
          (1) Title 11 information.--Any consumer reporting 
        agency that furnishes a consumer report that contains 
        information regarding any case involving the consumer 
        that arises under title 11, United States Code, shall 
        include in the report an identification of the chapter 
        of such title 11 under which such case arises if 
        provided by the source of the information. If any case 
        arising or filed under title 11, United States Code, is 
        withdrawn by the consumer before a final judgment, the 
        consumer reporting agency shall include in the report 
        that such case or filing was withdrawn upon receipt of 
        documentation certifying such withdrawal.
          (2) Key factor in credit score information.--Any 
        consumer reporting agency that furnishes a consumer 
        report that contains any credit score or any other risk 
        score or predictor on any consumer shall include in the 
        report a clear and conspicuous statement that a key 
        factor (as defined in section 609(f)(2)(B)) that 
        adversely affected such score or predictor was the 
        number of enquiries, if such a predictor was in fact a 
        key factor that adversely affected such score. This 
        paragraph shall not apply to a check services company, 
        acting as such, which issues authorizations for the 
        purpose of approving or processing negotiable 
        instruments, electronic fund transfers, or similar 
        methods of payments, but only to the extent that such 
        company is engaged in such activities.
  (e) Indication of Closure of Account by Consumer.--If a 
consumer reporting agency is notified pursuant to section 
623(a)(4) that a credit account of a consumer was voluntarily 
closed by the consumer, the agency shall indicate that fact in 
any consumer report that includes information related to the 
account.
  (f) Indication of Dispute by Consumer.--If a consumer 
reporting agency is notified pursuant to section 623(a)(3) that 
information regarding a consumer who was furnished to the 
agency is disputed by the consumer, the agency shall indicate 
that fact in each consumer report that includes the disputed 
information.
  (g) Truncation of Credit Card and Debit Card Numbers.--
          (1) In general.--Except as otherwise provided in this 
        subsection, no person that accepts credit cards or 
        debit cards for the transaction of business shall print 
        more than the last 5 digits of the card number or the 
        expiration date upon any receipt provided to the 
        cardholder at the point of the sale or transaction.
          (2) Limitation.--This subsection shall apply only to 
        receipts that are electronically printed, and shall not 
        apply to transactions in which the sole means of 
        recording a credit card or debit card account number is 
        by handwriting or by an imprint or copy of the card.
          (3) Effective date.--This subsection shall become 
        effective--
                  (A) 3 years after the date of enactment of 
                this subsection, with respect to any cash 
                register or other machine or device that 
                electronically prints receipts for credit card 
                or debit card transactions that is in use 
                before January 1, 2005; and
                  (B) 1 year after the date of enactment of 
                this subsection, with respect to any cash 
                register or other machine or device that 
                electronically prints receipts for credit card 
                or debit card transactions that is first put 
                into use on or after January 1, 2005.
  (h) Notice of Discrepancy in Address.--
          (1) In general.--If a person has requested a consumer 
        report relating to a consumer from a consumer reporting 
        agency described in section 603(p), the request 
        includes an address for the consumer that substantially 
        differs from the addresses in the file of the consumer, 
        and the agency provides a consumer report in response 
        to the request, the consumer reporting agency shall 
        notify the requester of the existence of the 
        discrepancy.
          (2) Regulations.--
                  (A) Regulations required.--The Bureau shall,, 
                in consultation with the Federal banking 
                agencies, the National Credit Union 
                Administration, and the Federal Trade 
                Commission,, prescribe regulations providing 
                guidance regarding reasonable policies and 
                procedures that a user of a consumer report 
                should employ when such user has received a 
                notice of discrepancy under paragraph (1).
                  (B) Policies and procedures to be included.--
                The regulations prescribed under subparagraph 
                (A) shall describe reasonable policies and 
                procedures for use by a user of a consumer 
                report--
                          (i) to form a reasonable belief that 
                        the user knows the identity of the 
                        person to whom the consumer report 
                        pertains; and
                          (ii) if the user establishes a 
                        continuing relationship with the 
                        consumer, and the user regularly and in 
                        the ordinary course of business 
                        furnishes information to the consumer 
                        reporting agency from which the notice 
                        of discrepancy pertaining to the 
                        consumer was obtained, to reconcile the 
                        address of the consumer with the 
                        consumer reporting agency by furnishing 
                        such address to such consumer reporting 
                        agency as part of information regularly 
                        furnished by the user for the period in 
                        which the relationship is established.

           *       *       *       *       *       *       *


Sec. 609. Disclosures to consumers

  (a) Every consumer reporting agency shall, upon request, and 
subject to section 610(a)(1), clearly and accurately disclose 
to the consumer:
          (1) All information in the consumer's file at the 
        time of the request, except that--
                  (A) if the consumer to whom the file relates 
                requests that the first 5 digits of the social 
                security number (or similar identification 
                number) of the consumer not be included in the 
                disclosure and the consumer reporting agency 
                has received appropriate proof of the identity 
                of the requester, the consumer reporting agency 
                shall so truncate such number in such 
                disclosure; and
                  (B) nothing in this paragraph shall be 
                construed to require a consumer reporting 
                agency to disclose to a consumer any 
                information concerning credit scores or any 
                other risk scores or predictors relating to the 
                consumer.
          (2) The sources of the information; except that the 
        sources of information acquired solely for use in 
        preparing an investigative consumer report and actually 
        used for no other purpose need not be disclosed: 
        Provided, That in the event an action is brought under 
        this title, such sources shall be available to the 
        plaintiff under appropriate discovery procedures in the 
        court in which the action is brought.
          (3)(A) Identification of each person (including each 
        end-user identified under section 607(e)(1)) that 
        procured a consumer report--
                  (i) for employment purposes, during the 2-
                year period preceding the date on which the 
                request is made; or
                  (ii) for any other purpose, during the 1-year 
                period preceding the date on which the request 
                is made.
          (B) An identification of a person under subparagraph 
        (A) shall include--
                  (i) the name of the person or, if applicable, 
                the trade name (written in full) under which 
                such person conducts business; and
                  (ii) upon request of the consumer, the 
                address and telephone number of the person.
          (C) Subparagraph (A) does not apply if--
                  (i) the end user is an agency or department 
                of the United States Government that procures 
                the report from the person for purposes of 
                determining the eligibility of the consumer to 
                whom the report relates to receive access or 
                continued access to classified information (as 
                defined in section 604(b)(4)(E)(i)); and
                  (ii) the head of the agency or department 
                makes a written finding as prescribed under 
                section 604(b)(4)(A).
          (4) The dates, original payees, and amounts of any 
        checks upon which is based any adverse characterization 
        of the consumer, included in the file at the time of 
        the disclosure.
          (5) A record of all inquiries received by the agency 
        during the 1-year period preceding the request that 
        identified the consumer in connection with a credit or 
        insurance transaction that was not initiated by the 
        consumer.
          (6) If the consumer requests the credit file and not 
        the credit score, a statement that the consumer may 
        request and obtain a credit score.
          (7) Information on the rights of an employee affected 
        by a shutdown, including which consumers may be an 
        employee affected by a shutdown and the process for a 
        consumer to self-certify as an employee affected by a 
        shutdown under section 630.
  (b) The requirements of subsection (a) respecting the 
disclosure of sources of information and the recipients of 
consumer reports do not apply to information received or 
consumer reports furnished prior to the effective date of this 
title except to the extent that the matter involved is 
contained in the files of the consumer reporting agency on that 
date.
  (c) Summary of Rights To Obtain and Dispute Information in 
Consumer Reports and To Obtain Credit Scores.--
          (1) Commission summary of rights required.--
                  (A) In general.--The Commission shall prepare 
                a model summary of the rights of consumers 
                under this title.
                  (B) Content of summary.--The summary of 
                rights prepared under subparagraph (A) shall 
                include a description of--
                          (i) the right of a consumer to obtain 
                        a copy of a consumer report under 
                        subsection (a) from each consumer 
                        reporting agency;
                          (ii) the frequency and circumstances 
                        under which a consumer is entitled to 
                        receive a consumer report without 
                        charge under section 612;
                          (iii) the right of a consumer to 
                        dispute information in the file of the 
                        consumer under section 611;
                          (iv) the right of a consumer to 
                        obtain a credit score from a consumer 
                        reporting agency, and a description of 
                        how to obtain a credit score;
                          (v) the method by which a consumer 
                        can contact, and obtain a consumer 
                        report from, a consumer reporting 
                        agency without charge, as provided in 
                        the regulations of the Bureau 
                        prescribed under section 211(c) of the 
                        Fair and Accurate Credit Transactions 
                        Act of 2003; and
                          (vi) the method by which a consumer 
                        can contact, and obtain a consumer 
                        report from, a consumer reporting 
                        agency described in section 603(w), as 
                        provided in the regulations of the 
                        Bureau prescribed under section 
                        612(a)(1)(C).
                  (C) Availability of summary of rights.--The 
                Commission shall--
                          (i) actively publicize the 
                        availability of the summary of rights 
                        prepared under this paragraph;
                          (ii) conspicuously post on its 
                        Internet website the availability of 
                        such summary of rights; and
                          (iii) promptly make such summary of 
                        rights available to consumers, on 
                        request.
          (2) Summary of rights required to be included with 
        agency disclosures.--A consumer reporting agency shall 
        provide to a consumer, with each written disclosure by 
        the agency to the consumer under this section--
                  (A) the summary of rights prepared by the 
                Bureau under paragraph (1);
                  (B) in the case of a consumer reporting 
                agency described in section 603(p), a toll-free 
                telephone number established by the agency, at 
                which personnel are accessible to consumers 
                during normal business hours;
                  (C) a list of all Federal agencies 
                responsible for enforcing any provision of this 
                title, and the address and any appropriate 
                phone number of each such agency, in a form 
                that will assist the consumer in selecting the 
                appropriate agency;
                  (D) a statement that the consumer may have 
                additional rights under State law, and that the 
                consumer may wish to contact a State or local 
                consumer protection agency or a State attorney 
                general (or the equivalent thereof) to learn of 
                those rights; and
                  (E) a statement that a consumer reporting 
                agency is not required to remove accurate 
                derogatory information from the file of a 
                consumer, unless the information is outdated 
                under section 605 or cannot be verified.
  (d) Summary of Rights of Identity Theft Victims.--
          (1) In general.--The Commission, in consultation with 
        the Federal banking agencies and the National Credit 
        Union Administration, shall prepare a model summary of 
        the rights of consumers under this title with respect 
        to the procedures for remedying the effects of fraud or 
        identity theft involving credit, an electronic fund 
        transfer, or an account or transaction at or with a 
        financial institution or other creditor.
          (2) Summary of rights and contact information.--
        Beginning 60 days after the date on which the model 
        summary of rights is prescribed in final form by the 
        Bureau pursuant to paragraph (1), if any consumer 
        contacts a consumer reporting agency and expresses a 
        belief that the consumer is a victim of fraud or 
        identity theft involving credit, an electronic fund 
        transfer, or an account or transaction at or with a 
        financial institution or other creditor, the consumer 
        reporting agency shall, in addition to any other action 
        that the agency may take, provide the consumer with a 
        summary of rights that contains all of the information 
        required by the Bureau under paragraph (1), and 
        information on how to contact the Bureau to obtain more 
        detailed information.
  (e) Information Available to Victims.--
          (1) In general.--For the purpose of documenting 
        fraudulent transactions resulting from identity theft, 
        not later than 30 days after the date of receipt of a 
        request from a victim in accordance with paragraph (3), 
        and subject to verification of the identity of the 
        victim and the claim of identity theft in accordance 
        with paragraph (2), a business entity that has provided 
        credit to, provided for consideration products, goods, 
        or services to, accepted payment from, or otherwise 
        entered into a commercial transaction for consideration 
        with, a person who has allegedly made unauthorized use 
        of the means of identification of the victim, shall 
        provide a copy of application and business transaction 
        records in the control of the business entity, whether 
        maintained by the business entity or by another person 
        on behalf of the business entity, evidencing any 
        transaction alleged to be a result of identity theft 
        to--
                  (A) the victim;
                  (B) any Federal, State, or local government 
                law enforcement agency or officer specified by 
                the victim in such a request; or
                  (C) any law enforcement agency investigating 
                the identity theft and authorized by the victim 
                to take receipt of records provided under this 
                subsection.
          (2) Verification of identity and claim.--Before a 
        business entity provides any information under 
        paragraph (1), unless the business entity, at its 
        discretion, otherwise has a high degree of confidence 
        that it knows the identity of the victim making a 
        request under paragraph (1), the victim shall provide 
        to the business entity--
                  (A) as proof of positive identification of 
                the victim, at the election of the business 
                entity--
                          (i) the presentation of a government-
                        issued identification card;
                          (ii) personally identifying 
                        information of the same type as was 
                        provided to the business entity by the 
                        unauthorized person; or
                          (iii) personally identifying 
                        information that the business entity 
                        typically requests from new applicants 
                        or for new transactions, at the time of 
                        the victim's request for information, 
                        including any documentation described 
                        in clauses (i) and (ii); and
                  (B) as proof of a claim of identity theft, at 
                the election of the business entity--
                          (i) a copy of a police report 
                        evidencing the claim of the victim of 
                        identity theft; and
                          (ii) a properly completed--
                                  (I) copy of a standardized 
                                affidavit of identity theft 
                                developed and made available by 
                                the Bureau; or
                                  (II) an affidavit of fact 
                                that is acceptable to the 
                                business entity for that 
                                purpose.
          (3) Procedures.--The request of a victim under 
        paragraph (1) shall--
                  (A) be in writing;
                  (B) be mailed to an address specified by the 
                business entity, if any; and
                  (C) if asked by the business entity, include 
                relevant information about any transaction 
                alleged to be a result of identity theft to 
                facilitate compliance with this section 
                including--
                          (i) if known by the victim (or if 
                        readily obtainable by the victim), the 
                        date of the application or transaction; 
                        and
                          (ii) if known by the victim (or if 
                        readily obtainable by the victim), any 
                        other identifying information such as 
                        an account or transaction number.
          (4) No charge to victim.--Information required to be 
        provided under paragraph (1) shall be so provided 
        without charge.
          (5) Authority to decline to provide information.--A 
        business entity may decline to provide information 
        under paragraph (1) if, in the exercise of good faith, 
        the business entity determines that--
                  (A) this subsection does not require 
                disclosure of the information;
                  (B) after reviewing the information provided 
                pursuant to paragraph (2), the business entity 
                does not have a high degree of confidence in 
                knowing the true identity of the individual 
                requesting the information;
                  (C) the request for the information is based 
                on a misrepresentation of fact by the 
                individual requesting the information relevant 
                to the request for information; or
                  (D) the information requested is Internet 
                navigational data or similar information about 
                a person's visit to a website or online 
                service.
          (6) Limitation on liability.--Except as provided in 
        section 621, sections 616 and 617 do not apply to any 
        violation of this subsection.
          (7) Limitation on civil liability.--No business 
        entity may be held civilly liable under any provision 
        of Federal, State, or other law for disclosure, made in 
        good faith pursuant to this subsection.
          (8) No new recordkeeping obligation.--Nothing in this 
        subsection creates an obligation on the part of a 
        business entity to obtain, retain, or maintain 
        information or records that are not otherwise required 
        to be obtained, retained, or maintained in the ordinary 
        course of its business or under other applicable law.
          (9) Rule of construction.--
                  (A) In general.--No provision of subtitle A 
                of title V of Public Law 106-102, prohibiting 
                the disclosure of financial information by a 
                business entity to third parties shall be used 
                to deny disclosure of information to the victim 
                under this subsection.
                  (B) Limitation.--Except as provided in 
                subparagraph (A), nothing in this subsection 
                permits a business entity to disclose 
                information, including information to law 
                enforcement under subparagraphs (B) and (C) of 
                paragraph (1), that the business entity is 
                otherwise prohibited from disclosing under any 
                other applicable provision of Federal or State 
                law.
          (10) Affirmative defense.--In any civil action 
        brought to enforce this subsection, it is an 
        affirmative defense (which the defendant must establish 
        by a preponderance of the evidence) for a business 
        entity to file an affidavit or answer stating that--
                  (A) the business entity has made a reasonably 
                diligent search of its available business 
                records; and
                  (B) the records requested under this 
                subsection do not exist or are not reasonably 
                available.
          (11) Definition of victim.--For purposes of this 
        subsection, the term ``victim'' means a consumer whose 
        means of identification or financial information has 
        been used or transferred (or has been alleged to have 
        been used or transferred) without the authority of that 
        consumer, with the intent to commit, or to aid or abet, 
        an identity theft or a similar crime.
          (12) Effective date.--This subsection shall become 
        effective 180 days after the date of enactment of this 
        subsection.
          (13) Effectiveness study.--Not later than 18 months 
        after the date of enactment of this subsection, the 
        Comptroller General of the United States shall submit a 
        report to Congress assessing the effectiveness of this 
        provision.
  (f) Disclosure of Credit Scores.--
          (1) In general.--Upon the request of a consumer for a 
        credit score, a consumer reporting agency shall supply 
        to the consumer a statement indicating that the 
        information and credit scoring model may be different 
        than the credit score that may be used by the lender, 
        and a notice which shall include--
                  (A) the current credit score of the consumer 
                or the most recent credit score of the consumer 
                that was previously calculated by the credit 
                reporting agency for a purpose related to the 
                extension of credit;
                  (B) the range of possible credit scores under 
                the model used;
                  (C) all of the key factors that adversely 
                affected the credit score of the consumer in 
                the model used, the total number of which shall 
                not exceed 4, subject to paragraph (9);
                  (D) the date on which the credit score was 
                created; and
                  (E) the name of the person or entity that 
                provided the credit score or credit file upon 
                which the credit score was created.
          (2) Definitions.--For purposes of this subsection, 
        the following definitions shall apply:
                  (A) Credit score.--The term ``credit 
                score''--
                          (i) means a numerical value or a 
                        categorization derived from a 
                        statistical tool or modeling system 
                        used by a person who makes or arranges 
                        a loan to predict the likelihood of 
                        certain credit behaviors, including 
                        default (and the numerical value or the 
                        categorization derived from such 
                        analysis may also be referred to as a 
                        ``risk predictor'' or ``risk score''); 
                        and
                          (ii) does not include--
                                  (I) any mortgage score or 
                                rating of an automated 
                                underwriting system that 
                                considers one or more factors 
                                in addition to credit 
                                information, including the loan 
                                to value ratio, the amount of 
                                down payment, or the financial 
                                assets of a consumer; or
                                  (II) any other elements of 
                                the underwriting process or 
                                underwriting decision.
                  (B) Key factors.--The term ``key factors'' 
                means all relevant elements or reasons 
                adversely affecting the credit score for the 
                particular individual, listed in the order of 
                their importance based on their effect on the 
                credit score.
          (3) Timeframe and manner of disclosure.--The 
        information required by this subsection shall be 
        provided in the same timeframe and manner as the 
        information described in subsection (a).
          (4) Applicability to certain uses.--This subsection 
        shall not be construed so as to compel a consumer 
        reporting agency to develop or disclose a score if the 
        agency does not--
                  (A) distribute scores that are used in 
                connection with residential real property 
                loans; or
                  (B) develop scores that assist credit 
                providers in understanding the general credit 
                behavior of a consumer and predicting the 
                future credit behavior of the consumer.
          (5) Applicability to credit scores developed by 
        another person.--
                  (A) In general.--This subsection shall not be 
                construed to require a consumer reporting 
                agency that distributes credit scores developed 
                by another person or entity to provide a 
                further explanation of them, or to process a 
                dispute arising pursuant to section 611, except 
                that the consumer reporting agency shall 
                provide the consumer with the name and address 
                and website for contacting the person or entity 
                who developed the score or developed the 
                methodology of the score.
                  (B) Exception.--This paragraph shall not 
                apply to a consumer reporting agency that 
                develops or modifies scores that are developed 
                by another person or entity.
          (6) Maintenance of credit scores not required.--This 
        subsection shall not be construed to require a consumer 
        reporting agency to maintain credit scores in its 
        files.
          (7) Compliance in certain cases.--In complying with 
        this subsection, a consumer reporting agency shall--
                  (A) supply the consumer with a credit score 
                that is derived from a credit scoring model 
                that is widely distributed to users by that 
                consumer reporting agency in connection with 
                residential real property loans or with a 
                credit score that assists the consumer in 
                understanding the credit scoring assessment of 
                the credit behavior of the consumer and 
                predictions about the future credit behavior of 
                the consumer; and
                  (B) a statement indicating that the 
                information and credit scoring model may be 
                different than that used by the lender.
          (8) Fair and reasonable fee.--A consumer reporting 
        agency may charge a fair and reasonable fee, as 
        determined by the Bureau, for providing the information 
        required under this subsection.
          (9) Use of enquiries as a key factor.--If a key 
        factor that adversely affects the credit score of a 
        consumer consists of the number of enquiries made with 
        respect to a consumer report, that factor shall be 
        included in the disclosure pursuant to paragraph (1)(C) 
        without regard to the numerical limitation in such 
        paragraph.
  (g) Disclosure of Credit Scores by Certain Mortgage 
Lenders.--
          (1) In general.--Any person who makes or arranges 
        loans and who uses a consumer credit score, as defined 
        in subsection (f), in connection with an application 
        initiated or sought by a consumer for a closed end loan 
        or the establishment of an open end loan for a consumer 
        purpose that is secured by 1 to 4 units of residential 
        real property (hereafter in this subsection referred to 
        as the ``lender'') shall provide the following to the 
        consumer as soon as reasonably practicable:
                  (A) Information required under subsection 
                (f).--
                          (i) In general.--A copy of the 
                        information identified in subsection 
                        (f) that was obtained from a consumer 
                        reporting agency or was developed and 
                        used by the user of the information.
                          (ii) Notice under subparagraph (d).--
                        In addition to the information provided 
                        to it by a third party that provided 
                        the credit score or scores, a lender is 
                        only required to provide the notice 
                        contained in subparagraph (D).
                  (B) Disclosures in case of automated 
                underwriting system.--
                          (i) In general.--If a person that is 
                        subject to this subsection uses an 
                        automated underwriting system to 
                        underwrite a loan, that person may 
                        satisfy the obligation to provide a 
                        credit score by disclosing a credit 
                        score and associated key factors 
                        supplied by a consumer reporting 
                        agency.
                          (ii) Numerical credit score.--
                        However, if a numerical credit score is 
                        generated by an automated underwriting 
                        system used by an enterprise, and that 
                        score is disclosed to the person, the 
                        score shall be disclosed to the 
                        consumer consistent with subparagraph 
                        (C).
                          (iii) Enterprise defined.--For 
                        purposes of this subparagraph, the term 
                        ``enterprise'' has the same meaning as 
                        in paragraph (6) of section 1303 of the 
                        Federal Housing Enterprises Financial 
                        Safety and Soundness Act of 1992.
                  (C) Disclosures of credit scores not obtained 
                from a consumer reporting agency.--A person 
                that is subject to the provisions of this 
                subsection and that uses a credit score, other 
                than a credit score provided by a consumer 
                reporting agency, may satisfy the obligation to 
                provide a credit score by disclosing a credit 
                score and associated key factors supplied by a 
                consumer reporting agency.
                  (D) Notice to home loan applicants.--A copy 
                of the following notice, which shall include 
                the name, address, and telephone number of each 
                consumer reporting agency providing a credit 
                score that was used:''.
                  (E) Actions not required under this 
                subsection.--This subsection shall not require 
                any person to--
                          (i) explain the information provided 
                        pursuant to subsection (f);
                          (ii) disclose any information other 
                        than a credit score or key factors, as 
                        defined in subsection (f);
                          (iii) disclose any credit score or 
                        related information obtained by the 
                        user after a loan has closed;
                          (iv) provide more than 1 disclosure 
                        per loan transaction; or
                          (v) provide the disclosure required 
                        by this subsection when another person 
                        has made the disclosure to the consumer 
                        for that loan transaction.
                  (F) No obligation for content.--
                          (i) In general.--The obligation of 
                        any person pursuant to this subsection 
                        shall be limited solely to providing a 
                        copy of the information that was 
                        received from the consumer reporting 
                        agency.
                          (ii) Limit on liability.--No person 
                        has liability under this subsection for 
                        the content of that information or for 
                        the omission of any information within 
                        the report provided by the consumer 
                        reporting agency.
                  (G) Person defined as excluding enterprise.--
                As used in this subsection, the term ``person'' 
                does not include an enterprise (as defined in 
                paragraph (6) of section 1303 of the Federal 
                Housing Enterprises Financial Safety and 
                Soundness Act of 1992).
          (2) Prohibition on disclosure clauses null and 
        void.--
                  (A) In general.--Any provision in a contract 
                that prohibits the disclosure of a credit score 
                by a person who makes or arranges loans or a 
                consumer reporting agency is void.
                  (B) No liability for disclosure under this 
                subsection.--A lender shall not have liability 
                under any contractual provision for disclosure 
                of a credit score pursuant to this subsection.

           *       *       *       *       *       *       *


Sec. 630. Database and self-certification for employees affected by a 
                    shutdown

  (a) Database.--
          (1) In general.--With respect to each shutdown, the 
        consumer reporting agencies described in section 603(p) 
        shall jointly establish a database that includes 
        employees affected by the shutdown as reported pursuant 
        to paragraph (2).
          (2) Contents of database.--
                  (A) Furloughed employees and contractors.--
                Each authority of the executive, legislative, 
                or judicial branch of the Federal Government or 
                District of Columbia shall provide to the 
                consumer reporting agencies described in 
                section 603(p) a list identifying--
                          (i) employees of such authority that 
                        are furloughed, excepted from furlough, 
                        or not receiving pay because of a 
                        shutdown; and
                          (ii) to the extent practicable, 
                        employees of contractors of such 
                        authority.
                  (B) Self-certified consumers.--A consumer 
                that self-certifies as an employee affected by 
                a shutdown pursuant to subsection (b) shall be 
                included in the database, unless the Bureau 
                determines such consumer is not an employee 
                affected by a shutdown.
          (3) Access to database.--The consumer reporting 
        agencies described in section 603(p) shall make the 
        database established under this subsection available to 
        the Bureau, other consumer reporting agencies, 
        furnishers of information to consumer reporting 
        agencies, and users of consumer reports. A consumer 
        reporting agency described in section 603(x) shall 
        periodically access the database to confirm the 
        accuracy of information such an agency has that 
        identifies a consumer as an employee affected by a 
        shutdown.
  (b) Self-certification Process.--A consumer shall be deemed 
to be an employee affected by a shutdown if such consumer self-
certifies through--
          (1) the website established under subsection (c); or
          (2) a toll-free telephone number established by a 
        consumer reporting agency.
  (c) Website.--The consumer reporting agencies described in 
section 603(p) shall jointly establish a website for a consumer 
to self-certify as an employee affected by a shutdown. Such 
website may not include any advertisement or other 
solicitation.

                             MINORITY VIEWS

    H.R. 4328 forces federal employees and others to keep their 
personal information in a new government-created database that 
has no safeguards to protect that information.
    This bill requires the three largest credit rating agencies 
to create and populate a database with information identifying 
consumers who may be struggling to make ends meet because of a 
government shutdown.
     The legislation does not permit an opt-in, nor 
does it allow federal employees, contractors, or other 
individuals impacted by a shutdown to opt-out of having their 
personal information included in this database.
     This new database would be accessible to 
potentially thousands of entities, including ``furnishers of 
information to consumer reporting agencies'' and ``users of 
consumer reports.'' The bill fails to define these terms.
     Committee Republicans are concerned this database, 
paired with broad language on which entity can access this 
database, could result in these consumers being targeted with 
predatory financial products and services.
    H.R. 4328 fails to establish minimum safeguards that would 
protect the personal information from unplanned or unauthorized 
uses.
     Previous breaches of financial entities 
demonstrate the industry is a target.
     Committee Republicans are concerned that the lack 
of privacy and security safeguards included in this bill leaves 
the names of millions of federal employees, contractors, and 
other individuals who self-certify to be vulnerable to a 
breach.
    The legislation permits individuals to self-certify if they 
believe they have been harmed by a federal government shutdown.
     Without a mechanism to determine who has actually 
been harmed by a shutdown, the bill could have additional 
negative consequences on underwriting standards. This may 
further limit access to credit for those who need it most.
    Republicans offered two commonsense amendments during 
Committee markup that would have mitigated the risks created by 
the bill--both amendments were rejected by Democrats.
       Rep. Tipton offered an amendment to limit the 
bill's scope to consumers who are directly impacted by a 
federal government shutdown.
           The amendment would have helped to 
        prevent abuse and fraud, while also preserving 
        underwriting standards.
     Rep. Riggleman offered an amendment to replace the 
bill's text with H.R. 2290, the Shutdown Guidance for Financial 
Institutions Act.
           H.R. 2290 is a productive, measured, and 
        bipartisan approach to the financial difficulties 
        facing federal employees impacted by a government 
        shutdown.
           H.R. 2290 codifies practices already 
        utilized by financial regulators and institutions. For 
        example, during the most recent government shutdown, 
        more than 100 banks offered customers loan 
        modifications, payment deadline extensions, payroll 
        advances, or low- or zero-interest rate loans, to 
        protect individuals affected by the shutdown.
           This past January, in a joint press 
        conference, the Federal Deposit Insurance Corporation, 
        Office of the Comptroller of the Currency, National 
        Credit Union Administration, Federal Reserve Board of 
        Governors, Consumer Financial Protection Bureau, and 
        Conference of State Bank Supervisors came together to 
        encourage institutions to work with consumers who were 
        negatively impacted by the shutdown.
    Ironically, one day after the Committee considered H.R. 
4328 and rejected H.R. 2290 as an amendment in committee, the 
House unanimously passed H.R. 2290, the Shutdown Guidance for 
Financial Institutions Act. Committee Republicans supported 
passage of the Shutdown Guidance for Financial Institutions Act 
and will continue to ensure that consumers impacted by a 
federal government shutdown receive the support they need.
    Republicans oppose H.R. 4328 and the creation of a new, 
unsecure database that creates an environment ripe for fraud 
and abuse.

                                   Roger Williams.
                                   Barry Loudermilk.
                                   Trey Hollingsworth.
                                   Lance Gooden.
                                   David Kustoff.
                                   William R. Timmons, IV.
                                   Scott R. Tipton.
                                   Warren Davidson.
                                   Denver Riggleman.
                                   Andy Barr.
                                   Ann Wagner.
                                   Blaine Luetkemeyer.
                                   Alexander X. Mooney.
                                   John W. Rose.
                                   Steve Stivers.
                                   J. French Hill.
                                   Van Taylor.
                                   Tom Emmer.
                                   Ted Budd.
                                   Bryan Steil.
                                   Anthony Gonzalez.
                                   Frank D. Lucas.
                                   Lee M. Zeldin.
                                   Bill Huizenga.
                                   Bill Posey.
                                   Patrick T. McHenry.

                                  [all]