[Federal Register Volume 69, Number 121 (Thursday, June 24, 2004)]
[Rules and Regulations]
[Pages 35468-35502]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 04-14388]



[[Page 35467]]

-----------------------------------------------------------------------

Part IV





Federal Trade Commission





-----------------------------------------------------------------------



16 CFR Parts 610 and 698



Free Annual File Disclosures; Final Rule

  Federal Register / Vol. 69, No. 121 / Thursday, June 24, 2004 / Rules 
and Regulations  

[[Page 35468]]


-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

16 CFR Parts 610 and 698

RIN 3084-AA94


Free Annual File Disclosures

AGENCY: Federal Trade Commission (FTC or Commission).

ACTION: Final Rule.

-----------------------------------------------------------------------

SUMMARY: The Fair and Accurate Credit Transactions Act of 2003 (FACT 
Act or the Act) requires the FTC to adopt regulations to require the 
establishment of a centralized source through which consumers may 
request a free annual file disclosure from each nationwide consumer 
reporting agency; a standardized form for such requests; and a 
streamlined process for consumers to request free annual file 
disclosures from nationwide specialty consumer reporting agencies. This 
final rule implements these requirements.

EFFECTIVE DATE: This rule is effective on December 1, 2004.

FOR FURTHER INFORMATION CONTACT: Helen Goff Foster or Sandra 
Farrington, Attorneys, Division of Financial Practices, Federal Trade 
Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580, (202) 
326-3224.

SUPPLEMENTARY INFORMATION: The final rule retains all of the 
requirements of the proposed rule, without major substantive changes, 
and adds a requirement relating to the use and disclosure of personally 
identifiable information collected through the centralized source.

Statement of Basis and Purpose

I. Background

    The Fair and Accurate Credit Transactions Act of 2003, Pub. L. 108-
159, 117 Stat. 1952 (FACT Act or the Act) was signed into law on 
December 4, 2003. In part, the Act amends the Fair Credit Reporting Act 
(FCRA), 15 U.S.C. 1681 et seq., by imposing new requirements on 
consumer reporting agencies that compile and maintain files on 
consumers on a nationwide basis (nationwide consumer reporting 
agencies), and nationwide specialty consumer reporting agencies, as 
defined by Sec. Sec.  603(p) and 603(w) of the FCRA, 15 U.S.C. 1681a(p) 
and (w), respectively. These additional requirements include the 
obligation to provide, upon request, one free file disclosure--commonly 
called a credit report--to the consumer once in a 12-month period.\1\
---------------------------------------------------------------------------

    \1\ Section 609 of the FCRA requires disclosure of ``[a]ll 
information in the consumer's file at the time of the request.'' 15 
U.S.C. 1681g(a)(1). The FACT Act refers to the requirement to make 
``all disclosures pursuant to [FCRA] section 609 once during any 12-
month period'' without charge as providing free ``consumer 
reports.'' FACT Act 211(d). To avoid confusion, the rule refers to 
disclosures made pursuant to FCRA Sec.  609 as ``file disclosures'' 
and to the free annual disclosures required under the FACT Act as 
``annual file disclosures.''
---------------------------------------------------------------------------

    The FACT Act directs the Commission to consider the concerns of 
both consumers and industry in prescribing these rules. Specifically, 
the Act directs the Commission to consider ``the significant demand 
that may be placed on consumer reporting agencies in providing such 
[annual file disclosures]; appropriate means to ensure that consumer 
reporting agencies can satisfactorily meet those demands, including the 
efficacy of a system of staggering the availability to consumers of 
such [file disclosures]; and the ease by which consumers should be able 
to contact consumer reporting agencies with respect to access to such 
[annual file disclosures].'' FACT Act Sec.  211(d)(2). In addition to 
these considerations, the FACT Act also requires the Commission to 
provide for an orderly transition for the centralized source in a 
manner that does not temporarily overwhelm the nationwide consumer 
reporting agencies with requests for annual file disclosures and does 
not deny creditors and other users access to consumer reports. FACT Act 
Sec.  211(d)(2). Finally, the FACT Act directs the Commission to 
consider, when setting the effective date for rule provisions 
applicable to the nationwide specialty consumer reporting agencies, the 
ability of each nationwide specialty consumer reporting agency to 
comply with the annual file disclosure requirements. FACT Act Sec.  211 
(a), codified at FCRA Sec.  612 (a), 15 U.S.C. Sec. 1681j (a).
    The Commission has carefully weighed all of these considerations as 
required by the FACT Act. On March 16, 2004, the Commission issued, and 
sought comment on, a proposed rule implementing the requirements of the 
FACT Act (the proposed rule).\2\ The Commission has reviewed the 
detailed comments received, which represented all points of view. In 
crafting both the proposed rule and the final rule, the Commission has 
strived to strike the balance that the FACT Act seeks between the 
availability of free annual file disclosures to consumers and the 
legitimate concerns of the consumer reporting agencies that are 
required to provide them. In issuing this final rule (the rule or the 
final rule), the Commission adopts the proposed rule with some 
modifications.
---------------------------------------------------------------------------

    \2\ The notice of proposed rulemaking (hereinafter, the NPR) and 
proposed rule were published in the Federal Register on March 19, 
2004. 69 FR 13192.
---------------------------------------------------------------------------

    Like the proposed rule, the final rule requires nationwide consumer 
reporting agencies to establish a centralized source to enable 
consumers, with a single request, to obtain annual file disclosures 
from all nationwide consumer reporting agencies, in accordance with the 
FACT Act, Sec.  211(d)(1)(A). The centralized source required by the 
final rule will provide consumers with the ability to request their 
free annual file disclosures from each of the nationwide consumer 
reporting agencies through a centralized Internet website, toll-free 
telephone number, and postal address. The rule also includes a 
standardized form for such requests, as specified in the FACT Act, 
Sec.  211(d)(1)(B). Further, the rule requires nationwide specialty 
consumer reporting agencies to establish a streamlined process for 
consumer requests for annual file disclosures, as provided in the FACT 
Act, Sec.  211(a)(2).
    The final rule limits the obligations of nationwide consumer 
reporting agencies when the volume of consumer requests for annual file 
disclosures is excessive. It permits nationwide consumer reporting 
agencies to queue requests for annual file disclosures during times of 
``high request volume''-i.e., volume that exceeds 125% of the rolling 
daily average volume. It also allows nationwide consumer reporting 
agencies to decline to accept requests during times of ``extraordinary 
request volume''-i.e., volume that exceeds 175% of the rolling daily 
average volume.
    The final rule maintains the gradual roll-out of the centralized 
source contained in the proposed rule. In order to ensure a smooth 
transition, and in response to concerns regarding the volume of 
consumers who may request annual file disclosures when the rule first 
becomes effective, the centralized source will become available to 
consumers in four cumulative stages that roll out from west to east. 
See discussion under Sec.  610.2(i) of this notice, infra. This 
transition will start on December 1, 2004, and will be completed within 
nine months, by September 1, 2005. Final rule Sec.  610.2 (i)(1). The 
final rule also provides for a lower threshold for ``high request 
volume'' during this transition period.
    In addition, the final rule retains, with some modifications, the 
proposed rulex2019;s requirements relating to nationwide 
specialty consumer reporting agencies. These agencies are required to 
establish a streamlined process for consumers to request annual file 
disclosures, final rule Sec.  610.3 (a),

[[Page 35469]]

including a toll-free telephone number for consumers to make such 
requests. The rule also requires nationwide specialty consumer 
reporting agencies to make their toll-free telephone numbers available 
to consumers in specific ways. Final rule Sec.  610.3 (a)(1). See 
discussion under Sec. 610.3 (a) of this notice, infra.

II. Overview of Comments Received.

    The Commission received more than 2,300 comments on the proposed 
rule.\3\ The vast majority of these comments were from consumers. 
Consumer advocacy groups,\4\ members of Congress, industry trade 
organizations, \5\ and various representatives of the consumer 
reporting industry -- including the three nationwide consumer reporting 
agencies,\6\ other consumer reporting agencies,\7\ and a variety of 
other interested organizations \8\--also submitted comments on the 
proposed rule.
---------------------------------------------------------------------------

    \3\ The public comments relating to this rulemaking may be 
viewed at www.ftc.gov[sol]os[sol]comments[sol]factafcr. The 
Commission considered all comments timely filed, i.e.-those received 
on or before the close of the comment period on April 16, 2004. As a 
matter of discretion, the Commission also considered comments that 
were filed after the close of the comment period. The total number 
of comments stated here includes more than 2,000 consumer comments 
collected through U.S. Public Interest Research Group, which are 
posted, in batch form, at U.S. Public Interest Research Group 
EREG000604. Citations to comments filed in this proceeding 
are made to the name of the organization (if any) or the last name 
of the commenter, and the comment number of record. Comment number 
may appear as all numeric characters-e.g., 000031 
(indicating a comment received by paper or electronic mail), or as 
numeric characters preceded by ``EREG''-e.g., ``EREG000031'' 
(indicating a comment received through www.regulations.gov).
    \4\ These include AARP, Asociac[iacute]on Campesino Lazaro 
Cardenas Inc., CEIBA, Consumer Federation of America, Consumers 
Union, Del Norte Neighborhood Development Corporation, Electronic 
Privacy Information Center, Housing and Economic Development 
Asociac[iacute]on De Puertorriquenos, Latino Leadership, Inc., 
Midland Community Development Corporation, National Association of 
Consumer Advocates, National Consumer Law Center, National Consumers 
League, National Council of La Raza, NEWSED C.D.C., Privacy Rights 
Clearinghouse, Privacy Times, Self-Help Enterprises, Spanish Action 
League, Spanish Coalition for Housing, Tejano Center for Community 
Concerns, U.S. Public Interest Research Group (US-PIRG), and 
Watts[sol]Century Latino Organization.
    \5\ In addition to Consumer Data Industry Association (CDIA)-the 
trade association that represents the nationwide consumer reporting 
agencies and a variety of other consumer reporting agencies-the 
Commission received comment on the proposed rule on behalf of a 
number of trade organizations representing a variety of industries 
and concerns. These include ACA International (representing debt 
collection agencies and other accounts receivable professionals), 
America's Community Bankers, National Association of Realtors, 
Credit Union National Association (CUNA), Consumer Credit Counselors 
of Los Angeles, National Association of Mortgage Brokers, Mortgage 
Bankers Association, and Coalition to Implement the FACT Act 
(representing trade associations and companies that furnish, use, 
collect, and disclose consumer information).
    \6\ The Commission is aware of three entities that meet the FCRA 
Sec.  603(p) definition of nationwide consumer reporting agency. 
These entities are Equifax Information Services LLC, Experian 
Information Solutions, Inc., and Trans Union LLC.
    \7\ These include ChoicePoint, Inc., Computer Sciences 
Corporation (CSC), Evergreen Credit Reporting Inc., and MIB Group, 
Inc. (MIB).
    \8\ These include Aegon Direct Marketing Services, Inc., Cendant 
Corporation, Chartered Marketing Services, Deluxe Corporation, Fair 
Isaac and Company, Inc., Intersections Inc., ReferencePro, and 
Schwartz & Ballen LLP.
---------------------------------------------------------------------------

    The Commission received comments relating to nearly every provision 
contained in the proposed rule. Most commenters -- consumer and 
industry representatives alike -- express general support for the 
concept of free annual file disclosures. Many consumers and consumer 
advocates note that free annual file disclosures will enhance consumer 
report accuracy, save consumers money, foster greater financial 
literacy, and prevent or mitigate the effects of identity theft. Some 
consumers urge the Commission to adopt provisions that extend beyond 
what the FACT Act provides: for example, requiring free file 
disclosures more often, requiring disclosure of free credit scores, or 
requiring free file disclosures from all consumer reporting agencies, 
regardless of nationwide or nationwide specialty consumer reporting 
agency status under the FCRA.
    The overwhelming majority of comments focus on one or more aspects 
of the proposed requirement for nationwide consumer reporting agencies 
to provide annual file disclosures through a ``centralized source.'' 
Proposed rule Sec.  610.2. Consumer commenters express concern about a 
variety of issues related to the centralized source. Many consumers and 
consumer advocates suggest that the final rule should include a 
limitation on the use and disclosure of information collected by 
nationwide consumer reporting agencies through the centralized source. 
Consumers also suggest that the regional roll-out of the centralized 
source, proposed rule Sec.  610.2 (i), was too long, and that it placed 
unfair burden on consumers residing in eastern states. Consumer 
advocates, on the other hand, express doubt as to the need for any type 
of gradual transition, but generally support a regional approach if 
such a transition were to be retained in the final rule. Many consumer 
advocacy groups also express concern that the proposed rule contained 
no requirement to provide file disclosures and centralized source 
information and instructions in Spanish.
    In addition, many consumers and consumer advocates urge the 
Commission to consider further restricting, or banning, advertising and 
marketing of other products through the centralized source. Many 
competitors of the nationwide consumer reporting agencies--including 
both other consumer reporting agencies\9\ as well as non-consumer 
reporting agencies\10\-- similarly advocate a final rule that would ban 
advertising and marketing through the centralized source.
---------------------------------------------------------------------------

    \9\ For example, Evergreen Credit Reporting Inc. See Comment, 
Evergreen Credit Reporting Inc.  000031.
    \10\ For example, Fair, Isaac and Company, Inc. See Comment, 
Fair, Isaac and Company, Inc. 000011.
---------------------------------------------------------------------------

    The Commission also received comments relating to the centralized 
source from both federal and state elected officials. One U.S. 
Senator\11\ and a group of members of the U.S. House of Representatives 
Committee on Financial Services\12\ express concern that the structured 
roll-out of the centralized source required by the proposed rule was 
too slow, and discriminated against consumers who reside in eastern 
states. A group of United States Senators\13\ and a different group of 
members of the U.S. House of Representatives Committee on Financial 
Services\14\ comment that the proposed rule did not provide the 
nationwide consumer reporting agencies with sufficient guidance, and 
that the safe harbor contained in the proposed rule was inadequate to 
protect these agencies from overwhelming consumer demand for annual 
file disclosures. A New York State Senator also expresses concern that 
the proposed rule did not specify how annual file disclosures should be 
delivered, contained inadequate provisions to protect consumers from 
unwanted solicitations and other uses of their personally identifiable 
information, and did not contain requirements that file disclosures and 
other information be provided to

[[Page 35470]]

consumers in languages other than English.
---------------------------------------------------------------------------

    \11\ Senator Charles E. Schumer (D-NY). See Comment, U.S. Senate 
000022.
    \12\ These Representatives included Julia Carson, Joseph 
Crowley, Harold E. Ford, Jr., Barney Frank, Luis V. Gutierrez, 
Barbara Lee, Stephen Lynch, Brad Sherman, and Maxine Waters. See 
Comment, U.S. House of Representatives 000134.
    \13\ These Senators included Robert F. Bennett, Elizabeth Dole, 
Tim Johnson, and Thomas R. Carper. Comment, United States Senate 
000137.
    \14\ These Representatives included Spencer Bachus, Judy 
Biggert, Rahm Emanuel, Jeb Hensarling, Ruben Hinojosa, Darlene 
Hooley, Steve Israel, Sue W. Kelly, Steven LaTourette, Dennis Moore, 
Robert W. Ney, Michael G. Oxley, Edward R. Royce, and David Scott. 
See Comment, U.S. House of Representatives 000136.
---------------------------------------------------------------------------

    CDIA and the nationwide consumer reporting agencies also comment at 
length on a variety of issues relating to the centralized source. They 
uniformly express concern that both the proposed rule transition and 
the provisions relating to the ``extraordinary request volume'' safe 
harbor were inadequate and, if adopted, would have subjected the 
industry to dangerous uncertainties, increased liability from private 
actions, and wasted resources. They urge the Commission to lengthen the 
transition period; convert the cumulative regional roll-out approach of 
the proposed rule to a permanent staggering of availability of free 
reports by birth month or quarter; and provide additional and lower 
safe harbor thresholds. In addition, the nationwide consumer reporting 
agencies and CDIA object to the proposed rule's requirement that 
nationwide consumer reporting agencies provide free annual file 
disclosures for consumers whose files are owned by, or maintained on 
the nationwide consumer reporting agency's system by, an associated 
consumer reporting agency.
    The Commission also received a number of comments relating to the 
proposed rule's requirement that nationwide specialty consumer 
reporting agencies implement a ``streamlined process'' for accepting 
and processing consumer requests for free annual file disclosures. 
Proposed rule Sec.  610.3. Consumer and consumer advocate comments on 
the ``streamlined process'' focus mainly on the visibility of 
nationwide specialty consumer reporting agencies and the convenience 
with which consumers should be able to contact them. A number of 
consumers comment that nationwide specialty consumer reporting agencies 
should be required to participate in the centralized source for 
nationwide consumer reporting agencies required under proposed rule 
Sec.  610.2, or that nationwide specialty consumer reporting agencies 
should also develop a joint centralized source.
    Representatives of nationwide specialty consumer reporting 
agencies\15\ express concern over the definition of that term found in 
the FACT Act. In addition, they object to the fact that the proposed 
rule did not provide nationwide speciality consumer reporting agencies 
with a structured roll-out for the required streamlined process. 
Finally, these entities urge the Commission to provide additional, and 
lower threshold safe harbors from both private and regulatory liability 
arising from unforeseen circumstances and overwhelming request volume.
---------------------------------------------------------------------------

    \15\ The Commission notes that some commenters identify 
themselves as ``nationwide specialty consumer reporting agencies.'' 
Others, however, decline to use this term, although their services 
focus on one or more of the five categories of nationwide specialty 
consumer reporting agencies. By referring to both types of 
commenters as ``nationwide specialty consumer reporting agencies'' 
here, the Commission is not making a legal determination or factual 
finding that such entities meet the statutory definition of that 
term.
---------------------------------------------------------------------------

III. Section-By-Section Analysis

Section 610.1--Definitions and rule of construction

    Section 610.1 (a) of the final rule explains that the definitions 
and the rule of construction provided in Sec.  610.1 (b) and (c) of the 
rule apply throughout Part 610. Terms not otherwise defined in Sec.  
610.1 of the rule have the meaning provided under the Fair Credit 
Reporting Act, 15 U.S.C. 1681a. See also 69 FR 29061.

Definitions.

    Section 610.1 (b) of the final rule sets forth definitions for a 
number of terms used throughout the rule.
    Annual file disclosure. The proposed rule defined ``annual file 
disclosure'' as a file disclosure that is provided to a consumer upon 
consumer request and without charge, once in any 12-month period, in 
compliance with Sec.  612(a) of the Fair Credit Reporting Act, 15 
U.S.C. 1681j(a). Proposed rule Sec.  610.1(b)(1). A consumer advocacy 
group suggests that this definition be revised to provide for free file 
disclosures ``once in a calendar year.''\16\ Such a definition, 
however, conflicts with the language of the FACT Act, which states free 
file disclosures should be provided ``once during any 12-month 
period.'' FACT Act Sec.  211 (a)(2), codified at FCRA Sec.  612 (a)(1), 
15 U.S.C. 1691j (a)(1) (emphasis supplied). The Commission therefore 
has adopted the proposed rule definition of annual file disclosure in 
the final rule.
---------------------------------------------------------------------------

    \16\ Comment, Electronic Privacy Information Center 
EREG000594.
---------------------------------------------------------------------------

    Associated consumer reporting agency. Section 610.1(b)(2) of the 
proposed rule defined an ``associated consumer reporting agency'' as a 
consumer reporting agency that maintains consumer reports within 
systems operated by a nationwide consumer reporting agency. In the NPR, 
the Commission noted that nationwide consumer reporting agencies have 
contractual relationships with a number of regional or local consumer 
reporting agencies. 69 FR at 13197. These regional or local consumer 
reporting agencies, traditionally called ``service bureaus'' or 
``affiliates,'' generally are independently owned and operated 
entities--they are not corporate affiliates of a nationwide consumer 
reporting agency.\17\ Rather, typically, they have a right to house 
some or all of the consumer data that they own on the systems of one or 
more nationwide consumer reporting agencies. The nationwide consumer 
reporting agency with whom such an entity is associated, in turn, has 
the right to sell that consumer data to its customers.\18\ The final 
rule, like the proposed rule, addresses these consumer reporting 
agencies as ``associated consumer reporting agencies.''
---------------------------------------------------------------------------

    \17\ That is to say, associated consumer reporting agencies 
generally are not under common ownership or control with a 
nationwide consumer reporting agency. See FACT Act Sec.  2 (4).
    \18\ The associated consumer reporting agency may also have the 
right to sell consumer information owned by the nationwide consumer 
reporting agency.
---------------------------------------------------------------------------

    One associated consumer reporting agency comments that this 
description of associated consumer reporting agencies appropriately 
describes the relationship between these agencies and nationwide 
consumer reporting agencies. Both the associated consumer reporting 
agency commenter and a nationwide consumer reporting agency, however, 
suggest that the proposed rule definition of ``associated consumer 
reporting agency'' should be altered slightly. These commenters both 
note that many, if not all, associated consumer reporting agencies own 
-- rather than merely maintain -- the files that they house in 
nationwide consumer reporting agency systems. Accordingly, the final 
rule definition of associated consumer reporting agency is ``a consumer 
reporting agency that owns or maintains consumer files housed within 
systems operated by one or more nationwide consumer reporting 
agencies.'' Final rule Sec.  610.1(b)(2) (emphasis supplied).
    Consumer. The proposed rule adopted the definition of ``consumer'' 
that is found in Sec.  603 (c) of the FCRA, 15 U.S.C. 1681a (c). The 
Commission received no comments suggesting changes to this definition, 
and it is adopted as proposed. Final rule Sec.  610.1(b)(3).
    Consumer report. The proposed rule adopted the definition of 
``consumer report'' that is found in Sec.  603(d) of the FCRA, 15 
U.S.C. 1681a(d). The Commission received no comments suggesting changes 
to this definition, and it is adopted as proposed. Final rule Sec.  
610.1(b)(4).
    Consumer reporting agency. The proposed rule adopted the definition 
of ``consumer reporting agency'' that is found in Sec.  603 (f) of the 
FCRA, 15 U.S.C.

[[Page 35471]]

1681a (f). The Commission received no comments suggesting changes to 
this definition, and it is adopted as proposed. Final rule Sec.  
610.1(b)(5).
    Extraordinary request volume. Under the proposed rule, 
``extraordinary request volume'' occurred (except as provided in Sec.  
610.2 (i)(2)) ``when the number of consumers requesting file 
disclosures during any 24-hour period is more than twice the daily 
rolling 90-day average of consumers requesting file disclosures.'' For 
reasons discussed under Sec.  610.2 (e) of this notice, infra, the 
Commission modifies the proposed rule definition of extraordinary 
request volume to volume that ``is more than 175% of the rolling 90-day 
daily average of consumers requesting or attempting to request file 
disclosures.'' Final rule Sec.  610.1(b)(6).
    File disclosure. The proposed rule, Sec.  610.1(b)(7), defined a 
``file disclosure'' as any disclosure made pursuant to Sec.  609 of the 
FCRA.\19\ Section 612(a) of the FCRA, 15 U.S.C. 1681j(a), as amended by 
the FACT Act, provides that nationwide consumer reporting agencies and 
nationwide specialty consumer reporting agencies must provide ``all 
disclosures pursuant to [FCRA] section 609 once during any 12-month 
period upon request of the consumer and without charge to the 
consumer.'' Accordingly, under proposed rule Sec.  610.1(b)(1), the 
term ``annual file disclosure'' was a file disclosure made upon 
request, free of charge, in compliance with Sec.  612(a) of the FCRA, 
15 U.S.C. 1681j(a), as amended. Although FCRA Sec. Sec.  612(b)-(e) 
provide for other types of free file disclosures, the term ``annual 
file disclosure,'' as defined in the proposed rule, referred only to 
free file disclosures made pursuant to FCRA Sec.  612(a).\20\
---------------------------------------------------------------------------

    \19\ Section 609 of the FCRA, 15 U.S.C. 1681g, requires every 
consumer reporting agency, upon request of the consumer, to disclose 
to the consumer, among other things, ``all information in the 
consumer's file at the time of the request.''
    \20\ It should be noted that the FCRA, as amended by the FACT 
Act, requires consumer reporting agencies to provide a free file 
disclosure to consumers under a number of different circumstances. 
In addition, under FCRA Sec.  612(f), 15 U.S.C. 1681j(f), a consumer 
reporting agency must provide file disclosures to consumers for a 
fee, upon request. The requirement for nationwide consumer reporting 
agencies to provide annual file disclosures supplements, but does 
not replace, these other provisions. In other words, a consumer is 
entitled to obtain a free annual file disclosure through the 
centralized source, once in any 12-month period, even if that 
consumer has obtained other free or paid file disclosures in that 
time period. See FCRA Sec.  612, 15 U.S.C. 1681j.
---------------------------------------------------------------------------

    One nationwide specialty consumer reporting agency requests that 
the Commission consider limiting the definition of file disclosure, as 
it applies to nationwide specialty consumer reporting agencies, to 
require only the disclosure of specific types of information. This 
commenter notes that the FACT Act specifically limits the types of 
nationwide specialty consumer reporting agencies that must provide 
annual file disclosures to only those that compile or maintain 
information on medical records or payments; residential or tenant 
history; check writing history; employment history; or insurance 
claims. See FCRA Sec.  603(w), 15 U.S.C. 1681a(w). Thus, the commenter 
posits, Congress must also have intended to circumscribe the content of 
such file disclosures to only the types of information listed in the 
definition of nationwide specialty consumer reporting agency.
    While the FACT Act limits ``nationwide specialty consumer reporting 
agencies'' to specific types of entities -- i.e., those that compile 
and maintain medical records or payments, residential or tenant 
history, check writing history, employment history, or insurance claims 
-- the plain language of the Act is broader in describing what 
information those entities must provide to consumers. The FACT Act 
specifically requires nationwide consumer reporting agencies to make 
all disclosures required by Sec.  609 of the FCRA, which, by the terms 
of that section, must include ``all information in the consumer's file 
at the time of the request.''\21\ The Commission therefore declines to 
limit the scope of the required disclosures as the commenter suggests. 
The final rule adopts the proposed rule definition of file disclosure 
without modification. Final rule Sec.  610.1(b)(7).
---------------------------------------------------------------------------

    \21\ FCRA Sec.  609(a), 15 U.S.C. 1681g(a).
---------------------------------------------------------------------------

    High request volume. A definition of ``high request volume'' was 
used in the transition section--Sec.  610.2(i)(3)-- of the proposed 
rule. Under that section, during the transition period, ``high request 
volume'' occurred when the number of consumers who contact or attempt 
to contact the centralized source, a particular request method, or a 
nationwide consumer reporting agency, in a 24-hour period, is more than 
115% of the rolling 7-day average number of consumers who contacted or 
attempted to contact the centralized source, a particular request 
method, or a nationwide consumer reporting agency, to request file 
disclosures. Proposed rule Sec.  610.2(i)(3). For reasons discussed 
under Sec. Sec.  610.2(e) and 610.3(c) of this notice, infra, the final 
rule broadens the concept of high request volume to apply both during 
and after the defined transition periods. The final rule defines high 
request volume as occurring when the number of consumers requesting or 
attempting to request file disclosures during any 24-hour period is 
more than 125% of the daily rolling 90-day average of consumers 
requesting or attempting to request file disclosures. As with 
extraordinary request volume, high request volume is defined 
differently during the transition period. See discussion under 
Sec. Sec.  610.2(i) and 610.3(g) of this notice, infra.
    Nationwide consumer reporting agency. Under proposed rule Sec.  
610.1(b)(8), the term ``nationwide consumer reporting agency'' meant a 
consumer reporting agency that compiles and maintains files on 
consumers on a nationwide basis, as defined in FCRA Sec.  603(p), 15 
U.S.C. 1681a(p). The Commission received no comments suggesting changes 
to this definition, and it is adopted as proposed. Final rule Sec.  
610.1(b)(9).
    Nationwide specialty consumer reporting agency. The term 
``nationwide specialty consumer reporting agency'' was defined under 
Sec.  610.1(b)(9) of the proposed rule, in accordance with FCRA Sec.  
603(w), 15 U.S.C. 1681a(w), as a consumer reporting agency that 
compiles and maintains files on consumers relating to medical records 
or payments, residential or tenant history, check writing history, 
employment history, or insurance claims, on a nationwide basis. One 
nationwide specialty consumer reporting agency urges the Commission to 
expand on the statutory definition of this term. The commenter argues 
that because the FACT Act added this definition to the FCRA, and 
because there is little or no legislative history to guide companies in 
the interpretation of this new definition, the Commission should 
further delineate the meaning of the term. Specifically, the commenter 
urges the Commission to adopt specific, limited meanings for the 
categories of information described in the definition of nationwide 
specialty consumer reporting agency. This same commenter similarly 
urges the Commission to define two other terms found within the 
definition of nationwide specialty consumer reporting agency: 
``compiles and maintains'' and ``nationwide.''\22\
---------------------------------------------------------------------------

    \22\ Comment, Choicepoint 000039.
---------------------------------------------------------------------------

    The Commission notes that the definition of the term nationwide 
specialty consumer reporting agency is set out in the FACT Act with 
some specificity. By the terms of the Act, its application is limited 
to a consumer reporting agency. Further, such consumer reporting agency 
must

[[Page 35472]]

compile and maintain files on consumers, on a nationwide basis, 
relating to at least one of five specific categories of information. 
The record as developed through this rulemaking provides insufficient 
information to justify altering the definition used by Congress in the 
FACT Act. Accordingly, the Commission declines to do so. Nor does the 
Commission find it appropriate, in this rulemaking, to define terms -- 
such as ``nationwide'' and ``compiles and maintains''-- that appeared 
in the FCRA prior to the FACT Act. The definition of nationwide 
specialty consumer reporting agency is adopted in the final rule as 
proposed. Final rule Sec.  610.1(b)(10).
    Request method. Proposed rule Sec.  610.1(b)(10) defined ``request 
method'' as the method by which a consumer chooses to communicate a 
request for an annual file disclosure. The FACT Act requires nationwide 
consumer reporting agencies, subject to regulations to be promulgated 
by the Commission, to establish a centralized source that will permit 
consumers to make such requests by three specific request methods: 
Internet website, toll-free telephone number, and mail. The Commission 
received no comments suggesting changes to this definition, and it is 
adopted as proposed. Final rule Sec.  610.1(b)(11).
    Rule of construction.
    Section 610.1(c) of the proposed rule sets out a rule of 
construction to clarify the effect of the examples used in the proposed 
rule. Given the complexity of the rule and its potential impact on a 
variety of entities, the Commission has elected, in some instances, to 
provide examples of conduct that would, and would not, comply with the 
proposed rule. This section of the proposed rule provided that these 
examples are not intended to be exhaustive; they are intended to 
illustrate how the proposed rule would apply in specific circumstances. 
Representatives of the nationwide consumer reporting agencies comment 
that the examples in the proposed rule, coupled with this rule of 
construction, provide useful guidance for complying with the rule. The 
Commission received no comments suggesting changes to this provision, 
and it is adopted as proposed. Final rule Sec.  610.1(c).

Section 610.2(a)--Centralized source for requesting annual file 
disclosures - purpose

    Under Sec.  610.2(a) of the proposed rule, the purpose of the 
centralized source, consistent with Sec.  211(d) of the FACT Act, was 
to enable consumers to make a single request to obtain annual file 
disclosures from all nationwide consumer reporting agencies, as 
required under Sec.  612(a) of the Fair Credit Reporting Act, 15 U.S.C. 
1681j(a). Some commenters suggest that the rule should be crafted to 
fulfill other purposes as well. For example, several consumer comments 
suggest that the rule require that credit scores be made available to 
consumers without charge, free file disclosures be made available more 
than once a year, and all consumer reporting agencies, not just 
nationwide consumer reporting agencies, be required to participate in 
the centralized source. These proposals are all inconsistent with the 
plain language of the FACT Act. Under Sec.  212 of the FACT Act, 
codified at FCRA Sec.  609(a)(6) and (f), 15 U.S.C. 1681g(a)(6) and 
(f), information about credit scores must be provided to consumers 
requesting file disclosures, and the scores themselves, together with 
additional information about them, must be provided, upon request, for 
a ``fair and reasonable fee.'' The statute also specifically limits the 
free annual file disclosure requirement to nationwide consumer 
reporting agencies and nationwide specialty consumer reporting 
agencies. Furthermore, it limits the operation of the centralized 
source to the nationwide consumer reporting agencies. FACT Act Sec.  
211(a)(2), codified at FCRA Sec.  612(a)(1), 15 U.S.C. 1681j(a)(1). 
Accordingly, Sec.  610.2(a) has been adopted as proposed.

Section 610.2(b)--Establishment and operation

    Under Sec.  610.2(b) of the proposed rule, the nationwide consumer 
reporting agencies were required to jointly design, fund, implement, 
maintain, and operate the centralized source for the purpose stated in 
Sec.  610.2(a). In addition, the centralized source was required to be 
designed, funded, implemented, maintained, and operated to meet 
specific requirements.
    Joint establishment and operations.
    Representatives of nationwide consumer reporting agencies object to 
the proposed rule requirement that the centralized source be 
``jointly'' designed, funded, implemented, maintained, and operated. 
They argue that the FACT Act does not require such joint establishment 
and operation. The FACT Act, however, does require the Commission to 
``prescribe regulations applicable to consumer reporting agencies 
described in section 603(p) [of FCRA], to require the establishment of 
a centralized source through which consumers may obtain [annual file 
disclosures].'' FACT Act Sec.  211(d)(1). Such a ``centralized source'' 
-- if it is to function as the Act contemplates -- must be a joint 
effort of the nationwide consumer reporting agencies. Thus, the 
Commission believes it is appropriate to require that the centralized 
source be jointly designed, funded, implemented, maintained, and 
operated by nationwide consumer reporting agencies, and the final rule 
adopts this provision without modification. Final rule Sec.  610.2(b).
    Potential competitive concerns among existing nationwide consumer 
reporting agencies. CDIA comments that it is unaware of any 
anticompetitive concerns that are raised by the proposed rule's 
implementation of the statutory requirement that the nationwide 
consumer reporting agencies jointly design, fund, implement, maintain, 
and operate the centralized source through which consumers may request 
their free file disclosures. The commenter points out that the 
nationwide consumer reporting agencies have operated the automated 
dispute resolution system required by FCRA Sec.  611(a)(5)(D) without 
any competitive problems.
    Further, although the final rule, like the proposed rule, requires 
nationwide consumer reporting agencies, which presumably are 
competitors, to jointly design, fund, implement, maintain, and operate 
the centralized source required under the FACT Act, nothing in the rule 
would permit any activity that is otherwise prohibited by applicable 
United States antitrust laws. One nationwide consumer reporting agency 
comments that this analysis interjects uncertainty into the ability of 
nationwide consumer reporting agencies to comply with existing 
antitrust law and the FACT Act simultaneously. As a result, the 
nationwide consumer reporting agencies urge the Commission to make 
clear that the coordination required by the statute and the rule is not 
subject to antitrust enforcement as it relates to the operation of the 
centralized source. As stated above, participation in the centralized 
source as required by the FACT Act and the final rule is not a 
violation of U.S. antitrust laws, which allow collaboration as long as 
it is not anticompetitive. The converse, however, is also true: Neither 
the FACT Act nor the final rule would permit nationwide consumer 
reporting agencies to engage in anticompetitive activities that would 
otherwise violate applicable antitrust laws.
    New entrants and barriers to entry. The Commission is aware of 
three entities that meet the FCRA Sec.  603(p) definition of nationwide 
consumer

[[Page 35473]]

reporting agency.\23\ It is possible, however, that additional 
nationwide consumer reporting agencies may exist, or be created, in the 
future. Any entity that meets the definition of nationwide consumer 
reporting agency in FCRA Sec.  603(p), 15 U.S.C. 1681a(p), cannot be 
excluded by the currently identified nationwide consumer reporting 
agencies from participating jointly in the centralized source.
---------------------------------------------------------------------------

    \23\ These entities are Equifax Information Services LLC, 
Experian Information Solutions, Inc., and Trans Union LLC.
---------------------------------------------------------------------------

    One nationwide consumer reporting agency expresses concern that the 
``joint'' establishment requirements might be interpreted to mean that 
the centralized source should be redesigned and reimplemented each time 
a new entrant is presented. The Commission agrees that to cause the 
entire centralized source to be reinvented for a new entrant would be 
inappropriate. Rather, Sec.  610.2(b) of the rule contemplates that the 
centralized source would be modified only as necessary to allow 
consumers to request file disclosures from new entrants with the same 
ease as they can request file disclosures from existing participants.
    Further, representatives of the nationwide consumer reporting 
agencies comment that the existing nationwide consumer reporting 
agencies, who will bear the costs of initial development and 
implementation of the centralized source, should be permitted to 
require any new entrants to reimburse them for the initial development 
and implementation costs associated with the centralized source. In 
contrast, some marketers of credit-related products and services 
express concern that the existing nationwide consumer reporting 
agencies will seek to impose unreasonable costs on potential new 
entrants to the centralized source in order to create an unreasonable 
barrier to entry. While the rule requires that the centralized source 
be jointly funded, it does not state how costs are to be shared among 
the nationwide consumer reporting agencies. In the Commission's view, 
final rule Sec.  610.2(b), which specifically requires joint funding, 
would permit both the sharing of ongoing operating costs as well as the 
reimbursement of design and development costs in an equitable manner. 
Section 610.2 of the final rule should not be used unreasonably to 
prevent new entrants from participating in the centralized source.
    One nationwide consumer reporting agency urges the Commission to 
``assume responsibility'' for identifying new entrants -- i.e., those 
consumer reporting agencies that meet the definition of nationwide 
consumer reporting agency, and thus, must participate in the 
centralized source. This commenter argues that the determination of 
whether a particular consumer reporting agency is a nationwide consumer 
reporting agency should not be made by competitors of that agency. The 
Commission agrees that such a determination should not be made by an 
entity's competitors. It does not follow, however, that the 
determination must then be made by the Commission. The determination of 
whether an entity meets the statutory definition of a nationwide 
consumer reporting agency-like the determination of whether an entity 
meets the definition of a consumer reporting agency-is fact specific. 
Thus, as is true with the determination of whether an entity is a 
consumer reporting agency, the entity itself must analyze its practices 
in light of the statute and existing law, and make its own 
determination.\24\
---------------------------------------------------------------------------

    \24\ Some commenters offer a similar argument in relation to the 
determination of what entities are nationwide specialty consumer 
reporting agencies. These commenters suggest that the Commission 
publish a list of such entities. For the reasons explained here, the 
Commission does not believe such a list would be appropriate.
---------------------------------------------------------------------------

    Joint and several liability. The final rule requirement for joint 
design, funding, implementation, maintenance, and operation of the 
centralized source suggests that all nationwide consumer reporting 
agency participants in the centralized source could be jointly liable 
for violations of final rule Sec.  610.2. The nationwide consumer 
reporting agencies and CDIA object to the idea that a nationwide 
consumer reporting agency could be held jointly and severally liable 
for violations committed by one or more of the others, over which that 
entity had no control. The Commission recognizes that any question of 
individual or joint and several liability would be fact specific. The 
Commission does not intend to alter existing applicable standards of 
liability.
    Required Request Methods.
    As specified under the FACT Act, Sec.  211(d)(3), final rule Sec.  
610.2(b)(1), like the proposed rule, requires the centralized source to 
include a toll-free telephone number, an Internet website, and a mail 
process for consumers to make requests for annual file disclosures. 
Comments received relating to this provision of the proposed rule 
generally note that it is consistent with the mandate of the FACT Act. 
The Act requires the nationwide consumer reporting agencies to 
establish a centralized source through which, by means of a single 
request, consumers may obtain annual file disclosures. As noted in the 
NPR, the FACT Act requires that consumers be able to request their 
annual file disclosures through specific request methods, but does not 
mandate the method by which the nationwide consumer reporting agencies 
may deliver those file disclosures. 69 FR at 13194.
    Some commenters express concern regarding particular aspects of how 
the request methods might be presented. One nationwide consumer 
reporting agency commenter urges the Commission to clarify that the 
FACT Act and the final rule do not require any ``live'' telephone 
assistance to consumers requesting file disclosures. The final rule, 
like the proposed rule, requires nationwide consumer reporting agencies 
to provide the request methods mandated by the Act, but does not 
provide detailed specifications on how each request method should be 
presented. The Commission notes that there is nothing in the FACT Act 
that would either require or prohibit a completely automated telephone 
system for accepting file disclosure requests.
    Several commenters urge the Commission to specify in the final rule 
how annual file disclosures may be provided to consumers who request 
them. One consumer advocacy group supports requiring that all three 
reports be generated simultaneously, in order to facilitate comparison. 
Some consumers, on the other hand, urge the Commission to specify that 
the reports do not have to be provided at the same time, arguing that a 
consumer may wish to monitor their file disclosures over the course of 
a year. Because the consumer is entitled to a free file disclosure from 
each nationwide consumer reporting agency, that consumer may, for 
example, choose to order only one file disclosure every four months. 
The Commission believes that the divergence of opinion on this point 
illustrates the need for flexibility. Because neither the FACT Act, nor 
the final rule, specifies that all annual file disclosures must be 
delivered simultaneously, consumers benefit from having a choice of 
when they would prefer to request any, or all, of the available annual 
file disclosures.
    One state official argues that the final rule must specify by what 
means annual file disclosures may be provided. The commenter argues 
that, without specificity in the final rule, nationwide consumer 
reporting agencies might limit the available methods of delivery in 
such a way as to effectively thwart certain consumers from obtaining 
annual file disclosures. Representatives

[[Page 35474]]

of the nationwide consumer reporting agencies, on the other hand, argue 
that the proposed rule improperly allows consumers alone to select the 
delivery channel for annual file disclosures.
    FCRA Sec.  610(b), 15 U.S.C. 1681h(b), specifies that disclosures 
may be made in such form as may be specified by the consumer and 
available from the agency. Thus, the proposed rule allowed nationwide 
consumer reporting agencies flexibility in determining what methods of 
annual file disclosure delivery to make available generally to 
consumers. Similarly the final rule neither prohibits nor requires any 
particular method of delivery for annual file disclosures. The 
Commission notes that the FCRA, notwithstanding the FACT Act 
amendments, already specifies, in some detail, how file disclosures may 
be delivered to consumers.\25\ See FCRA Sec.  610(a)-(b), 15 U.S.C. 
1681h(a)-(b). Because the delivery of file disclosures to consumers is 
already delineated in the FCRA, the final rule neither adds to nor 
subtracts from those pre-existing provisions of law.\26\
---------------------------------------------------------------------------

    \25\ FCRA Sec.  610(a)(2), 15 U.S.C. 1681h(a)(2), requires that 
file disclosures be made in writing, except as provided in 
subsection (b). Section 610(b), 15 U.S.C. 1681h(b), in turn, 
provides that disclosures may be made in forms other than in writing 
if such disclosures are (1) available from the consumer reporting 
agency and (2) specified by the consumer. Under Sec.  610(b)(2), 15 
U.S.C. 1681h(b)(2), consumers may specify that file disclosures may 
be made in person (under specified conditions), by telephone (upon 
written request), by electronic means (if available from the 
consumer reporting agency) or any other reasonable means that is 
available from the agency. Thus, under FCRA Sec.  610(b), it is 
clear that consumers may specify any means of delivery for their 
file disclosures that are available from the consumer reporting 
agency.
    \26\ Similarly, some consumers suggest that the final rule 
should require that annual file disclosures be delivered within a 
specified period of time. The Commission notes that the FACT Act 
itself sets forth the appropriate timing for delivery of annual file 
disclosures. Under FACT Act Sec.  211(a)(2), codified at FCRA Sec.  
612(a)(2), 15 U.S.C. 1681j(a)(2), ``a consumer reporting agency 
shall provide [an annual file disclosure] not later than 15 days 
after the date on which the request is received . . ..'' In light of 
this clear statutory mandate, the final rule does not further 
specify the timing for delivery of annual file disclosures.
---------------------------------------------------------------------------

    Adequate capacity.
    Under Sec.  610.2(b)(2)(i) of the proposed rule, the centralized 
source was required to have adequate capacity to accept requests from 
the reasonably anticipated volume of consumers contacting the 
centralized source through each request method. The reasonably 
anticipated volume was required to be determined in compliance with 
Sec.  610.2(c), discussed infra. Under the FACT Act, nationwide 
consumer reporting agencies must fulfill consumers' requests for free 
annual disclosures ``only if the request from the consumer is made 
using the centralized source established for such purpose.'' FACT Act 
Sec.  211(a)(2), codified at FCRA Sec.  612(a)(1)(B), 15 U.S.C. 
1681j(a)(1)(B). In recognition of the importance of a centralized 
source with adequate capacity to ensure the ability of consumers to 
obtain annual file disclosures, the final rule adopts Sec.  
610.2(b)(2)(i) as proposed, and thus requires that the centralized 
source be designed, funded, implemented, maintained, and operated in a 
manner that has adequate capacity to accept requests from the 
reasonably anticipated volume of consumers contacting the centralized 
source. Final rule Sec.  610.2(b)(2)(i).
    It is important to note that, under the final rule, nationwide 
consumer reporting agencies are required to anticipate the number of 
consumers who will contact the centralized source. Because nationwide 
consumer reporting agencies must meet this requirement during the 
transition periods defined by the final rule under Sec.  610.2(i), this 
language is intended to include consumers who contact the centralized 
source at a time when it is not yet available in their state. In the 
Commission's view, the nationwide consumer reporting agencies may 
employ technological or other means (such as blocking non-eligible area 
codes during the transition) to prevent consumers from mistakenly 
contacting the centralized source during the transition at a time when 
they are not eligible to receive an annual file disclosure.
    The Commission received few comments on this provision itself.\27\ 
CDIA comments that ``it is entirely appropriate to require that the 
nationwide consumer reporting agencies build and maintain each 
individual request method of the centralized source to anticipate 
consumer's request volume when there is data upon which to estimate 
demand.''\28\ The Commission agrees, and Sec.  610.2(b)(2)(i) is 
adopted as proposed.
---------------------------------------------------------------------------

    \27\ The Commission did, however, receive numerous comments on 
its companion provision, Sec.  610.2(c), which requires reasonable 
procedures to anticipate and respond to the volume of consumer 
requests. See discussion under Sec.  610.2(c) of this notice, infra.
    \28\ Comment, CDIA 000018
---------------------------------------------------------------------------

    Collection of information and identification of consumers.
    The proposed rule, in Sec.  610.2(b)(2)(ii), required that the 
nationwide consumer reporting agencies collect only as much information 
from a consumer through the centralized source as is reasonably 
necessary in order to properly identify the consumer and to process the 
transaction(s) requested by the consumer. The final rule retains this 
requirement, with some modification. See final rule Sec.  
610.2(b)(2)(ii).
    Personally identifiable information. One nationwide consumer 
reporting agency comments that the proposed rule limitation on the 
collection of ``information'' may prohibit the nationwide consumer 
reporting agencies from collecting useful anonymous data through the 
centralized source. This commenter explains that such anonymous data 
would be useful for system maintenance and in detecting activities that 
would harm the centralized source, such as fraud.
    The purpose of this provision of the rule is to ensure that the 
centralized source will be easy for consumers to use, while allowing 
the nationwide consumer reporting agencies to properly identify 
consumers who request their file disclosures through the centralized 
source, in compliance with FCRA Sec.  610(a)(1), 15 U.S.C. 1681h(a)(1). 
The Commission is concerned that a centralized source that collects too 
much personal information may discourage some consumers from requesting 
their annual file disclosures. The Commission also recognizes, however, 
the need for collection of anonymous data for purposes such as system 
maintenance, service improvement, or fraud prevention.\29\ Accordingly, 
the Commission has modified the Sec.  610.2(b)(2)(ii) requirement to 
limit the collection of personally identifiable information -- rather 
than all information -- to that which is reasonably necessary to 
properly identify the consumer and process the transaction(s) requested 
by that consumer. Accordingly, final rule Sec.  610.2(b)(2)(ii) would 
not prevent nationwide consumer reporting agencies from collecting 
anonymous information.
---------------------------------------------------------------------------

    \29\ For example, the nationwide consumer reporting agencies may 
want to collect information and statistics on the number of 
consumers that use the centralized source website and toll-free 
telephone number, so they can efficiently allocate resources.
---------------------------------------------------------------------------

    Social Security number. Some consumers suggest that the final rule 
should specify that consumers are not required to provide their Social 
Security numbers when requesting their free file disclosures through 
the centralized source. These commenters contend that, in order to 
prevent identity theft, consumers have been repeatedly instructed by 
consumer advocates and government not to provide their Social Security 
numbers to anyone, and that some consumers do not have Social Security 
numbers. Therefore, they assert, the availability of annual file

[[Page 35475]]

disclosures should not be conditioned on providing a Social Security 
number.
    The final rule does not specifically require or prohibit the 
collection of Social Security numbers through the centralized source. 
Section 610.2(b)(2)(ii) is intended to provide a standard for 
information collection that is sufficiently flexible to accommodate the 
proper identification of consumers requesting free annual file 
disclosures by all nationwide consumer reporting agencies. The 
collection of this information is limited to that which is ``reasonably 
necessary'' to achieve proper identification of the consumer. The 
Commission believes that a consumer's Social Security number may be 
``reasonably necessary'' to properly identify the consumer, given the 
requirements of the nationwide consumer reporting agencies' current 
systems. Therefore, the rule does not prohibit the collection of that 
information. If, however, at some future time, due to changes in 
technology or in the consumer data industry, a Social Security number 
is not ``reasonably necessary'' for proper identification, then the 
collection of that information would be prohibited by final rule Sec.  
610.2(b)(2)(ii).
    Separate authentication. Representatives of the nationwide consumer 
reporting agencies comment on the need for each agency to conduct 
separate authentication processes for each consumer requesting a free 
annual file disclosure through the centralized source. As noted in the 
NPR, proposed rule Sec.  610.2(b)(2)(ii) was intended to afford each 
nationwide consumer reporting agency the flexibility to implement its 
own identification procedures for consumers who request file 
disclosures through the centralized source, in order to allow proper 
identification of consumers and to protect against fraud. File 
disclosures contain a great deal of very sensitive information. If 
misdirected to, or fraudulently obtained by, someone other than the 
consumer to whom it relates, a file disclosure would provide the ideal 
means for identity theft and other fraudulent activity. In addition, 
the nationwide consumer reporting agencies each maintain slightly 
different information in their consumer files, making it difficult to 
devise a common identification scheme. Moreover, a flexible approach 
allows the nationwide consumer reporting agencies to adjust to changing 
threats and patterns of fraudulent activity over time. Accordingly, 
like the proposed rule, the final rule does not prohibit the use of 
separate authentication processes by each nationwide consumer reporting 
agency for consumers requesting free annual file disclosures through 
the centralized source.
    Reasonably necessary. One nationwide consumer reporting agency 
suggests that the final rule alter the limitation on information 
collection. This commenter expresses concern that the ``reasonably 
necessary'' standard creates uncertainty and would, therefore, increase 
the risk of litigation.\30\ The commenter also states that this risk of 
liability would create incentive for a nationwide consumer reporting 
agency to collect only the minimum necessary amount of information in 
order to identify consumers, thus creating increased risk of identity 
theft or fraud.
---------------------------------------------------------------------------

    \30\ Throughout their comments, CDIA and the nationwide consumer 
reporting agencies repeatedly object to the use of ``reasonable'' 
standards in the proposed rule-such as may be found in proposed rule 
Sec. Sec.  610.2(b)(2)(i) (``reasonably anticipated volume''); 
610.2(b)(2(ii) (collect only as much information as is ``reasonably 
necessary''); 610.2(b)(2)(iv)(B) (provide information that consumers 
might ``reasonably need''); 610.2(c) (implement ``reasonable 
procedures''); 610.2(c)(2)(i)(B) (time when centralized source may 
be ``reasonably anticipated'' to be able to accept requests); and 
610.2(c)(2)(i)(C) (take all ``reasonable steps'' and defer requests 
until a ``reasonable later time''). In general, the stated objection 
to such provisions is that the use of a ``reasonable'' standard is 
inappropriately vague, creates uncertainty and increases the risk of 
private litigation. The Commission notes, however, that, since its 
inception more than 30 years ago, the provisions of the FCRA itself 
have been based upon the concept of ``reasonableness.'' Indeed, 
Congress declared that the very purpose of the FCRA is ``to require 
that consumer reporting agencies adopt reasonable procedures.'' FCRA 
Sec.  602(b), 15 U.S.C. 1681(b). Further, FCRA Sec.  607(b) requires 
all consumer reporting agencies to ``follow reasonable procedures to 
assure maximum possible accuracy'' in consumer reports. 15 U.S.C. 
1681e(b). Far from abandoning this approach, the FCRA, as amended by 
the FACT Act, uses the words ``reasonable'' or ``reasonably'' more 
than 70 times. Further, the ``reasonable'' standard is particularly 
appropriate when technology and the industry are continually 
changing. A more prescriptive standard might provide certainty 
today, but it would likely be overtaken and rendered anachronistic 
by advances in technology within a very short time. Accordingly, the 
Commission believes use of a ``reasonable'' standard in the final 
rule is appropriate and consistent with the regulatory scheme long 
established by the FCRA.
---------------------------------------------------------------------------

    As noted above, the Commission intends for the final rule to strike 
a balance between ease of use of the centralized source and maintaining 
adequate identification and authentication procedures to protect 
against fraud and identity theft. In part, the purpose of the 
``reasonably necessary'' standard is to allow for advances in 
technology or other developments that improve proper identification and 
authentication. The Commission believes that creating a flexible 
standard that can adapt over time is the most effective way of ensuring 
that proper procedures are implemented. Accordingly, nationwide 
consumer reporting agencies are required to limit the collection of 
personally identifiable information through the centralized source to 
that which is ``reasonably necessary.''
    Potential for fraud. In promulgating the proposed rule, the 
Commission posed a question as to whether and how the rule should 
address the potential for fraudulent websites, telephone numbers, or 
other ploys that might mimic the centralized source in order to gain 
access to personally identifiable consumer information for illegal 
purposes. In addition, the Commission asked whether the rule should 
require the nationwide consumer reporting agencies to employ measures 
to reassure consumers that they are contacting the legitimate 
centralized source.
    Two of the nationwide consumer reporting agencies and CDIA 
responded to these questions by stating that the primary mechanism for 
preventing such fraudulent ploys is FTC enforcement action. These 
comments further assert that no specific preventive measures should be 
required of the nationwide consumer reporting agencies. One nationwide 
consumer reporting agency suggests that the nationwide consumer 
reporting agencies and the Commission engage in future discussions 
regarding effective measures to reassure consumers that they are 
contacting the centralized source.
    At this time, the Commission has not identified any specific 
appropriate measures that, if incorporated into the centralized source, 
would sufficiently address fraudulent spoofing or mimicking of the 
centralized source. It welcomes further dialogue with the nationwide 
consumer reporting agencies regarding this important topic of fraud 
prevention. The Commission may also address these issues through 
consumer education, and, if appropriate, enforcement actions pursuant 
to the FTC Act, 15 U.S.C. 45(a). As a further aid to wary consumers, 
the Commission urges the nationwide consumer reporting agencies to make 
it easy for consumers to navigate from the nationwide consumer 
reporting agencies' individual homepages to the centralized source 
website. In addition, to assist consumers in identifying the 
centralized source, the final rule requires the nationwide consumer 
reporting agencies to include a statement indicating that the consumer 
has reached the website or telephone number ``operated by the national 
credit reporting agencies for ordering free annual credit reports, as 
required by

[[Page 35476]]

federal law.'' Final rule Sec. 610.2 (b)(2)(iv)(D).
    Information on alternate request methods.
    To ensure that consumers can access the centralized source request 
method of their choice, proposed rule Sec.  610.2(b)(2)(iii) required 
the centralized source toll-free number and Internet website to provide 
information regarding how to make a request for annual file disclosures 
through all available request methods. The Commission received no 
comments relating to this provision and adopts the provision as set 
forth in the proposed rule. Final rule Sec.  610.2(b)(2)(iii).
    Clear and easily understandable instructions.
    Under proposed rule Sec.  610.2(b)(2)(iv), the centralized source 
was required to provide clear and easily understandable information and 
instructions to consumers. This provision required the nationwide 
consumer reporting agencies to communicate to consumers, through the 
centralized source, information and instructions that may be needed by 
a consumer to request a free annual file disclosure. Under the proposed 
rule, such communications include informing consumers of the progress 
of their request for a file disclosure while they are in the process of 
making the request. Proposed rule Sec.  610.2(b)(2)(iv)(A). For a 
website request method, the proposed rule also required the centralized 
source to provide access to a ``help'' or ``frequently asked 
questions'' screen. Proposed rule Sec.  610.2(b)(2)(iv)(B). Finally, in 
the event that a consumer cannot be properly identified through the 
centralized source, the proposed rule required the nationwide consumer 
reporting agencies to notify the consumer of that fact, and to provide 
instructions on how to complete the request. Proposed rule Sec.  
610.2(b)(2)(iv)(C).
    As stated in the NPR, the intent of these rule provisions was to 
ensure that centralized source materials are provided to consumers in 
plain language and that the centralized source is easy for consumers to 
use. A nationwide consumer reporting agency argues that the phrase 
``clear and easily understandable'' is overly broad and subject to 
troubling interpretation. This commenter suggests that the Commission 
provide model language that could be used to give consumers the 
instructions and information required by the rule. Similarly, some 
consumer commenters suggest that the final rule should require that 
centralized source instructions be written at a 12-year old reading 
level. Since the instructions and information to be provided will be 
determined in substantial part by the format and structure of the yet-
to-be-created centralized source, the Commission has decided not to 
include such model ``information and instructions'' in the final rule. 
The Commission also declines to require that centralized source 
materials be written to a specific reading level, but notes that 
evaluation of centralized source communications by consumer 
communication experts, and consumer testing, may be instructive in 
determining whether centralized source materials are ``clear and easily 
understandable.''
    Many consumer advocacy groups and a state official suggest that the 
centralized source be required to provide instructions in languages, 
other than English, that are spoken by a substantial number of 
consumers in the United States. These commenters point to the fact that 
a significant portion of the United States population communicates 
primarily in languages other than English. Having carefully considered 
these comments, the Commission has determined not to require 
instructions in other languages. The Commission believes that requiring 
multi-language translations of centralized source materials, including 
the centralized source website itself, would impose significant 
additional burden on the nationwide consumer reporting agencies at a 
time when they will already be responding to the multiple and varied 
new obligations that the FACT Act imposes upon them. Accordingly, the 
Commission declines, at this time, to require multi-language 
centralized source information and instructions. The Commission, 
however, intends to provide education and outreach to consumers 
concerning the final rule in Spanish\31\ -- the language most commonly 
mentioned by commenters on this issue -- and encourages other 
stakeholders in the centralized source, including the nationwide 
consumer reporting agencies, to do the same.
---------------------------------------------------------------------------

    \31\ The Commission has been active in both consumer outreach 
and enforcement initiatives relevant to Spanish-speaking consumers. 
See, e.g., 
www.ftc.gov[sol]opa[sol]2004[sol]04[sol]hispanicsweep2.htm. To date, 
the Commission has translated nearly 70 consumer publications into 
Spanish and posted them to the FTC's En Espanol Web site at 
www.ftc.gov[sol]spanish.
---------------------------------------------------------------------------

    Consumer advocacy groups recommend that the centralized source be 
required to provide additional information, including a statement of 
the consumer's right to obtain a credit score, a disclosure of the 
other circumstances under which a consumer is entitled to a free report 
(e.g., when a consumer is a victim of identity theft, unemployed, or a 
welfare recipient), and information about nationwide speciality 
consumer reporting agencies. The Commission does not adopt these 
recommendations, primarily because requirements to provide such 
additional information appear elsewhere in the FCRA.\32\ Similarly, 
requirements relating to nationwide speciality consumer reporting 
agencies are contained in final rule Sec.  610.3. The Commission 
believes the dissemination of information required under these 
statutory and rule provisions is sufficient to inform consumers.
---------------------------------------------------------------------------

    \32\ Section 609(d) of the FCRA as amended by the FACT Act, 15 
U.S.C. 1681g(d), requires the Commission in consultation with other 
agencies to prepare and make available a summary of the rights of 
identity theft victims. Section 609(c) of the FCRA as amended by the 
FACT Act, 15 U.S.C. 1681g(c), requires the Commission to prepare and 
make available a Summary of Rights to Obtain and Dispute Information 
in Consumer Reports and to Obtain Credit Scores, which summary is 
required to be included with each written disclosure provided to the 
consumer by a consumer reporting agency, including free annual file 
disclosures. Pursuant to Sec.  609(a)(6) of the FCRA, 15 U.S.C. 
1681g(a)(6), as amended by Sec.  212 of the FACT Act, consumers who 
request a file disclosure but not the credit score must be informed 
of the right to request and obtain a credit score.
---------------------------------------------------------------------------

    A nationwide consumer reporting agency recommends that the 
requirement of proposed rule Sec.  610.2(b)(2)(iv)(A) that the 
centralized source provide ``information on the progress of the 
consumer's request while the consumer is engaged in the process of 
requesting a file disclosure'' be limited to requests made using the 
Internet website. This commenter argues that this requirement will 
cause confusion in the telephone request context. The Commission has 
decided not to adopt this recommendation because it finds such 
information to be useful in the context of a telephone request. The 
purpose of having the centralized source provide such information is to 
ensure that consumers do not mistakenly discontinue the order process 
without finishing their request. The centralized source could comply 
with this requirement in the telephone context, for example, by 
instructing consumers to ``please hold while we find your record.''
    A nationwide consumer reporting agency recommends that the 
requirement of proposed rule Sec.  610.2(b)(2)(iv)(A) be modified to 
state that it is not intended to allow a consumer to return to the 
centralized source to check the ``status'' of a request for an annual 
file disclosure already made, but rather is intended to keep the 
consumer informed as the request is

[[Page 35477]]

being made. The language of the rule provision itself is clear on this 
point: it requires information on the progress of the request ``while 
the consumer is engaged in the process of requesting a file 
disclosure.'' This provision is intended only to require the 
centralized source to communicate with the consumer while the consumer 
is in the process of providing information to make the request. Once 
all the requisite information is provided, there is no further 
obligation for the centralized source to ``update'' consumers on the 
status of the processing of their request. The Commission has 
determined that the rule provision is clear as stated, and accordingly, 
adopts it as proposed. Final rule Sec.  610.2(b)(2)(iv)(A).
    The Commission received no comments regarding the language of 
proposed rule Sec. Sec.  610.2(b)(2)(iv)(B) and (C). The Commission 
adopts Sec.  610.2(b)(2)(iv)(A)-(C) as set forth in the proposed rule.
    Make standardized form available.
    Proposed rule Sec.  610.2(b)(3) required that the centralized 
source make available to consumers a standardized form established 
jointly by the nationwide consumer reporting agencies. The Commission 
has adopted a model form which may be used to comply with this section. 
See final rule Sec.  698, App. D. and the discussion of that section in 
this notice, infra. The Commission did not receive comment on Sec.  
610.2(b)(3), and it is adopted as proposed.\33\
---------------------------------------------------------------------------

    \33\The Commission did, however, receive comments on the content 
of the model standardized form contained in the proposed rule. These 
comments, and the final rule modifications to the model form, are 
discussed under the section of this notice entitled ``Part 698 
Appendix D,'' infra.
---------------------------------------------------------------------------

Section 610.2(c)--Requirement to anticipate

    Proposed rule Sec.  610.2(c) required nationwide consumer reporting 
agencies to implement reasonable procedures to anticipate and respond 
to the volume of consumers who will contact the centralized source 
through each request method. This requirement included developing and 
implementing contingency plans to address circumstances that may 
materially and adversely impact the centralized source. These 
contingency plans were to include measures to minimize the impact of 
such circumstances.

Implement reasonable procedures to anticipate and respond to volume.

    General requirement. CDIA and the nationwide consumer reporting 
agencies object to the proposed rule requirement that nationwide 
consumer reporting agencies ``implement reasonable procedures to 
anticipate, and respond to, the volume of consumers who will contact 
the centralized source through each request method, to request, or 
attempt to request, a file disclosure.'' Proposed rule Sec.  610.2(c). 
These commenters argue that this requirement will put them in the 
untenable position of defending their ``guesses'' regarding the 
required capacity, against the perfect hindsight of consumer litigants 
and the Commission.
    This is not the case. Proposed rule Sec. 610.2(c) required only 
that the nationwide consumer reporting agencies develop and implement 
reasonable procedures to anticipate volume. It did not require the 
nationwide consumer reporting agencies to anticipate volume perfectly. 
The nationwide consumer reporting agencies have considerable experience 
in anticipating the likely volume of consumer contacts. For example, in 
the last five years, they have developed and implemented procedures to 
anticipate the volume of consumer calls to their toll-free dispute 
telephone numbers to facilitate their compliance with FCRA 
requirements.\34\ Also, the nationwide consumer reporting agencies have 
had to anticipate consumer request volume for free disclosures in those 
states where, under state law, consumers have previously been granted 
the right to obtain them. The Commission believes it is critical to 
meeting the objectives of the centralized source that the nationwide 
consumer reporting agencies implement reasonable procedures to 
anticipate and respond to consumer contact volume. The Commission 
believes this standard is both feasible and appropriate.
---------------------------------------------------------------------------

    \34\ See, U.S. v. Equifax Credit Information Services, Inc., 
1:00-CV-0087 (N.D. GA 2000), http://www.ftc.gov/os/2000/01/equifaxconsent.htm, U.S. v. Experian Information Solutions, Inc., 3-
00CV0056-L (N.D. TX 2000), http://www.ftc.gov/os/2000/01/experianconsent.htm, U.S. v. Trans Union LLC, Civil Action No. 
00C0235 (N.D. IL 2000), http://www.ftc.gov/os/2000/01/transunionconsent.htm.
---------------------------------------------------------------------------

    Set point for initial capacity. Proposed rule Sec.  610.2(c) 
required the nationwide consumer reporting agencies to implement 
reasonable procedures to anticipate and respond to the volume of 
consumer contacts, both during and after the transition period for the 
centralized source. CDIA and the nationwide consumer reporting agencies 
argue that the absence of any actual volume data for centralized source 
operations makes this requirement impossible to meet during the first 
two years of implementation of the centralized source. These commenters 
claim that the Commission itself has declared initial request volume 
impossible to estimate,\35\ and, in the absence of any reliable 
historical data, the nationwide consumer reporting agencies should not 
be required to anticipate and respond to the ``unknowable'' volume of 
consumer contacts.\36\
---------------------------------------------------------------------------

    \35\ Comment, CDIA 000018. While the Commission 
acknowledged in the NPR that accurately anticipating the initial 
volume for the centralized source would be difficult, it did not 
state, and does not believe, that it is ``impossible.'' See 69 FR at 
13198. This is especially true because the proposed and final rules 
require only reasonable procedures to anticipate volume.
    \36\ See, e.g., Comment, Experian Information Solutions, Inc. 
000040.
---------------------------------------------------------------------------

    CDIA and the nationwide consumer reporting agencies suggest that 
the Commission should designate the starting capacity for the 
centralized source in the rule itself. Further, they argue that the 
starting capacity set point should constitute a safe harbor from all 
liability under the rule for the first two years of operations of the 
centralized source. In other words, they contend that the Commission 
should designate the starting capacity, and the nationwide consumer 
reporting agencies should not be required to exceed that capacity until 
December 2006.
    For a number of reasons, the Commission does not believe such a 
rule provision would be appropriate, and thus has declined to adopt 
this suggestion. As noted above, the Commission believes that the Sec.  
610.2(c) requirement to implement reasonable procedures to anticipate 
and respond to capacity is both feasible and appropriate. In the NPR, 
the Commission explained how such reasonable procedures might be 
implemented, for example, by conducting a sample analysis of the only 
probative data available at that time. Thus, the Commission noted that,
    ``Although the precise demand for consumer free annual file 
disclosures on a nationwide basis is largely unknown, there is some 
available information that appears to be instructive in anticipating 
request volume when the rule becomes effective. For example, according 
to a Congressional Research Service Report to Congress, the consumer 
request rate for file disclosures in states where free annual 
disclosures are not currently available is 0.5% to 2%. In those states 
where consumers are, by state law, already guaranteed the right to a 
free annual disclosure, the request rate ranges from 3.5% to 10%. This 
represents an average disclosure rate that is 231% [of] the request 
rate in

[[Page 35478]]

other states.\37\ Based upon these statistics alone, and taking into 
account also the publicity likely to be generated by the promulgation 
of the final rule, it would be reasonable to anticipate that the number 
of requests for annual file disclosures will be 300% of the current 
disclosure rate, absent any unanticipated intervening factors.''
---------------------------------------------------------------------------

    \37\ Loretta Nott and Angie Welborn, ``A Consumer's Access to 
Free Credit Report: A Legal and Economic Analysis,'' Congressional 
Research Service, Library of Congress, July 21, 2003, p. 11.
---------------------------------------------------------------------------

69 FR at 13198. Based upon the comments and the information available 
to date, the Commission continues to believe that 300% of the current 
rate of file disclosures is a reasonable estimation of needed initial 
capacity for the centralized source.
    Further, the Commission believes that the comments of CDIA and the 
nationwide consumer reporting agencies themselves demonstrate that it 
is possible to implement reasonable procedures to anticipate and 
respond to the volume of consumers who will contact, or attempt to 
contact, the centralized source.\38\ The nationwide consumer reporting 
agencies, not the Commission, are in the best position to anticipate 
likely demand for annual file disclosures, particularly as the initial 
implementation of the centralized source begins to provide additional 
data on the likely level of demand. The rule is designed and intended 
to require only that the nationwide consumer reporting agencies develop 
a reasonable initial estimate of adequate capacity, and then reasonably 
expand capacity if those estimates prove too low. Further, the 
nationwide consumer reporting agencies have decades of experience in 
dealing with consumer requests and disputes relating to consumer 
reports. In the Commission's view, it would not be appropriate to 
substitute its estimation of consumer demand for free annual file 
disclosures for that of the seasoned business judgment of organizations 
that have superior access to existing relevant information and 
experience in the industry.
---------------------------------------------------------------------------

    \38\ Trans Union declares that ``we believe that there is 
sufficient data regarding experience with state free file disclosure 
requirements that would enable the Commission to develop a clear and 
reasonable standard for central source capacity at its inception.'' 
Comment, Trans Union 000035. CDIA states that it ``believes 
the initial capacity should be based on experiential data.'' 
Comment, CDIA 000018. CDIA goes on to explain:``CDIA 
believes that the consumer request volume will be the highest in the 
first year that the centralized source is in operation. . . . As 
discussed above, . . . data indicates that consumer requests for all 
their file disclosures will be based on 231% of the current total 
number of requests for file disclosures received by the nationwide 
consumer reporting agencies in states that do not currently require 
free file disclosures. Thus, the approximate percentage attributable 
to the new federal free file disclosure right should be 131% of the 
current file disclosure request rate in those states. The total 
volume based upon those percentages should be adjusted to reflect 
the fact that 43 of the 51 jurisdictions do not currently require 
free file disclosures. The initial capacity of the centralized 
source and of each nationwide consumer reporting agency should be 
determined by applying the appropriate formula (i.e., based upon 
231% or 131%) to the daily average of all consumer requests for file 
disclosures received by the nationwide consumer reporting agencies . 
. . .'' These comments demonstrate that it is possible to examine 
existing data, draw conclusions based upon that examination, and 
develop reasonable procedures based upon those conclusions.
---------------------------------------------------------------------------

    Similarly, as discussed further under Sec.  610.2(i) of this 
notice, infra, the Commission does not believe that reasonable 
estimations can be made only after a full two years of centralized 
source operations. The final rule does, however, provide the nationwide 
consumer reporting agencies with a reliable safe harbor structure, 
based upon request volume, that applies both during and after the 
centralized source transition period. See discussion under Sec. Sec.  
610.2(e) and 610.2(i)(2)-(3), infra.
    Developing and implementing contingency plans.
    As part of its requirement for reasonable procedures to anticipate 
and respond to consumer request volume, proposed rule Sec.  610.2(c) 
required the nationwide consumer reporting agencies to develop and 
implement contingency plans to address circumstances that may 
materially and adversely impact the operation of the nationwide 
consumer reporting agency, a centralized source request method, or the 
centralized source. Examples of the types of circumstances for which 
the nationwide consumer reporting agencies were required to develop 
contingency plans included natural disasters, telecommunications 
interruptions, equipment malfunctions, labor shortages, computer 
viruses, coordinated hacker attacks, and seasonal or other fluctuations 
in consumer request volume.
    CDIA, the nationwide consumer reporting agencies, and some members 
of Congress comment that these provisions of the proposed rule 
``essentially require[d] the nationwide consumer reporting agencies to 
anticipate the unpredictable''\39\ and ``perform despite those 
disasters.''\40\ These commenters suggest that the proposed rule 
imposed liability upon the nationwide consumer reporting agencies even 
if they were unable to accept or respond to consumer requests due to 
some unpredictable and materially adverse event. These commenters go on 
to posit that it would be more appropriate for the final rule to 
relieve the nationwide consumer reporting agencies of liability in the 
event of such circumstances than to impose a requirement to reasonably 
anticipate and respond to events that may be completely outside their 
control.
---------------------------------------------------------------------------

    \39\ Comment, CDIA 000018.
    \40\ Comment, Equifax Information Services, LLC 000028. 
See also, Comment, Experian Information Solutions, Inc. 
000040; Comment, U.S. House of Representatives Committee on 
Financial Services 000136; and Comment, U.S. Senate 
000137.
---------------------------------------------------------------------------

    The proposed rule was not intended to suggest that nationwide 
consumer reporting agencies should be required to process requests for 
annual file disclosures despite any and all unpredictable and 
uncontrollable events that may hamper their performance. Rather, 
proposed rule Sec.  610.2(c) was intended to require only that the 
nationwide consumer reporting agencies consider the types of material 
and adverse events that are reasonably likely to occur, and develop 
reasonable plans to address such events in ways that will minimize 
impact on the centralized source. Further, the Commission did not 
intend that this provision should be interpreted to require nationwide 
consumer reporting agencies to develop precise and unique plans for 
every particular event listed in the proposed rule or otherwise 
anticipated. Rather, the intent of this provision was to require that 
generally appropriate plans be developed and implemented, based upon 
the types of interruption such events may bring. Accordingly, final 
rule Sec.  610.2(c) has been modified to clarify this intent, and 
references to specific types of events have been removed.
    As clarified, the Commission believes the requirement for 
nationwide consumer reporting agencies to develop and implement 
contingency plans for material and adverse circumstances that are 
reasonably likely to occur is appropriate. The Commission notes that it 
is common practice in many industries to develop contingency and 
recovery plans for events that are not completely predictable but 
likely enough that contingency plans are appropriate. For example, it 
is not possible to predict exactly where and when a hurricane may 
strike. The final rule would not require nationwide consumer reporting 
agencies to have hurricane contingency plans regardless of where 
centralized source operations are located. If, however, centralized 
source operation centers are located in Miami, Florida, it would be 
reasonably likely--based upon historical weather patterns for that 
region-- that a hurricane may occur that would materially and adversely 
impact those operations. In such a case, the final rule

[[Page 35479]]

would require the nationwide consumer reporting agencies to develop and 
implement contingency plans to minimize the impact of such events, to 
the extent reasonably practicable under the circumstances.
    The Commission also recognizes that some events may be predictable, 
but are so devastating that there are no reasonable measures that can 
be implemented to minimize impact. Thus, the Commission intends that 
the required contingency plans be tempered by two factors: the 
likelihood of a material and adverse event occurring, and the extent to 
which particular measures to minimize impact are reasonable under the 
circumstances. For example, even though a hurricane that will 
materially and adversely impact the centralized source operations in 
Miami, Florida may be reasonably likely to occur, the contingency plan 
for such an event need not include measures to minimize the impact of 
the complete destruction of the centralized source operations by a 
hurricane. Even if hurricanes of such destructive magnitude may have 
occurred in the region previously, there are no reasonable measures 
that could be undertaken to minimize the impact of such a devastating 
event.
    As revised, Sec.  610.2(c) is intended to reflect what would be 
sound business planning in nearly any industry. Indeed, in the 
Commission's view, the nationwide consumer reporting agencies may 
comply with the requirement to develop and implement contingency plans 
under final rule Sec.  610.2(c) by implementing the same contingency 
procedures for centralized source operations that they maintain and 
implement for their for-profit enterprises.
    Specific measures to minimize impact.
    Under the proposed rule the contingency plans required by paragraph 
(c) were to include specific reasonable measures to minimize the impact 
of material and adverse circumstances on the operation of the 
centralized source. These measures included, but were not necessarily 
limited to: (1) providing information to consumers on how to use 
another available request method; (2) communicating, to a consumer who 
attempts but is unable to make a request, the fact that a condition 
exists that has precluded the centralized source from accepting all 
requests, and the period of time after which the centralized source is 
reasonably anticipated to be able to accept the consumer's request for 
an annual file disclosure; and (3) taking all reasonable steps to 
restore the centralized source to normal operating status as quickly as 
possible. Measures to minimize impact also included, as appropriate, 
collecting request information but declining to accept the request for 
processing until a reasonable later time, provided that the nationwide 
consumer reporting agency clearly and prominently informs the consumer 
when it will accept the request for processing. Proposed rule Sec.  
610.2(c)(2).
    Industry commenters on this provision generally believe the list of 
measures to minimize impact to be sufficiently inclusive and the 
measures appropriate. CDIA and one nationwide consumer reporting agency 
comment, however, that, as proposed, this section required some 
measures to be performed ``to the extent possible.'' These commenters 
argue that a standard of what is ``possible'' is too broad and 
subjective to be truly meaningful. To address these concerns, the final 
rule provides that these measures should be undertaken ``to the extent 
reasonably practicable under the circumstances.'' Final rule Sec.  
610.2(c)(1).
    Centralized source maintenance.
    One nationwide consumer reporting agency comments that temporary 
outages may result from the need to perform maintenance on the 
centralized source Internet website or telephone lines. The commenter 
requests that the final rule clarify that such outages are not 
violations of the rule. The Commission acknowledges that particular 
request methods may be unavailable for reasonable periods of time due 
to the need for maintenance. Accordingly, final rule Sec.  610.2(c)(2) 
provides that nationwide consumer reporting agencies shall not be in 
violation of the final rule's adequate capacity requirement if a 
centralized source request method is unavailable for a reasonable 
period of time for purposes of maintenance. This provision requires, 
however, that only one request method be unavailable for such 
maintenance at any given time.
    In light of the foregoing discussion, the Commission adopts 
proposed rule Sec.  610.2(c) with some modifications. As explained 
above, the final rule requires nationwide consumer reporting agencies 
to develop and implement contingency plans for material and adverse 
events that are reasonably likely to occur. These contingency plans 
must contain measures to minimize impact ``to the extent reasonably 
practicable under the circumstances.'' Further, the final rule includes 
a new subparagraph (3) to clarify that the nationwide consumer 
reporting agencies are not in violation of the rule if a centralized 
source request method is temporarily unavailable for maintenance. Final 
rule Sec. Sec.  610.2(c)(1) and (2). The Commission believes that final 
rule Sec.  610.2 (c) appropriately balances the considerations of 
minimizing potential disruptions of the centralized source, and 
providing nationwide consumer reporting agencies with both flexibility 
and sufficient guidance in their compliance obligations.

Section 610.2(d)--Disclosure of all files

    The proposed rule, in Sec.  610.2(d), required a nationwide 
consumer reporting agency to provide an annual file disclosure to any 
consumer who requests one if the consumer reporting agency has the 
ability to provide a consumer report to a third party relating to that 
consumer. As noted in the NPR, this provision was intended to ensure 
that every consumer can obtain annual file disclosures through the 
centralized source from each of the nationwide consumer reporting 
agency systems, regardless of whether the information in that 
consumer's file is owned by the nationwide consumer reporting agency or 
an associated consumer reporting agency. See 69 FR at 13197.
    Files Owned by Associated Consumer Reporting Agencies.
    As noted in the discussion of the definition of associated consumer 
reporting agency, supra, some nationwide consumer reporting agencies 
house within their systems data owned by one or more associated 
consumer reporting agencies. By virtue of such relationships with 
associated consumer reporting agencies, a nationwide consumer reporting 
agency, which does not itself own consumer files in a localized area or 
region of the country, is able to provide consumer reports on consumers 
residing in that area or region to its customers. On that basis, the 
proposed rule required nationwide consumer reporting agencies to 
provide free annual file disclosures to any consumer for whom they 
could sell a consumer report, even if they did not ``own'' that 
particular consumer's file.
    Representatives of the nationwide consumer reporting agencies raise 
many objections to this requirement. They comment that requiring them 
to disclose files owned by another consumer reporting agency is 
contrary to the intent of Congress, and outside the scope of the FACT 
Act. These commenters assert that although, absent such a requirement, 
not all consumers would be able to obtain annual file disclosures from 
each of the three identified nationwide consumer reporting agencies 
through the centralized source, this is a ``problem,''

[[Page 35480]]

in their view, based in the FACT Act itself, and the Commission should 
not attempt to fix it.
    As stated in the NPR, the Commission believes that the legislative 
history indicates Congressional intent that all consumers be able to 
obtain free annual file disclosures from each of the three known 
nationwide consumer reporting agencies.\41\ The Commission does not 
believe that it was the intent of Congress to create pockets of the 
country in which consumers could obtain only one or two annual file 
disclosures through the centralized source. Further, the language of 
the FACT Act places the responsibility for providing annual file 
disclosures solely on the nationwide consumer reporting agencies. The 
Commission believes, therefore, that the intent of Congress and the 
mandate of the FACT Act are best realized by requiring the nationwide 
consumer reporting agencies to disclose to consumers all files in their 
possession that they can provide to third parties, including those 
residing on their systems but owned or maintained by an associated 
consumer reporting agency. Moreover, the Commission believes it is 
appropriate that if a nationwide consumer reporting agency has the 
ability to provide a consumer report on a consumer to a third party, 
and thereby profit from the sale of that report, that nationwide 
consumer reporting agency should disclose the file to the consumer.
---------------------------------------------------------------------------

    \41\ ``The centralized system shall allow consumers to obtain 
free reports from all three [nationwide consumer reporting] agencies 
using a single request.'' S. Rep. No.108-166, at 17 (2003) (emphasis 
supplied).
---------------------------------------------------------------------------

    As an alternative means of providing free annual file disclosures 
to all consumers, the nationwide consumer reporting agencies suggest 
that an associated consumer reporting agency should be considered a 
``consumer reporting agency that compiles and maintains files on 
consumers on substantially a nationwide basis,'' as referred to in 
Sec.  211(d)(6)(A) of the FACT Act, and that such agencies should be 
obligated to provide consumers with annual file disclosures through the 
centralized source. These commenters assert that all associated 
consumer reporting agencies are substantially nationwide, based upon 
their relationships with nationwide consumer reporting agencies. The 
Commission notes that associated consumer reporting agencies are a 
diverse group of entities, including many that own consumer credit 
files for only a small geographic area. The Commission believes it is 
not appropriate to classify all associated consumer reporting agencies, 
regardless of their size, the scope of their operations, or the number 
of files they own, as compiling and maintaining files on consumers ``on 
substantially a nationwide basis'' based solely on their contractual 
relationships with nationwide consumer reporting agencies.\42\
---------------------------------------------------------------------------

    \42\ See discussion under section IV of this notice, infra.
---------------------------------------------------------------------------

    The nationwide consumer reporting agencies also assert that this 
provision is unfair. They argue that the requirement to provide annual 
file disclosures for files owned by associated consumer reporting 
agencies gives the associated consumer reporting agencies an 
overwhelming advantage in any negotiations between the two entities for 
supplying and paying for the file disclosures. These commenters suggest 
that the Commission should include in the final rule provisions that 
would govern the bargaining between these entities-for example, by 
prohibiting the charging of certain fees by the associated consumer 
reporting agencies. The nationwide consumer reporting agencies assert 
that otherwise they will have unequal bargaining power when negotiating 
contracts with the associated consumer reporting agencies.
    The Commission does not believe it is appropriate or necessary to 
intervene in the contractual relationships between the nationwide 
consumer reporting agencies and the associated consumer reporting 
agencies. These relationships have existed for many years, during which 
the parties have managed to successfully negotiate various kinds of 
terms and adjust to a wide variety of economic and regulatory changes 
affecting the industry. The nationwide consumer reporting agencies' 
assertion that they will have little leverage in these negotiations 
seems improbable given the reciprocal and symbiotic nature of the 
relationships between these entities. The parties involved rely on each 
other to provide products or services of value to their customers. The 
associated consumer reporting agencies rely on the nationwide consumer 
reporting agencies to obtain updates for, and to some extent, to sell 
their consumer reports on a national basis. In return, the nationwide 
consumer reporting agencies rely on the associated consumer reporting 
agencies for access to files in parts of the country where the 
nationwide agency does not own files. It is clearly in the interests of 
both parties to maintain these relationships, and the Commission does 
not believe that the final rule will disrupt those interests or be 
substantially unfair to any of the parties.
    In addition, one nationwide consumer reporting agency comments that 
the proposed rule does not specify that this provision applies only to 
its own files and those of associated consumer reporting agencies. 
Therefore, this commenter asserts, the rule provision could also be 
read to require a nationwide consumer reporting agency to disclose 
files owned by any other consumer reporting agency, regardless of 
whether the files were housed in the system of the nationwide consumer 
reporting agency. In order to clarify that this obligation applies only 
to files that are either owned by the nationwide consumer reporting 
agency itself, or housed on that agency's system but owned by an 
associated consumer reporting agency, the final rule includes modified 
Sec.  610.2(d) that clarifies the intended limited application of this 
provision.
    Proper Identification of Consumers.
    One nationwide consumer reporting agency comments that the 
obligation to provide an annual file disclosure should apply only when 
the nationwide consumer reporting agency can confirm the requester's 
identity. The Commission notes that FCRA Sec.  610(a)(1), 15 U.S.C. 
1681h(a)(1), requires consumer reporting agencies to obtain proper 
identification from consumers before providing file disclosures. This 
statutory provision applies to those disclosures requested through the 
centralized source. Accordingly, Sec.  610.2(d) of the rule has been 
modified to clarify that the nationwide consumer reporting agencies are 
obligated to provide annual file disclosures only upon proper 
identification in compliance with Sec.  610(a)(1) of the FCRA, and 
Sec.  610.2(b)(2)(ii) of the final rule.

Section 610.2(e)--High request volume and extraordinary request volume

    The Commission recognizes that there may be times when the volume 
of consumer requests for file disclosures may be higher than 
anticipated, such as may overwhelm the systems of a nationwide consumer 
reporting agency or a nationwide specialty consumer reporting agency. 
As noted in the NPR, the Commission recognizes that, even with careful 
planning and preparation, it may be difficult for the nationwide 
consumer reporting agencies to anticipate and respond to consumer 
request volume under all circumstances. In light of these 
uncertainties, and in consideration of the possible impact of 
unexpected and extraordinary demand for annual file disclosures on the 
ability of the nationwide consumer reporting agencies to produce other 
file

[[Page 35481]]

disclosures and consumer reports, the proposed rule provided some 
limits on the liability of nationwide consumer reporting agencies 
during times when request volume significantly exceeds what could 
reasonably have been anticipated. Proposed rule Sec.  610.2(e).
    Members of Congress, industry commenters-including CDIA, nationwide 
and associated consumer reporting agencies, and several trade 
organizations-strongly support the concept of liability relief 
(sometimes called ``surge protection'') during times of heavy consumer 
request volume. These comments provide a number of compelling arguments 
that reasonable surge protection must be a feature of the final rule. 
They posit that, without such protections, the nationwide consumer 
reporting agencies could be overwhelmed with unexpected volume and be 
unable to respond to consumer requests-a situation that would frustrate 
consumers and thwart the purposes of the FACT Act and the rule. They 
also contend that maintaining vast amounts of excess capacity for the 
sole purpose of responding to sporadic surges is wasteful and 
prohibitively expensive.
    In addition, a number of commenters who represent organizations 
that furnish consumer report information to nationwide consumer 
reporting agencies comment that large surges in annual file disclosure 
request volume may have a ripple effect for the whole financial 
services industry. Even if nationwide consumer reporting agencies could 
accept and process all of the requests for annual file disclosures 
during a surge, the corresponding surge in consumers contacting the 
nationwide and associated consumer reporting agencies and furnishers to 
dispute information contained in those reports would constitute a 
significant strain on the financial services industry. These commenters 
assert that surge protection must be provided to manage the number of 
requests for annual file disclosures that are accepted by nationwide 
consumer reporting agencies in the first instance, in part to allow the 
nationwide and associated consumer reporting agencies and furnishers to 
manage these ``back end'' effects.
    In response to these comments, the final rule provides two tiers of 
relief for times when the consumer request volume is higher than the 
normal fluctuations in demand. In times of ``high request volume''-- 
i.e., when volume exceeds 125% of average -- nationwide consumer 
reporting agencies may delay accepting requests for processing until a 
reasonable later time.\43\ Final rule Sec.  610.2(e)(1). In addition, 
the rule provides a more complete limitation on liability in times of 
``extraordinary request volume''--i.e. exceeding 175% of the daily 
average volume- by allowing nationwide consumer reporting agencies to 
decline requests at such times. The Commission believes the combined 
structure of high request volume relief and extraordinary request 
volume relief provides the industry with adequate protection from 
unexpected, overwhelming request volume.
---------------------------------------------------------------------------

    \43\ Except as provided in Sec. Sec.  610.2(i) and 610.3(g), 
high request volume occurs when the number of consumers requesting 
or attempting to request file disclosures during any 24-hour period 
is more than 125% of the daily rolling 90-day average. Final rule 
Sec.  610.1(b)(8).
---------------------------------------------------------------------------

    High and extraordinary request volume thresholds.
    Under the proposed rule, extraordinary request volume occurred when 
the volume of requests exceeded twice the daily average volume. The 
Commission received comment from consumer advocacy groups expressing 
concern that the proposed rule definition of ``extraordinary request 
volume'' set the bar too low for the nationwide consumer reporting 
agencies and nationwide specialty consumer reporting agencies to obtain 
relief from the rule's requirements. In particular, these commenters 
are concerned that because extraordinary request volume was defined as 
only twice the daily average of consumer requests, a single security 
breach or national media event could produce request volume at the 
``extraordinary'' level, thus allowing nationwide consumer reporting 
agencies and nationwide specialty consumer reporting agencies to stop 
fulfilling file disclosure requests too frequently. In contrast, 
representatives of the nationwide consumer reporting agencies and 
nationwide specialty consumer reporting agencies, as well as some 
members of Congress, express concern that relief that is triggered at 
twice the daily rolling average is, in fact, no relief at all. These 
commenters argue that such a standard would require the nationwide 
consumer reporting agencies to maintain an unrealistic amount of 
costly, daily excess capacity.\44\
---------------------------------------------------------------------------

    \44\ The Commission notes that while the nationwide consumer 
reporting agency and nationwide specialty consumer reporting agency 
commenters agree that the extraordinary request volume threshold 
contained in the proposed rule is too high, they are not similarly 
uniform in their opinion as to what the appropriate threshold should 
be. The nationwide consumer reporting agencies, as well as an 
associated consumer reporting agency, suggest the proper threshold 
is 125% of average volume. One nationwide specialty consumer 
reporting agency commenter suggests 110% of average volume.
---------------------------------------------------------------------------

    In addition, industry commenters noted that under the proposed 
rule, nationwide consumer reporting agencies, during the transition 
period, were permitted to queue requests for file disclosures and delay 
accepting such requests until a reasonable later time, when ``high 
request volume'' occurs. No such relief was provided under the proposed 
rule for nationwide specialty consumer reporting agencies or for 
nationwide consumer reporting agencies after the transition period. 
Compare proposed rule Sec. Sec.  610.2(i)(3) and 610.3(g). Accordingly, 
industry commenters urge the Commission to revise the final rule to (1) 
lower the extraordinary request volume threshold from 200% to 125%, and 
(2) allow nationwide consumer reporting agencies to delay accepting 
requests for file disclosures by queuing them at an intermediate 
threshold of 115%, and to continue to have this option beyond the 
transition period. Some commenters also ask the Commission to adopt 
``high request volume'' provisions that would apply to nationwide 
specialty consumer reporting agencies, both during and after the 
transition period. As noted above, the Commission agrees that the 
addition of high request volume relief during and after the transition 
for both nationwide and nationwide specialty consumer reporting 
agencies is appropriate.
    In support of their argument that ``high request volume'' should be 
defined as any volume that exceeds 115% of the rolling daily average 
volume, the nationwide consumer reporting agencies posit that demand 
for file disclosures is so volatile and difficult to predict that even 
modest fluctuations beyond the average volume are likely to cause 
significant difficulty for their operations. The Commission notes that, 
according to CDIA, ``volatility in contact rates usually ranges no 
higher (or lower) than 20% of the average baseline of contact.''\45\ 
The Commission believes that the nationwide consumer reporting agencies 
and nationwide specialty consumer reporting agencies should be prepared 
to respond to such day-to-day volatility. High request volume and 
extraordinary request volume provisions, on the other hand, should be 
available to address volatility that significantly exceeds the norm.
---------------------------------------------------------------------------

    \45\ Comment, CDIA 000018.
---------------------------------------------------------------------------

    In light of these comments, the final rule provides for ``high 
request volume'' relief when the number of consumers requesting or 
attempting to request file disclosures exceeds 125% of the rolling 
daily 90-day average volume. The Commission believes requiring the

[[Page 35482]]

nationwide consumer reporting agencies to be prepared to accept 125% of 
the daily rolling 90-day average of consumer requests is reasonable. As 
one nationwide consumer reporting agency asserted: ``We believe that 
maintaining a 25% buffer in excess capacity should be reasonably 
achievable and should be sufficient based on our historical experience 
with surges in demand for file disclosures.''\46\
---------------------------------------------------------------------------

    \46\ Comment, Trans Union 000035.
---------------------------------------------------------------------------

    Further, the Commission notes that the threshold for extraordinary 
request volume is meant to be truly extraordinary because, at that 
level, the rule provides complete relief from liability. For as long as 
that level is maintained, the nationwide consumer reporting agencies 
and nationwide specialty consumer reporting agencies are protected from 
liability under the rule even if they decline to accept additional 
consumer requests for file disclosures. See final rule Sec. Sec.  
610.2(e)(2) and 610.3(c)(2). As noted above, the Commission believes 
the nationwide consumer reporting agencies should be prepared to 
respond to normal, day-to-day volatility of 25% over average volume. 
The Commission also believes, however, that a volume that is more than 
three times that normal variation in demand--i.e. 175% of rolling 90-
day daily average--would be ``extraordinary,'' and consequently the 
level at which extraordinary relief should be provided. Accordingly, 
the final rule provides that ``extraordinary request volume'' is volume 
that exceeds 175% of rolling 90-day daily average volume.
    As noted above, some consumer advocacy groups assert that the high 
and extraordinary request volume threshold should not be set at a level 
that is likely to be triggered by a single event. The Commission notes, 
however, that the capacity of the centralized source likely cannot be 
expanded and contracted immediately in response to sudden, 
unpredictable events.\47\ Accordingly, the final rule provides for high 
and extraordinary request volume relief at request levels that 
significantly exceed normal fluctuations in demand, regardless of the 
particular causes of such fluctuations.
---------------------------------------------------------------------------

    \47\ The commenters who argue that extraordinary request volume 
relief should not be available at a level likely to be triggered by 
a single event cite to the possibility of a large-scale security 
breach or incidence of identity theft. The Commission notes that 
while the consumers impacted by such events may choose at that point 
in time to seek their annual file disclosures through the 
centralized source, that is not the only means by which they might 
obtain a file disclosure under those circumstances. Under the FCRA, 
an individual who ``has reason to believe that the file on the 
consumer at the agency contains inaccurate information due to 
fraud'' is entitled to a free file disclosure during any 12-month 
period. FCRA Sec.  612(c)(3), 15 U.S.C. 1681j(c)(3). In addition, a 
consumer who asserts a good faith suspicion that he or she is or is 
about to become a victim of fraud or identity theft is entitled to a 
free file disclosure. FACT Act Sec.  112, codified at FCRA Sec.  
605A, 15 U.S.C. 1681c-1. The Commission notes that these free file 
disclosures are available to consumers in such circumstances, in 
addition to -- not in place of -- the annual free file disclosure to 
be provided through the centralized source. FACT Act Sec.  211(a), 
codified at FCRA Sec.  612(a), 15 U.S.C. 1681j(a).
---------------------------------------------------------------------------

    To ensure that the high and extraordinary request volume threshold 
functions as intended, however, the final rule alters the definition of 
extraordinary request volume slightly. The Commission notes that, once 
extraordinary request volume is reached, attempts to make requests for 
file disclosures may be declined or queued for later processing. See 
final rule Sec. Sec.  610.2(e) and 610.3(c). These attempted requests, 
to the extent that they can be tracked, should be considered part of 
the consumer request volume. Accordingly, the final rule modifies the 
proposed rule's definition of ``extraordinary request volume'' to make 
clear that the threshold is calculated based upon ``the number of 
consumers requesting, or attempting to request, file disclosures during 
any 24-hour period.'' Final rule Sec.  610.1(b)(6).
    Under the final rule high and extraordinary request volume are 
measured on the basis of requests for all types of file disclosures, 
rather than only requests for annual file disclosures. Although the 
FACT Act requires the nationwide consumer reporting agencies and 
nationwide specialty consumer reporting agencies to develop the 
centralized source and streamlined process described in the final rule 
for the purpose of receiving requests for annual file disclosures, 
Congress specifically directed the Commission to consider ``the 
significant demands that may be placed on consumer reporting agencies 
in providing [annual file disclosures],'' and ``appropriate means to 
ensure that consumer reporting agencies can satisfactorily meet those 
demands.'' FACT Act Sec.  211(d)(2). The significant demands of 
providing annual file disclosures include demands associated with 
simultaneously responding to requests for other types of file 
disclosures, such as free file disclosures resulting from adverse 
action under FCRA Sec.  612(b), 15 U.S.C. 1681j(b), and free file 
disclosures provided in response to suspected fraud under FCRA Sec.  
612(c)(3), 15 U.S.C. 1681j(c)(3). Further, consumer reporting agencies 
may face additional significant demands in responding to inquiries, or 
requests for reinvestigation,\48\ generated through each of these types 
of file disclosures.\49\ Delays in this system caused by excess demand 
may adversely impact consumers with a specific, immediate need for 
access to their file disclosures and to reinvestigation procedures. 
Accordingly, it is appropriate to consider the volume of request for 
all types of file disclosures in determining ``extraordinary request 
volume'' for the purpose of limiting liability under the final rule. 
Final rule Sec.  610.1(b)(6).\50\
---------------------------------------------------------------------------

    \48\ See FCRA Sec.  611(a), 15 U.S.C. 1681i(a).
    \49\ The Commission notes that the FACT Act has expanded 
consumers' rights to obtain a free file disclosure in a number of 
ways. See, e.g., FACT Act Sec.  112.
    \50\ For the same reasons, high request volume also is 
calculated based upon volume of all types of file disclosures.
---------------------------------------------------------------------------

    In addition, the Commission recognizes that the volume of requests 
for annual file disclosures will be particularly difficult to predict 
and volatile during the transition period. Due to such special 
considerations during the transition period, high and extraordinary 
request volume is defined differently during that period.\51\ See 
discussion of Sec. Sec.  610.2(i) and 610.3(g) infra.
---------------------------------------------------------------------------

    \51\ The final rule definition of extraordinary request volume 
found in Sec.  610.1 (b)(6) also makes clear that this definition 
will prevail, except during the transition periods defined in 
Sec. Sec.  610.2 (i) and 610.3 (g). As noted, the term is defined 
differently in those sections, for the duration of the transition 
periods described.
---------------------------------------------------------------------------

    High and extraordinary request volume protections.
    When high request volume occurs, nationwide consumer reporting 
agencies may collect consumer request information and delay accepting 
the request for processing until a reasonable later time. The 
nationwide consumer reporting agency must, however, clearly and 
prominently inform the consumer of when the request will be accepted 
for processing. This provision will provide nationwide consumer 
reporting agencies with some protection from unexpected surges, and, as 
one consumer advocacy group points out, it has the benefit of 
eliminating the need for consumers within the surge to reinitiate 
contact with the centralized source at a later time in order to obtain 
an annual file disclosure. In order to take advantage of this high 
request volume protection, however, the nationwide consumer reporting 
agency must implement reasonable procedures to anticipate consumer 
request volume developed in compliance with final rule Sec.  610.2(c).
    The FACT Act requires nationwide consumer reporting agencies to 
provide annual file disclosures within 15 days of

[[Page 35483]]

when the request is received. By permitting nationwide consumer 
reporting agencies to queue some requests for annual file disclosures 
during times of high request volume, the final rule allows the 
nationwide consumer reporting agencies to postpone receiving those 
requests -- and thereby postpone the running of the 15-day delivery 
requirement -- for a reasonable period of time.\52\
---------------------------------------------------------------------------

    \52\ What constitutes a ``reasonable period of time'' to 
postpone accepting requests will likely depend on a number of 
factors, including the length and magnitude of the surge. For 
example, if high request volume lasts only one day, it may not be 
reasonable to postpone accepting the request for annual file 
disclosures for three weeks. In addition, the rule does not specify 
how the nationwide consumer reporting agencies should process 
requests placed in a queue versus new requests after high request 
volume ceases. The nationwide consumer reporting agencies are in the 
best position to manage their resources to process these requests. 
However, because the nationwide consumer reporting agencies may only 
postpone accepting requests for a ``reasonable period of time,'' 
they must efficiently process requests placed in a queue, and it 
would be logical to process requests in a chronological order from 
the time they were received.
---------------------------------------------------------------------------

    Under final rule Sec.  610.2(e)(2), when extraordinary request 
volume occurs, nationwide consumer reporting agencies will not be 
deemed in violation of the rule's requirement for adequate capacity, 
provided that they implement reasonable procedures to anticipate 
consumer request volume in compliance with Sec.  610.2(c). This 
provision is adopted as proposed, with only minor modifications.
    In the event of high or extraordinary request volume affecting a 
particular request method, the final rule requires nationwide consumer 
reporting agencies to direct consumers to other available request 
methods to the extent reasonably practicable. Final rule Sec.  
610.2(c)(1)(i)(A). Thus, high or extraordinary request volume affecting 
just one request method would not necessarily lead to a limitation on 
liability in relation to the operation of the other request methods.
    The Commission believes that--taken in combination with the 
provisions of the FACT Act itself-- the high and extraordinary request 
volume protections will provide appropriate and sufficient relief to 
the nationwide consumer reporting agencies and other affected 
businesses during times of unexpected, heavy volume. The 15-day time 
line for providing reports prescribed under the FACT Act allows 
considerable flexibility for nationwide consumer reporting agencies to 
smooth normal fluctuations in demand for ``back end'' services by 
managing when the requested annual file disclosures are provided. In 
times of excess volume, final rule provisions for high and 
extraordinary request volume allow the nationwide consumer reporting 
agencies additional flexibility to manage both the acceptance of the 
requests and timing of the processing of the requests.
    Liability limitations contingent upon reasonable procedures.
    CDIA and the nationwide consumer reporting agencies also comment 
that, under the proposed rule, surge protection was contingent upon the 
nationwide consumer reporting agency having complied with the Sec.  
610.2(c) requirement to develop and implement reasonable procedures to 
anticipate and respond to request volume. These comments assert that 
the development of contingency plans for material adverse events and 
relief from the effects of excess consumer request volume must remain 
distinct. To support this argument, CDIA uses this example:
    ``[i]t would be possible for the nationwide consumer reporting 
agencies to adopt reasonable procedures to anticipate consumer request 
volume, but to have the actual demand exceed their reasonable 
expectations. Under the proposed rule, these agencies could avail 
themselves of the extraordinary request volume provisions or high 
request volume provisions only if the agencies had also developed and 
implemented contingency plans to address circumstances that would 
materially and adversely impact the operations, even if none of those 
circumstances affected the actual volume of requests.''\53\
---------------------------------------------------------------------------

    \53\ Comment, CDIA 000045.
---------------------------------------------------------------------------

    The Commission believes this argument misinterprets the intended 
application of the rule. The purpose of requiring the nationwide 
consumer reporting agencies to implement reasonable procedures at all 
times, including during times of high or extraordinary request volume, 
is to ensure that the agencies respond, to the extent reasonably 
practicable under the circumstances, to material and adverse 
circumstances that impact the centralized source. It would seem of 
little use to require nationwide consumer reporting agencies to develop 
and implement reasonable procedures to anticipate and respond to 
consumer demand if there was no corresponding requirement to implement 
those procedures when they are most needed. Final rule Sec.  610.2(e) 
ensures that excessive volume does not excuse the nationwide consumer 
reporting agencies from their responsibility to implement reasonable 
procedures to minimize impact on the centralized source, as required 
under Sec.  610.2(c). Conversely, final rule Sec.  610.2(e) should not 
be interpreted to deny high and extraordinary request volume 
protections to a nationwide consumer reporting agency because the 
agency failed to develop and implement contingency plans for events 
that are unrelated to the ability of the agency to respond to request 
volume during the time period at issue.
    Ongoing staggering of availability of file disclosures.
    The FACT Act Sec.  211(d)(2) directs the Commission to consider 
``appropriate means to ensure that consumer reporting agencies can 
satisfactorily meet [the demands of providing annual file disclosures], 
including the efficacy of a system of staggering the availability to 
consumers of such [annual file disclosures].'' The proposed rule 
provided for a staggering of availability over a nine-month transition 
in which regions of the country would successively become eligible 
every three months. The NPR stated that ``there is no basis for 
concluding ongoing staggering of the availability of annual file 
disclosures is necessary'' and, accordingly, the proposed rule did not 
provide for such staggering beyond the transition period. 69 FR at 
13196.
    The nationwide consumer reporting agencies urge the Commission to 
change this process in two ways: (1) to permit consumers to request 
file disclosures only during discrete periods of time (e.g., birth 
month or birth quarter); and (2) to continue this segmentation in 
perpetuity. One nationwide consumer reporting agency expresses doubt 
that the Commission has properly considered ongoing, permanent 
staggering of annual file disclosure availability. This commenter 
maintains the Commission is ``ignor[ing] the plain language of the 
statute [by] maximizing consumer ease of access at the expense of the 
staggered availability contemplated by the statute.''\54\The commenter 
suggests that the FACT Act requires the Commission to adopt such 
staggering if it is found to be effective in ensuring that nationwide 
consumer reporting agencies can meet their responsibilities.
---------------------------------------------------------------------------

    \54\ Comment, Equifax Information Services LLC 000028.
---------------------------------------------------------------------------

    The Commission has considered the significant demands placed upon 
the nationwide and nationwide specialty consumer reporting agencies in 
the process of formulating both the proposed and the final rule. As 
noted in the NPR, these demands include not only the provision of 
annual file disclosures to consumers, but also

[[Page 35484]]

demands associated with simultaneously responding to requests for other 
types of file disclosures, such as free file disclosures resulting from 
adverse action under FCRA Sec.  612(b), 15 U.S.C. 1681j(b), and free 
file disclosures provided in response to suspected fraud under FCRA 
Sec.  612(c)(3), 15 U.S.C. 1681j(c)(3). Further, consumer reporting 
agencies may face additional significant demands in responding to 
inquiries, or requests for reinvestigation,\55\ generated through each 
of these types of file disclosures. The Commission has also considered, 
and adopted, a number of appropriate means to ensure that nationwide 
consumer reporting agencies can meet those demands, including a 
staggered transition period and two levels of surge protection. The 
Commission does not agree that the FACT Act's direction to ``consider . 
. . appropriate means to ensure that consumer reporting agencies can 
satisfactorily meet [the significant demands]'' (emphasis supplied) 
equates to a mandate to adopt a particular scheme of staggering, 
especially when viewed in light of the FACT Act's direction also to 
consider the ease by which consumers should be able to request annual 
file disclosures. FACT Act Sec.  211(d).
---------------------------------------------------------------------------

    \55\ See FCRA Sec.  611(a), 15 U.S.C. 1681i(a).
---------------------------------------------------------------------------

    The nationwide consumer reporting agencies themselves state that 
consumer demand for annual file disclosures, after the transition 
period, can be reasonably anticipated based upon experiential data. The 
final rule provides for a gradual, staggered roll-out, final rule Sec.  
610.2(i), and for protection from unexpected surges in file disclosure 
demand, both during the rollout period and thereafter, Sec.  610.2(e). 
Further, the FACT Act provides nationwide consumer reporting agencies 
with considerable flexibility in meeting the significant demands placed 
upon them. As noted above, the FACT Act allows nationwide consumer 
reporting agencies 15 days from the time a request for an annual file 
disclosure is received to provide that disclosure. FACT Act Sec.  
211(a), codified at FCRA Sec.  612(a)(2), 15 U.S.C. 1681j(a)(2). The 
Act also allows nationwide consumer reporting agencies a significantly 
longer period of time to resolve requests for reinvestigation when they 
originate from an annual file disclosure. FACT Act Sec.  211(a), 
codified at FCRA Sec.  612(a)(3), 15 U.S.C. 1681(a)(3) (45 days, rather 
than 30 days). In addition, annual file disclosures must be provided 
only once in a 12-month period. The 12-month limitation should result 
in the continuation of the demand-smoothing effects of the transition 
roll-out scheme, for the requests that are first made during that 
period. This provides some ongoing limitation on unexpected volume 
after the transition period-i.e., a consumer who received an annual 
file disclosure when his or her state first became eligible under the 
transition provisions is not eligible to request another such 
disclosure for 12 months.
    Accordingly, the Commission determines that ongoing staggering of 
the availability of the annual file disclosures is not an appropriate 
means to ensure that the nationwide consumer reporting agencies can 
meet the significant demands placed upon them by the FACT Act, 
particularly when balanced against the interests of consumers in having 
ready access to file disclosures. The high and extraordinary request 
volume protections incorporated into the final rule achieve the same 
objective, and strike a better balance between the competing interests. 
The Commission intends, however, to closely monitor the progress of the 
transition and the capability of the nationwide consumer reporting 
agencies to respond to actual request volume, and may adjust the rule, 
as necessary or appropriate, in the future.

Section 610.2(f)--Information use and disclosure

    Under the proposed rule, Sec.  610.2(f) addressed only information 
security. The proposed rule did not contain any limitations on use and 
disclosure of information collected by the centralized source.\56\ In 
the NPR, the Commission posed several questions regarding what, if any, 
use and disclosure restrictions would be appropriate for the personally 
identifiable information collected through the centralized source. 
Based upon those comments, as described below, the Commission adopts a 
new Sec.  610.2(f) in the final rule, addressing information use and 
disclosure. The provision of the proposed rule relating to information 
security has been deleted, as discussed below.
---------------------------------------------------------------------------

    \56\ Proposed rule Sec.  610.2(b)(2)(ii) did address collection 
of information by the centralized source, but not use or disclosure 
of the information collected. This provision has been altered 
slightly in the final rule. See discussion under Sec.  610.2(b) of 
this notice, supra.
---------------------------------------------------------------------------

    Information use and disclosure.
    The majority of consumer and consumer advocate commenters assert 
that the final rule should contain restrictions on ``secondary'' use 
and disclosure of information collected through the centralized source. 
These commenters argue that consumers must be reassured that providing 
their information to the centralized source will not subject them to 
unintended consequences, such as unwanted marketing. Further, these 
commenters note that because concern for information privacy is ``a key 
motivating factor for consumers to request their [file disclosures],'' 
a final rule that does not restrict use and disclosure of information 
``will seriously impair [consumers'] trust in the system.''\57\ For 
these reasons, the commenters advocate that use and disclosure of 
information collected through the centralized source be limited to 
verifying the identity of the consumer making the request.
---------------------------------------------------------------------------

    \57\ Comment, Consumer Federation of America et al. 
000019.
---------------------------------------------------------------------------

    Similarly, some marketers of credit-related products and services 
also recommend that secondary uses of the personally identifiable 
information collected through the centralized source be prohibited. One 
commenter asserts, for example, that without such restrictions, 
``consumers will be forced to choose between exercising their rights 
[to obtain an annual file disclosure] . . .and maintaining their 
privacy.''\58\ Further, these commenters argue that the ability to use 
and disclose this consumer information would provide the nationwide 
consumer reporting agencies with an unfair competitive advantage.\59\ 
In contrast, CDIA comments that the final rule should not attempt to 
interfere with the use and disclosure requirements already applicable 
to such personal information.
---------------------------------------------------------------------------

    \58\ Comment, Intersections Inc. 000034.
    \59\ These commenters assert the same arguments that some 
advanced to support banning the marketing and advertising of non-
statutorily mandated products on the centralized source. The 
Commission's response to this argument is discussed under Sec.  
610.2(g) of this notice.
---------------------------------------------------------------------------

    The Commission notes that the information collected by the 
centralized source may include information that consumers view as 
particularly sensitive and vulnerable to misuse-such as Social Security 
numbers. Under FCRA Sec. 612(a)(1)(B), 15 U.S.C. 1681j(a)(1)(B), 
consumers can obtain annual file disclosures from the nationwide 
consumer reporting agencies only through the centralized source. In 
obtaining free annual file disclosures, then, consumers are compelled 
to use the centralized source. As a result, if consumers are reluctant 
to use the centralized source due to concerns relating to the use and 
disclosure of their personal information, the purpose of the FACT Act's 
requirement for free annual file disclosures would be thwarted.
    Further, as some commenters point out, the Commission believes it 
is not

[[Page 35485]]

appropriate to make the availability of annual file disclosures -- a 
right conferred by federal law -- contingent on a consumer's 
willingness to subject personal identifying information to unrelated, 
secondary uses. In this sense, the final rule is analogous to the 
Commission's restriction on secondary uses of the Do Not Call Registry 
required by the Telemarketing Sales Rule, 16 CFR Part 310 (TSR). Under 
the TSR, use of the Commission's Do Not Call Registry for purposes 
other than to prevent telephone calls to the persons listed is 
prohibited. 16 CFR 310.2(b)(2). Similar reasoning applies here; 
consumers should not be subjected to unrelated uses of their 
information as a condition of availing themselves of protections and 
benefits afforded to them by law.
    For these reasons, in the final rule Sec.  610.2(f), the Commission 
limits the use and disclosure of ``any personally identifiable 
information collected from consumers as a result of a request for 
annual file disclosure, or other disclosure required by the [FCRA], 
made through the centralized source.'' This provision applies only to 
personally identifiable information that is collected as the result of 
providing a statutorily-mandated product-such as a file disclosure or 
credit score. As noted under Sec.  610.2(g) of this notice, infra, the 
final rule does not prevent nationwide consumer reporting agencies from 
offering other products and services through the centralized source. 
The Commission notes that use and disclosure of information collected 
as a result of a consumer purchase of one of these non-statutorily-
mandated products is not subject to the limitation of Sec.  610.2(f).
    Final rule Sec.  610.2(f) permits use and disclosure of personally 
identifiable information in four ways: ``[1] to provide the annual file 
disclosure or other disclosure requested by the consumer; [2] to 
process a transaction requested by the consumer at the same time as a 
request for annual file disclosure or other disclosure; [3] to comply 
with applicable legal requirements, including those imposed by the Fair 
Credit Reporting Act and this [rule]; and [4] to update personally 
identifiable information already maintained by the nationwide consumer 
reporting agencies for the purpose of providing consumer reports, 
provided that the nationwide consumer reporting agency uses and 
discloses the updated personally identifiable information subject to 
the same restrictions that would apply to the information updated.''
    The final rule makes it clear that personally identifiable 
information collected through the centralized source may be used and 
disclosed as necessary to process a transaction that the consumer 
requests at the same time as a statutorily-mandated disclosure. The 
purpose of this provision is to avoid requiring consumers to reenter 
the information in order to purchase a non-statutorily mandated 
product.
    Some consumer advocacy organizations express concern regarding the 
use of information collected through the centralized source to enhance 
the nationwide consumer reporting agencies' consumer reporting files. 
The final rule permits nationwide consumer reporting agencies to use 
the information collected through the centralized source to update the 
information they already maintain for consumer reporting purposes, but 
would not permit them to add additional information that they do not 
already collect from other sources -- such as an email address. This 
provision would also prevent nationwide consumer reporting agencies 
from using the protected information to develop new consumer files for 
non-consumer reporting agency purposes.
    The Commission notes that the information maintained by nationwide 
consumer reporting agencies for consumer reporting purposes is subject 
to a variety of restrictions under existing law. The Commission does 
not believe it would be appropriate to permit the updating of such 
information to interfere with any use and disclosure limitations that 
may apply to the existing data prior to the update. For this reason, 
this provision makes clear that if a nationwide consumer reporting 
agency uses personally identifiable information obtained from consumers 
requesting disclosures through the centralized source to update 
information it maintains for consumer reporting purposes, the updated 
information is subject to the same restrictions that apply to the 
original, pre-updated data. One commenter from outside the consumer 
reporting industry suggests that use and disclosure of information 
collected through the centralized source is already limited to 
``permissible purposes'' under the FCRA.\60\ This commenter argues that 
any provision of the final rule that restricts the use and disclosure 
of such information would be an attempt to change the operation of the 
FCRA itself.\61\ This is not the case. The FCRA limits the use and 
disclosure of ``consumer reports.'' As noted above, most information 
collected through the centralized source is not a ``consumer report'' 
as that term is defined under the FCRA, and thus, the FCRA's 
restrictions on use and disclosure of consumer reports do not apply. To 
the extent that information collected through the centralized source is 
consumer report information, final rule Sec.  610.2(f) would permit the 
nationwide consumer reporting agencies to use that information to 
update their consumer report files. Thus, contrary to the commenter's 
assertions, the final rule's restriction on use and disclosure of 
information collected through the centralized source does not impact 
the availability of consumer reports for permissible purposes under the 
FCRA.
---------------------------------------------------------------------------

    \60\ See FCRA Sec.  604, 15 U.S.C. 1681b.
    \61\ Comment, ACA International 000043.
---------------------------------------------------------------------------

    Information security.
    The proposed rule, in Sec.  610.2(f), required nationwide consumer 
reporting agencies to comply with the requirements set forth in 
Standards for Safeguarding Customer Information, 16 CFR 314 (the 
Safeguards Rule),\62\ regarding all personally identifiable information 
collected through or disclosed by the centralized source. 
Representatives of the nationwide consumer reporting agencies comment 
that this provision of the proposed rule is unnecessary because 
consumer reporting agencies are financial institutions subject to the 
Commission's jurisdiction under GLBA, and thus, already subject to the 
Safeguards Rule. See 67 FR 36484, 36485 (May 23, 2002). Representatives 
of the nationwide consumer reporting agencies also comment that by 
requiring compliance with the Safeguards Rule in this rule, the 
Commission has sought to alter the scheme of GLBA by applying the 
FCRA's private right of action to GLBA violations where no private 
right of action previously existed.
---------------------------------------------------------------------------

    \62\ 16 C.F.R. Part 314 was promulgated by the Commission 
pursuant to the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. 6801 et 
seq.
---------------------------------------------------------------------------

    The Commission notes that the nationwide consumer reporting 
agencies are subject to a variety of existing laws relating to 
unauthorized access and[sol]or security of information they collect and 
disclose, including, but not limited to the FCRA, the Safeguards Rule 
and the FTC Act. The record in this rulemaking provides no basis for 
concluding that these existing requirements are inadequate to address 
the information collected and disclosed through the centralized source, 
or that the centralized source creates any new or unique risks that are 
not addressed by such existing requirements. Thus, the Commission does 
not believe it is necessary to duplicate or augment those requirements 
in the final rule.

[[Page 35486]]

 Accordingly, Sec.  610.2(f) of the proposed rule is not adopted in the 
final rule.

Section 610.2(g)--Communications provided by the centralized source

    The Commission noted in the NPR that the centralized source would 
afford the nationwide consumer reporting agencies the opportunity to 
communicate information to consumers about other credit-related 
products and services they may sell. In addition, the Commission stated 
that the proposed rule would not prohibit these agencies from offering 
other file disclosures or products and services, in addition to the 
required annual file disclosures, through the centralized source. In 
order to ensure that such advertising or marketing does not undermine 
the purpose of the centralized source, or mislead consumers, Sec.  
610.2(g) of the proposed rule states that any communications provided 
through the centralized source ``shall not interfere with, detract 
from, contradict, or otherwise undermine the purpose of the centralized 
source.'' In addition, the proposed rule listed examples of 
representations that would be unacceptable: (1) pop-up advertisements 
that hinder the consumer's ability to complete an online request for 
annual file disclosures; (2) representations that a consumer must 
purchase a product in order to receive or understand the file 
disclosures; (3) representations that the annual file disclosures are 
not free or that requesting them will have a negative impact on the 
consumer's credit rating; and (4) representations that other products 
are free, if that is not the case, or failing to disclose clearly and 
prominently that a service advertised as initially free must be 
cancelled to avoid a charge.
    The final rule retains this provision with only minor 
modifications. The example described in Sec.  610.2(g)(2)(i) with 
respect to pop-up advertisements has been modified to make clear that 
any offers or promotions that hinder the consumer's ability to complete 
an online request for file disclosures would constitute undue 
interference with the purpose of the centralized source.
    A number of commenters, including consumer organizations, 
individual consumers, and businesses that market credit-related 
products or services, address this issue, urging the Commission to 
prohibit advertising and marketing on the centralized source. 
Competitors of the nationwide consumer reporting agencies argue that 
advertising and marketing would give the nationwide consumer reporting 
agencies an unfair competitive advantage. Consumer advocacy 
organizations argue that the promotion of products or services - other 
than credit scores - would necessarily confuse consumers and undermine 
the purpose of the centralized source. Moreover, they did not believe 
that any regulation could address adequately the potential for 
confusion or deceptive advertising practices. In addition, some argue 
that any advertising or marketing of products on the centralized source 
would carry an implication of government endorsement or approval of the 
products offered.
    Most of these commenters further argue that there is no 
congressional authority to allow the centralized source to be used for 
other purposes. In addition, some suggest that if there is to be 
advertising and marketing on the centralized source, the source should 
be made available to other sellers of credit products or services or to 
consumer groups that wish to provide their own information about credit 
issues.
    Comments from the nationwide consumer reporting agencies and CDIA 
generally favor the Commission's approach on this matter, although some 
express concern that the language of this rule provision is not 
sufficiently specific to provide clear guidance.
    Section 212(a) of the FACT Act requires that consumer reporting 
agencies inform consumers about the availability of credit scores when 
providing file disclosures to them. Further, a credit score that is 
based upon consumer reporting information can only be generated from 
that information. A consumer must be properly identified and the 
appropriate consumer file must be located in order for either a credit 
score or a file disclosure to be generated. It would be an anomalous 
result, for both consumers and the nationwide consumer reporting 
agencies, for the law to require the centralized source to inform 
consumers about the availability of credit scores, but not permit them 
to obtain credit scores at that juncture. Accordingly, it is consistent 
with the FACT Act to make both file disclosures and credit scores 
available through the centralized source. Allowing consumers who wish 
to purchase credit scores to do so at the same time that they obtain 
their annual file disclosures will result in efficiency for both 
consumers and nationwide consumer reporting agencies.
    The statute, however, is silent with respect to other products or 
services that may be advertised or marketed on the centralized source. 
The Commission does not interpret this silence as an indication that 
the nationwide consumer reporting agencies are barred from the 
advertising or marketing of other products or services. An absolute 
prohibition of such communications would have to withstand scrutiny 
under U.S. Supreme Court decisions regarding the First Amendment and 
commercial speech. See Central Hudson Gas & Elec. Corp. v. Public Serv. 
Comm'n., 447 U.S. 557, 564 (1980). The Commission believes that its 
substantial interest in preventing communications that are misleading, 
confusing to consumers, or undermine the purpose of the centralized 
source can be served by less restrictive means than an absolute ban, 
and it has crafted Sec.  610.2(g) accordingly.
    The purpose of the centralized source is to enable consumers to 
make a single request to obtain annual file disclosures from the 
nationwide consumer reporting agencies. Advertising or marketing must 
be secondary to, and constrained by, that purpose. If a consumer is 
hindered in the effort to make an online request for file disclosures 
by the need to view and respond to, or close windows for, multiple 
offers of products and services, such communications would interfere 
with or undermine the purpose of the centralized source. Any 
representation that a consumer must purchase a product in order to 
receive or understand the annual file disclosure would contradict and 
detract from the right to obtain the free annual disclosure. Similarly, 
any representation that the file disclosure request itself will have a 
negative effect on the consumer's credit rating would undermine and 
detract from the right to the free annual disclosure. The same would be 
true of misrepresentations about the cost of other products or 
services, or the terms of any subscription service such as credit 
monitoring.
    The Commission further notes that the specific provisions of the 
rule are not the only mechanisms available to it to address deceptive 
or unfair marketing practices in connection with the operation of the 
centralized source. The FTC Act's prohibition against such practices 
also would apply to the nationwide consumer reporting agencies in their 
joint operation of the centralized source, just as it does in their 
individual business operations. 15 U.S.C. 45(a). For example, any 
express or implied claim that any product or service offered via the 
centralized source bears government approval or endorsement would be 
deceptive, and therefore a violation of the FTC Act. The Commission 
believes that the enforcement tools available to the agency, under both 
the rule and the FTC Act, will enable it to ensure that the centralized 
source is operated in an appropriate manner - i.e., one that enables 
consumers to request their

[[Page 35487]]

annual file disclosures easily and without being subjected to deceptive 
or unfair practices.
    The Commission believes that, in general, competition with regard 
to credit-related products and services may be enhanced as a result of 
the final rule, because easier consumer access to file disclosures may 
create greater consumer awareness of the entire industry. Further, any 
competitive advantage for the nationwide consumer reporting agencies is 
created by the FACT Act's requirement to establish the centralized 
source, an undertaking that imposes significant costs on the industry.

Section 610.2(h)--Effective date

    The FACT Act, in Sec.  211(d)(5), requires that the Commission 
issue centralized source regulations in final form no later than six 
months after the enactment date of the FACT Act, and that these rules 
take effect no later than six months after the date on which the 
regulations are issued in final form. The statute, therefore, requires 
that the effective date be no later than December 4, 2004.
    The Commission proposed an effective date of December 1, 2004, at 
which time the phase-in of consumer eligibility for free annual file 
disclosures would begin. Some consumers suggest that this transition 
would begin too late, and that free annual file disclosures should 
begin to be available as soon as the final rule is issued. Some members 
of Congress assert that the transition should be completed, and all 
consumers should be eligible to request their free annual file 
disclosures, by December 4, 2004.
    Representatives of the nationwide consumer reporting agencies 
comment that a six-month period is the minimum necessary time prior to 
the initial deployment of the centralized source to any portion of the 
country. These commenters explain that at least six months will be 
required to evaluate the final rule and design and build the necessary 
infrastructure for the centralized source.
    The Commission has considerable recent experience in designing and 
implementing structures to respond to large volumes of consumer 
requests, e.g. the implementation of the Do-Not-Call Registry. After 
considering the FACT Act requirements under Sec.  211(d), and the 
significant technological challenges presented by designing, building 
and implementing the centralized source required by this part, the 
Commission believes it is reasonable to require the nationwide consumer 
reporting agencies to begin to implement the centralized source about 
six months after the final rule is issued. Accordingly, the final rule 
becomes effective on December 1, 2004. Final rule Sec.  610.2(h).

Section 610.2(i)--Transition

    The final rule -- like the proposed rule-- requires a cumulative 
regional roll-out for the centralized source. Under Sec.  610.2(i), the 
centralized source will become available to consumers by region, 
starting in the west and moving eastward across the country, at three-
month intervals. Consumers residing in the western part of the United 
States (California and 12 other western states) will have access to the 
centralized source beginning on December 1, 2004.\63\ On March 1, 2005, 
consumers in 12 midwestern states also will become eligible to request 
their annual file disclosures from the centralized source. On June 1, 
2005, the centralized source will become available to consumers in 11 
southern states. Finally, on September 1, 2005, the centralized source 
will become available to all remaining consumers, including those 
residing in eastern states, the District of Columbia, and all U.S. 
territories and possessions.
---------------------------------------------------------------------------

    \63\ According to the 2000 U.S. Census, these states account for 
22.1% of total U.S. population.
---------------------------------------------------------------------------

    Some consumers and consumer groups comment that there is 
insufficient evidence to justify any gradual transition scheme. 
Accordingly, those commenters suggest that annual file disclosures 
should be available without a segmented approach to consumer 
eligibility. These commenters also suggest that if the final rule 
provides for any transition, it should allow for only a very short 
``test'' period when the centralized source would be available to a 
portion of the country. If the consumer demand proved overwhelming 
during the ``test,'' they argued, the Commission could then amend the 
rule to provide a more structured roll-out for the rest of the country. 
In contrast to these comments, all representatives of the consumer 
reporting industry emphasize the need for a substantial structured 
transition in order to manage initial consumer demand for annual file 
disclosures.
    Section 211(d)(4) of the FACT Act requires that the Commission's 
regulations provide for an ``orderly transition'' for nationwide 
consumer reporting agencies to fully implement the centralized source. 
The FACT Act directs that this transition be conducted in a manner that 
does not temporarily overwhelm such consumer reporting agencies with 
requests for disclosures beyond their capacity to deliver; and does not 
deny creditors, other users, and consumers access to consumer reports 
on a time-sensitive basis for specific purposes, such as home purchases 
or suspicions of identity theft, during the transition period. This 
provision of the statute clearly indicates that Congress contemplated 
allowing the nationwide consumer reporting agencies some period of time 
in which to build and implement the centralized source.\64\
---------------------------------------------------------------------------

    \64\ Some commenters suggested that even if the rule allows a 
transition period to phase in the availability of the centralized 
source, consumers who approach an individual nationwide consumer 
reporting agency directly should be entitled to receive their free 
annual file disclosures without waiting. The FACT Act amended FCRA 
Sec.  612(a) to require the nationwide consumer reporting agencies 
to make free annual file disclosures upon request of the consumer. 
This right was limited, however, to requests that are made using the 
centralized source. FCRA Sec.  612(a)(1)(B), 15 U.S.C. 
1681j(a)(1)(B).
---------------------------------------------------------------------------

    Given the significant development necessary to fully implement the 
centralized source, the Commission believes a gradual, segmented 
transition is appropriate. Further, the Commission notes that 
conditioning a structured transition on the results of a test period, 
as suggested by some commenters, would subject the availability of the 
centralized source to unreasonable uncertainty and delay. The 
Commission likely would not be able to examine test data and promulgate 
a revised rule without delaying the complete implementation of the 
centralized source. In the meantime, the nationwide consumer reporting 
agencies would be uncertain as to what this revised rule might require. 
Accordingly, the Commission believes that establishing, at the outset, 
a structured transition over a reasonable period of time will provide 
the best results for both industry and consumers.
    Transition Length.
    Consumers, consumer groups and members of Congress comment that the 
nine-month transition period set out in the proposed rule is 
unreasonably long, and that this delay in implementation is contrary to 
the intent of the FACT Act. These commenters point out that because the 
FACT Act was signed in December of 2003, and the transition does not 
begin until December of 2004, the nationwide consumer reporting 
agencies will already have had a year to work on meeting the 
requirements of the rule before the transition period begins. They 
assert that, without specific substantiation for such a delay, an 
additional nine months is an unreasonable amount of time for consumers 
-- especially those at the end of the transition scheme -- to wait to 
receive their annual file disclosures.
    On the other hand, representatives of the nationwide consumer 
reporting

[[Page 35488]]

agencies assert that a transition period of nine months is too short to 
ensure a smooth implementation. They contend that even with this time 
frame, they are compelled to begin the process of building the 
centralized source prior to issuance of the final rule. They argue that 
a transition of two years is needed to fully implement the centralized 
source. During the first year of this suggested transition, consumers 
would become eligible for discrete periods of time (rather than on a 
cumulative basis). These commenters maintain that the centralized 
source's first year of operation will not provide reliable data to 
determine the appropriate baseline for operations of the centralized 
source, because demand will be uncharacteristically high due to 
consumer education efforts and media campaigns. The first six to nine 
months of the second year of operation, they argue, would provide 
better data to use in anticipating normal demand. After collecting that 
data, the nationwide consumer reporting agencies assert, they would 
adjust capacity accordingly.
    The Commission concludes that the proposed nine-month transition 
period proposed is appropriate. It is important for consumers to become 
eligible to obtain their annual file disclosures as quickly as 
practicable. The large number of consumers who commented on the 
proposed rule and requested a shorter transition is evidence that many 
consumers place much value on receiving these file disclosures.
    The Commission is mindful, however, that the transition provided by 
the final rule must enable the nationwide consumer reporting agencies 
to meet the significant demands of building and adjusting a system with 
adequate capacity to respond to requests from all eligible consumers at 
the end of the transition. The nationwide consumer reporting agencies 
comment that significant adjustments in the capacity of the centralized 
source will require 60 to 90 days. Accordingly, a nine-month transition 
provides the nationwide consumer reporting agencies with adequate 
opportunity to adjust capacity based upon the experience provided by 
the first two segments, prior to the implementation of the centralized 
source nationwide. Further, this transition length and roll-out assist 
in smoothing out demand after the transition. That is, each group to 
become eligible in a period will not be able to request another annual 
file disclosure for 12 months, which will cause some natural staggering 
by groups after the transition.
    For these reasons, the Commission believes that nine months 
provides adequate time, in light of the number of consumer files 
maintained by the nationwide consumer reporting agencies and the 
significant development demands that the centralized source will 
require, to gradually build capacity to meet full demand. Accordingly, 
Sec.  610.2(i)(1) is adopted as proposed.
    Regional Rollout.
    Consumers and consumer advocacy groups comment that, in the event 
the final rule provides for a rollout, a regional rollout is preferable 
to one based on birth date or other identifier. These commenters assert 
that a regional approach permits better consumer education through 
regional and local media, and it aids in household financial management 
in that it allows members of the same household to obtain their free 
annual file disclosures at the same time.
    Representatives of the nationwide consumer reporting agencies 
suggest, however, that a preferable method of staggering eligibility 
would be by consumers' birth month, or first initial of last name, 
rather than by region of the country. Some commenters, including a 
member of Congress, advocate staggering eligibility based upon Social 
Security number. The nationwide consumer reporting agencies argue that 
a regional approach would exacerbate demand on the centralized source 
due to local media and advocacy group efforts.
    The Commission believes that a regional approach is the most 
effective and appropriate method to roll out the centralized source. A 
regional rollout can be easily understood by consumers and will be 
complemented by local and regional press coverage, which will remind 
consumers when the centralized source becomes available to their state 
or media market.\65\ Further, an approach that allows members of the 
same household to obtain their annual file disclosures at the same time 
is efficient and convenient for consumers.
---------------------------------------------------------------------------

    \65\ The regional divisions do not divide metropolitan 
statistical areas.
---------------------------------------------------------------------------

    Some commenters assert that the rollout of eligibility from the 
western part of the country eastward unreasonably discriminates against 
consumers residing in the east. The Commission acknowledges that 
consumers in the east will wait longer before becoming eligible to 
receive annual file disclosures than consumers elsewhere in the 
country. The Commission notes, however, that in any transition scheme, 
regardless of the method of segmentation, some segment will wait longer 
than others. Further, of the seven states where free file disclosures 
are currently available under state law,\66\ five are in the eastern 
segment of the transition. As noted in the NPR, the transition allows 
implementation of the centralized source to begin with the smallest 
segment by population -- the west -- and gradually build to the 
capacity to handle the addition of the final, largest segment. The 
Commission believes this structure to be an appropriate means of 
facilitating a smooth transition.
---------------------------------------------------------------------------

    \66\ Colorado, Maine, Maryland, Massachusetts, New Jersey, 
Georgia, and Vermont. The frequency of the availability of free file 
disclosures in these states is not preempted by the FACT Act. FACT 
Act Sec.  212(e)(4).
---------------------------------------------------------------------------

    Representatives of the nationwide consumer reporting agencies 
comment that one nationwide consumer reporting agency currently 
receives a disproportionate number of requests for file disclosures in 
the western region as compared to other regions. Accordingly, these 
commenters suggest beginning the transition with a region other than 
the west. The Commission notes that, although one nationwide consumer 
reporting agency may currently receive a disproportionate number of 
file disclosure requests from consumers in the west, there is a smaller 
total population in that region than in any other segment of the 
transition. The Commission believes that the higher request rate in 
that region may not repeat itself in the requests for annual file 
disclosures. Indeed, since the requests in that region are already 
higher, it may be that the incremental increase in demand for annual 
file disclosures will be smaller in the west than in the other regions. 
Accordingly, the Commission adopts a regional rollout, which will occur 
in four segments, moving from west to east.\67\
---------------------------------------------------------------------------

    \67\ Some commenters raised questions regarding the timing of 
eligibility of consumers serving in military active duty. Consumers 
serving in military active duty will become eligible during the 
transition based on their addresses of record with creditors. The 
FACT Act provides additional rights to consumers on military active 
duty and their families. See, FACT Act Sec.  112.
---------------------------------------------------------------------------

Surge Protection During the Transition

    High request volume during transition. The proposed rule provided 
nationwide consumer reporting agencies with some relief, during the 
transition period, in times of high request volume that does not reach 
the extraordinary request volume benchmark. Under proposed rule 
610.2(i)(3), when consumer request volume exceeded 115% of the rolling 
daily seven-day average, the nationwide consumer reporting agencies 
were permitted to place requests into a queue for processing at a 
reasonable later time.

[[Page 35489]]

 See discussion under Sec.  610.2(e) of this notice, supra.
    Representatives of the nationwide consumer reporting agencies 
comment in support of this intermediate threshold at which they could 
begin to queue consumer requests. These commenters suggest, however, 
that the level for high request volume, during the transition, should 
be set at any volume above the initial capacity\68\ of the centralized 
source, request method or nationwide consumer reporting agency. 
Consumers and consumer groups also comment on this provision of the 
rule, asserting that the 115% threshold was set too low because 
fluctuations in request volume at that level were not excessive. They 
suggest instead using a trigger of 200% of the daily rolling seven-day 
average.
---------------------------------------------------------------------------

    \68\ See discussion of initial capacity, under Sec.  610.2(c) 
supra.
---------------------------------------------------------------------------

    The Commission believes that setting the threshold for high request 
volume during the transition at 115% is appropriate. Request volume is 
likely to be particularly volatile during the transition period. Thus, 
a transition high request volume threshold that is slightly lower than 
the post-transition threshold is appropriate. The 115% level is 
sufficiently sensitive to provide some relief to the nationwide 
consumer reporting agencies during times of unexpected high demand. 
Accordingly, the final rule, Sec.  610.2(i)(2), generally provides for 
high request volume relief during the transition when volume exceeds 
115% of the daily rolling seven-day average.
    Extraordinary request volume during the transition. Under the 
proposed rule, during the transition, extraordinary request volume was 
generally defined as twice the daily rolling seven-day average volume 
of requests. In general, comments on the threshold for extraordinary 
request volume during the transition track the comments made regarding 
extraordinary request volume outside the transition, and are discussed 
fully under Sec.  610.2(e) of this notice, supra. Because the final 
rule provides complete relief from liability when extraordinary request 
volume is reached, the Commission believes the same extraordinary 
request volume threshold--175% --is appropriate both during the 
transition period and after. Thus, the Commission determines that 175% 
of the daily rolling 7-day average volume is appropriate to provide 
relief to the nationwide consumer reporting agencies during periods of 
truly extraordinary request volume during the transition. Final rule 
Sec.  610.2(i)(3).
    First week of transition. As explained under Sec.  610.2(e) of this 
notice, supra, the final rule generally provides high request volume 
and extraordinary request volume relief for the nationwide consumer 
reporting agencies when request volume reaches specific thresholds 
based upon rolling daily average of requests over the previous 90 days. 
During the transition period, when request volume may be most volatile, 
both high and extraordinary request volume levels are generally 
calculated based upon seven-day rolling averages, in order to 
accommodate the unique structure of the transition and the volatile 
demand for annual file disclosures that may prevail during that time.
    During the first week of the transition, high and extraordinary 
request volume levels are determined in reference to the reasonably 
anticipated volume of consumer contacts to the centralized source. In 
other words, the nationwide consumer reporting agencies must use the 
reasonable procedures required under Sec.  610.2(c) to develop an 
estimate of expected volume for each centralized source request method, 
the centralized source as a whole, and each nationwide consumer 
reporting agency. During the first week of operations, high request 
volume will be calculated at 115% of this reasonably anticipated 
baseline volume. Final rule Sec.  610.2(i)(2)(i). Similarly, 
extraordinary request volume will be calculated based on 175% of that 
baseline. Final rule Sec.  601.2(i)(3)(i). From the second week, until 
the end of the transition, high and extraordinary request volume will 
be calculated based upon the rolling average volume of the previous 
seven days. Final rule Sec. Sec.  610.2(i)(2)(ii) and 610.2(i)(3)(ii).
    The nationwide consumer reporting agencies object to this structure 
as requiring them to build a system that will have vast amounts of 
excess capacity, and to adjust that capacity within an unreasonably 
short period of time-i.e., a week. As noted in the NPR, because it is 
tied to a seven-day time frame, the standard for extraordinary request 
volume in fact may produce rapid expansion of the system. If 
extraordinary levels of demand persist, the system's capacity would 
have to increase significantly every week in order to take advantage of 
the extraordinary request volume protections. CDIA asserts that these 
provisions would require the nationwide consumer reporting agencies to 
double the capacity of the system within two weeks of the 
implementation, and that such rapid expansion is simply not possible.
    The Commission believes that, viewed in light of the overall 
structure of the transition, these provisions are reasonable and 
appropriate. The development of the centralized source is a complex 
project, and the Commission assumes that, by necessity, the vast 
majority of the development will be completed before the transition 
period begins. It is reasonable to expect that although it will be 
required to service only about one quarter of the country during the 
initial weeks of implementation, the system will at that point be 
capable of handling substantially more than the anticipated volume 
associated with that segment of the country. Accordingly, the 
Commission believes it is reasonable to expect rapid expansion of the 
system within the first segment if, for example, request volumes prove 
to be even greater than could be anticipated in the first week of 
operations.
    Representatives of the nationwide consumer reporting agencies also 
comment that it may be unclear how the trigger for extraordinary 
request volume would operate during the first seven days of the 
transition. These commenters express concern that the provision may be 
interpreted to mean that the reasonably anticipated volume would adjust 
daily during that week. The Commission intends that the reasonably 
anticipated volume for that first week of the transition would remain 
constant.
    Accordingly, final rule Sec.  610.2(i)(2) defines high request 
volume during the first week as more than 115% of the daily total 
number of consumers that were reasonably anticipated to contact the 
centralized source and, from December 8, 2004 through the end of the 
transition, as more than 115% of the daily rolling seven-day average 
number of consumers that contact the centralized source. Similarly, 
Sec.  610.2(i)(3) of the final rule defines extraordinary request 
volume during the first week as more than 175% of the daily total 
number of consumers that were reasonably anticipated to contact the 
centralized source and, from December 8, 2004 through the end of the 
transition, as more than 175% of the daily rolling seven-day average 
number of consumers that contact the centralized source.

Section 610.3(a)--Streamlined process for requesting annual file 
disclosures from nationwide specialty consumer reporting agencies-
Streamlined process requirements.

    Section 211 of the FACT Act requires nationwide specialty consumer

[[Page 35490]]

reporting agencies \69\ to provide annual file disclosures to 
consumers, once during any 12-month period upon the request of the 
consumer and without charge to the consumer. The FACT Act directs the 
Commission to prescribe regulations\70\ to require the establishment of 
``a streamlined process'' for consumers to request their free annual 
file disclosures from these nationwide specialty consumer reporting 
agencies.\71\ The FACT Act expressly requires that the streamlined 
process must, at a minimum, include the establishment by each 
nationwide specialty consumer reporting agency of a toll-free telephone 
number for such requests. FACT Act Sec.  211(a), codified at FCRA Sec.  
612(a), 15 U.S.C. 1681j(a).
---------------------------------------------------------------------------

    \69\ As explained under Sec.  610.1(b)(10) of this notice, 
supra, a ``nationwide specialty consumer reporting agency'' means 
``a consumer reporting agency that compiles and maintains files on 
consumers on a nationwide basis relating to (1) medical records or 
payments; (2) residential or tenant history; (3) check writing 
history; (4) employment history; or (5) insurance claims.'' FCRA 
Sec.  603 (w), 15 U.S.C. 1681a (w).
    \70\ In promulgating its regulations applicable to nationwide 
specialty consumer reporting agencies, the Commission considered: 1) 
the significant demands that may be placed on consumer reporting 
agencies in providing annual file disclosures; 2) appropriate means 
to ensure that consumer reporting agencies can satisfactorily meet 
those demands, including the efficacy of a system of staggering the 
availability to consumers of such file disclosures; and 3) the ease 
by which consumers should be able to contact consumer reporting 
agencies with respect to access to such file disclosures. FACT Act, 
Sec.  211(a)(2).
    \71\ One nationwide specialty consumer reporting agency suggests 
that the FTC further define: the term ``nationwide specialty 
consumer reporting agency;'' the meaning of the enumerated types of 
information that trigger Sec.  603(w) status; the phrase ``compiled 
and maintained;'' and the information required to be disclosed in 
the ``annual file disclosure.'' See discussion under Sec.  610.1(b) 
of this notice, supra.
---------------------------------------------------------------------------

    Streamlined process requirements. Under the proposed rule Sec.  
610.3(a)(1), each nationwide specialty consumer reporting agency was 
required to establish a streamlined process for accepting and 
processing consumer requests for annual file disclosures, which, at a 
minimum, shall include the establishment of a toll-free telephone 
number for accepting such requests. To enable consumers to request 
annual file disclosures by telephone, the proposed rule required that 
nationwide specialty consumer reporting agencies make their streamlined 
process toll-free number available to consumers in specific ways: by 
publication in any telephone directory in which the entity has its 
telephone number published, Sec.  610.3(a)(1)(ii), and by posting the 
toll-free number, along with instructions for requesting disclosures 
via any additional request methods, on any website owned or maintained 
by the entity, Sec.  610.3(a)(1)(iii).
    In response to a comment by CDIA, writing on behalf of its 
nationwide specialty consumer reporting agency members, the Commission 
modifies the wording of Sec.  610.3(a)(1)(i) and (iii) in the final 
rule to make clear that the only required request method is the toll-
free number; provision of additional request methods, such as mail or 
the Internet, is optional.
    Further, one nationwide specialty consumer reporting agency 
suggests that for companies that own and maintain many websites, the 
requirement to post the toll-free number and instructions for 
additional request methods on all websites is burdensome, may 
artificially increase consumer demand for annual file disclosures, and 
could potentially confuse consumers. The Commission has not deleted 
this provision, but has modified it to make it clear that a nationwide 
specialty consumer reporting agency need only post this information on 
websites that it owns and maintains and that are related to consumer 
reporting. The Sec.  610.3(a)(1)(iii) requirement is designed to make 
it as easy as possible for consumers to locate the nationwide specialty 
consumer reporting agencies and to learn how to request annual file 
disclosures. Several consumer advocacy organizations, in a joint 
comment, state that many consumers may be unfamiliar with the 
nationwide specialty consumer reporting agencies and the types of 
consumer files they maintain. They stress the importance of raising the 
public visibility of these agencies and informing consumers about the 
availability of these file disclosures. As the Commission noted in the 
NPR, this provision was not intended to require nationwide specialty 
consumer reporting agencies to post the toll-free telephone number on 
every page of a website. Rather, it was intended to require them to 
provide a clear and prominent link to such information on any website 
that the nationwide specialty consumer reporting agency owns or 
maintains that is related to consumer reporting. Final rule Sec.  
610.3(a)(1)(iii) makes this clear.
    Under proposed rule Sec.  610.3(a)(1)(i), nationwide specialty 
consumer reporting agencies were permitted, but not required, to 
provide request methods in addition to the required toll-free number, 
provided that when consumers contact the agency via its toll-free 
telephone number, they were given access to clear and easily 
understandable instructions for requesting annual file disclosures by 
any other available request method. In the final rule Sec.  
610.3(a)(1)(i), the Commission modifies this provision slightly to make 
clear that when a nationwide specialty consumer reporting agency 
provides instructions to consumers for requesting disclosures by any 
additional available request method, these instructions must ``not 
interfere with, detract from, contradict, or otherwise undermine the 
ability of consumers to obtain annual file disclosures through the 
streamlined process.''
    One nationwide specialty consumer reporting agency suggests that, 
because of its own unique and unusual business methods, taking a 
request by telephone would present difficulties for the company, such 
that it might not be able to service a request by telephone in as 
streamlined a manner as it could via alternative methods. The 
Commission notes, however, that the mandate of the FACT Act is 
unequivocal -- at a minimum, each nationwide specialty consumer 
reporting agency must establish a toll-free telephone number for 
consumers to request their free annual file disclosures. The FACT Act 
and the final rule require nationwide specialty consumer reporting 
agencies to accept consumer requests for file disclosures over the 
telephone. A nationwide specialty consumer reporting agency that 
consistently directs consumers to another request method and does not 
permit requests to be made by telephone-by requiring consumers to go to 
a website or sign a specific form, for example-does not meet the 
mandate of the FACT Act or the final rule.
    This commenter also suggests that requiring request methods other 
than telephone-for example mailing a signed document-is necessary to 
ensure proper identification of consumers. The Commission notes that 
FCRA Sec.  610(a) requires consumer reporting agencies to obtain 
``proper identification'' from consumers as a condition of providing a 
file disclosure. 15 U.S.C. 1681h(a). The final rule, however, permits 
nationwide and nationwide specialty consumer reporting agencies to 
collect only as much personally identifiable information from consumers 
as is reasonably necessary to properly identify the consumer. Final 
rule Sec. Sec.  610.2(b)(2)(ii) and 610.3(a)(2)(ii). The Commission 
does not believe that FCRA Sec.  610 is inconsistent with the 
requirement to accept requests by telephone. Given the unambiguous 
requirement of the FACT Act that nationwide specialty consumer 
reporting agencies accept telephone requests for annual file 
disclosures, it is incumbent upon nationwide specialty

[[Page 35491]]

consumer reporting agencies to develop methods to identify consumers by 
telephone, to the extent practicable.
    Operation of the streamlined process.
    Under the proposed rule, the streamlined process was required to be 
``designed, funded, implemented, maintained and operated'' in a manner 
that: has adequate capacity to accept reasonably anticipated volume, 
Sec.  610.3(a)(2)(i); collects only as much personal information as is 
reasonably necessary to properly identify the consumer, 
Sec. 610.3(a)(2)(ii); and provides clear and easily understandable 
information and instructions, Sec.  610.3(a)(2)(iii). These 
requirements are similar to the requirements for operation of the 
centralized source, discussed under Sec.  610.2(b) of this notice, 
supra.
    The proposed rule requirement to provide clear and easily 
understood information and instructions to consumers included a 
requirement to inform consumers of the progress of their request while 
they are in the process of making the request. Proposed rule Sec.  
610.3(a)(2)(iii)(A). For a Web site request method, if a nationwide 
specialty consumer reporting agency chooses to provide such a method, 
the proposed rule also required the nationwide speciality consumer 
reporting agencies to provide access to a ``help'' or ``frequently 
asked questions'' screen and instructions for filing complaints with 
the nationwide speciality consumer reporting agencies and the Federal 
Trade Commission. Proposed rule Sec.  610.3(a)(2)(iii)(B). Finally, in 
the event that a consumer cannot be properly identified in accordance 
with the FCRA Sec.  610(a)(1), 15 U.S.C. 1681h(a)(1), and other 
applicable laws and regulations, the proposed rule required the 
nationwide specialty consumer reporting agencies to notify the consumer 
of that fact, and to provide instructions on how to complete the 
request. Proposed rule Sec.  610.3(a)(2)(iii)(C).
    One nationwide speciality consumer reporting agency objects to the 
proposed rule requirement to inform consumers of the progress of their 
request while they are in the process of making the request, suggesting 
that it be eliminated because it is unclear, burdensome, and 
unworkable. For reasons similar to those discussed above in connection 
with the requirements of Sec.  610.2(b)(2)(iv)(A) of the final rule, 
the Commission declines to adopt this recommendation. The language of 
this provision, which has been retained in the final rule, makes clear 
that the status information requirement operates ``while the consumer 
is in the process of making a request;'' thus, it would operate in the 
context of both telephone and on-line requests. For example, a status 
message that instructs telephone consumers to ``please hold while we 
locate your file,'' would ensure that consumers do not mistakenly 
discontinue the telephone ordering process without finishing their 
request. The Commission recognizes, however, that for other possible 
request methods, such as mail, the requirement would be inappropriate 
and therefore not apply.
    The Commission did not receive further significant comment relating 
to proposed rule Sec.  610.3(a), and it is adopted with the 
modifications discussed above.

Section 610.3(b)--Requirement to anticipate

    Similar to the requirements relating to the centralized source, 
discussed under Sec.  610.2(c) of this notice, supra, proposed rule 
Sec.  610.3(b) required that nationwide specialty consumer reporting 
agencies implement reasonable procedures to anticipate and respond to 
the volume of consumers who will contact them to request file 
disclosures through the streamlined process.
    One nationwide specialty consumer reporting agency and CDIA suggest 
that the requirements for contingency planning be deleted and replaced 
by a provision to relieve entities of any obligation to deliver reports 
when conditions beyond the control of the nationwide specialty consumer 
reporting agency occur. The Commission declines to adopt this 
suggestion. Rather, the final rule retains, but modifies, the 
contingency planning provisions applicable to nationwide specialty 
consumer reporting agencies, for the same reasons discussed under Sec.  
610.2(c) of this notice, supra.

Section 610.3(c)--High request volume and Extraordinary request volume

    Under proposed rule Sec.  610.3(c), nationwide specialty consumer 
reporting agencies would not be deemed in violation of the adequate 
capacity requirement in times of extraordinary request volume, provided 
that they implemented reasonable procedures in compliance with Sec.  
610.3(b).\72\ CDIA and a nationwide specialty consumer reporting agency 
suggest that the proposed definition of extraordinary request volume-- 
i.e., volume that exceeds 200% of the rolling 90-day daily average--be 
revised.\73\ In the NPR, the Commission sought data with regard to the 
issue of setting the extraordinary request volume threshold; however, 
it received very little specific information relating to nationwide 
specialty consumer reporting agencies in this regard. For reasons 
discussed under Sec.  610.2(e) of this notice supra, however, the final 
rule modifies the extraordinary request volume threshold to 175% of 
average daily volume.
---------------------------------------------------------------------------

    \72\ One commenter mistakenly suggests that the proposed rule 
contains no definition of ``extraordinary request volume'' 
applicable to nationwide specialty consumer reporting agencies 
beyond the transition period described in proposed rule Sec.  
610.3(g). As final rule Sec.  610.1(a) explains, the definitions 
contained in section 610.1(b) apply throughout this part, including 
in both Sec.  610.2 and Sec.  610.3 of the final rule.
    \73\ The consumer reporting agency recommends that 
``extraordinary request volume'' be set at 110% of the rolling 90-
day daily average, and CDIA suggests that ``extraordinary request 
volume'' should be more than 125% of the rolling 90-day daily 
average.
---------------------------------------------------------------------------

    In response to comments received with regard to the centralized 
source, as well as comments from CDIA, writing on behalf of its 
nationwide specialty consumer reporting agency members, the Commission 
has also crafted a provision to allow nationwide specialty consumer 
reporting agencies to obtain relief during times of high request 
volume. Final rule Sec.  610.3(c)(1) allows a nationwide specialty 
consumer reporting agency to collect the request information in a queue 
for processing at a reasonable later time, so long as the nationwide 
specialty consumer reporting agency informs the consumer as to when the 
request will be accepted for processing. The high request volume 
trigger for nationwide specialty consumer reporting agencies is the 
same as that which applies to the centralized source-more than 125% of 
the rolling 90-day daily average. Final rule Sec.  610.1(b)(8).
    As noted under Sec.  610.2(c) above, one comment from a nationwide 
consumer reporting agency suggests the need for some protection to 
apply during system maintenance. The Commission notes that this need is 
equally applicable to the nationwide specialty consumer reporting 
agencies. Final rule Sec.  610.3(b)(2) provides that a nationwide 
specialty consumer reporting agency will not be deemed in violation of 
the streamlined process requirements if the toll-free number is 
unavailable to take requests for a reasonable period of time for 
purposes of maintenance, provided that the agency makes other request 
methods available to consumers during such time.

Section 610.3(d)--Information use and disclosure

    Final rule Sec.  610.3(d) provides that, ``[a]ny personally 
identifiable information collected from consumers as a result of a 
request for annual file disclosure, or other disclosure required

[[Page 35492]]

by the Fair Credit Reporting Act, made through the streamlined process 
required by this part, may be used or disclosed by the nationwide 
specialty consumer reporting agencies only ``[1] to provide the annual 
file disclosure or other disclosure required under the FCRA requested 
by the consumer; [2] to process a transaction requested by the consumer 
at the same time as a request for annual file disclosure or other 
disclosure; [3] to comply with applicable legal requirements, including 
those imposed by the Fair Credit Reporting Act and this part; and [4] 
to update personally identifiable information already maintained by the 
nationwide specialty consumer reporting agency for the purpose of 
providing consumer reports, provided that the nationwide specialty 
consumer reporting agency uses and discloses the updated personally 
identifiable information subject to the same restrictions that would 
apply, under any applicable provision of law or regulation, to the 
information updated.'' This provision is nearly identical to the 
information use and disclosure provision applicable to nationwide 
consumer reporting agencies in Sec.  610.2(f), and is adopted subject 
to the same analysis provided under Sec.  610.2(f) of this notice, 
supra.
    Under Sec.  610.3(d) of the proposed rule, nationwide specialty 
consumer reporting agencies also were required to comply with the 
Safeguards Rule, 16 CFR part 314, for information collected and 
disclosed through the streamlined process. CDIA and America's Community 
Bankers, a trade association for the banking industry, suggest that 
this provision should not be applied to the nationwide specialty 
consumer reporting agencies. They argue that to the extent these 
entities are already subject to the Safeguards Rule under the GLBA, 
this rule would subject them to another layer of regulatory oversight. 
In addition, the commenters contend that under this rule, unlike under 
the GLBA Safeguards Rule, nationwide specialty consumer reporting 
agencies could be subject to private rights of action.
    As noted under Sec.  610.2(f), supra, of this notice, the 
information collected and disclosed by nationwide specialty consumer 
reporting agencies is subject to a variety of existing laws relating to 
unauthorized access and security of information, including, but not 
limited to, the FCRA, the Safeguards Rule, and the FTC Act. The 
Commission does not believe that it is necessary to duplicate or 
augment those requirements in the final rule. Accordingly, the final 
rule does not adopt proposed rule Sec.  610.3(d).

Section 610.3(e)--Requirement to accept or redirect requests

    The FACT Act requires nationwide consumer reporting agencies to 
provide annual file disclosures upon request, but only if such requests 
are received through the centralized source. As noted in the NPR, there 
is no similar statutory limitation applicable to the streamlined 
process to be developed by the nationwide specialty consumer reporting 
agencies. Accordingly, recognizing that many consumers may request 
their free annual file disclosures through a method other than the 
streamlined process, the final rule -- like the proposed rule -- 
requires nationwide specialty consumer reporting agencies either to 
honor those requests or to redirect the consumer to the streamlined 
process. Final rule Sec.  610.3(e).
    CDIA suggests that this provision be revised to make it analogous 
to the statutory requirement for the centralized source, i.e., to limit 
consumers' ability to request free annual file disclosures from these 
agencies to the required streamlined process methods. The Commission 
declines to adopt this suggestion. Although it might easily have done 
so, Congress did not limit the availability of annual file disclosures 
from nationwide specialty consumer reporting agencies to only those 
consumers who make requests through the streamlined process. Moreover, 
the rule provision does not impose an onerous burden on the nationwide 
specialty consumer reporting agencies; they can choose either to honor 
the requests they may receive outside of the streamlined process 
request methods, or simply redirect consumers to those methods.\74\ 
Accordingly, Sec.  610.3(e) is adopted as proposed.
---------------------------------------------------------------------------

    \74\ One nationwide specialty consumer reporting agency requests 
that the rule include a general limitation on liability for private 
causes of actions under proposed rule Sec.  610.3(e), as well as 
other rule provisions, in order to limit the circumstances under 
which a nationwide specialty consumer reporting agency is at risk of 
private actions, including class actions. The FCRA, as amended by 
the FACT Act, however, provides a specific scheme of enforcement and 
liability for violations of the FCRA. Where Congress intended to 
limit private rights of action, it did so. See FCRA Sec.  615(h)(8). 
Accordingly, the Commission declines to include additional 
limitations in the final rule.
---------------------------------------------------------------------------

Section 610.3(f)--Effective date

    The proposed rule provided that Sec.  610.3 become effective on 
December 1, 2004, the same effective date as rule provisions for the 
centralized source. This provision is unchanged in the final rule. 
Final rule Sec.  610.3(f).
    The Commission notes that the FACT Act requires that the rules 
implementing the annual file disclosure requirements relating to 
nationwide specialty consumer reporting agencies take effect no later 
than six months after the date on which the regulations are issued in 
final form-unless the Commission determines that up to an additional 
three months is appropriate. Further, the FACT Act requires the 
Commission to consider the ability of each nationwide specialty 
consumer reporting agency to provide annual file disclosures in the 
manner required under the Act, in determining the effective date for 
these provisions.
    The Commission has considered these, as well as the other factors 
required by Sec.  211(a) of the FACT Act and has determined that 
December 1, 2004, is an appropriate effective date for these 
provisions. The Commission recognizes that while nationwide specialty 
consumer reporting agencies will need some time to develop and 
implement the streamlined process required under the proposed rule, it 
appears that nearly six months from the issuance of the final rule is 
adequate, given the limited requirements of the final rule for 
nationwide specialty consumer reporting agencies.
    One nationwide specialty consumer reporting agency requests that 
the Commission delay the effective date of the streamlined process 
requirement for three additional months in order to allow the agency to 
study how it can integrate its own traditional business methods with 
the new annual file disclosure obligation. This commenter further 
suggests that if the streamlined process effective date were delayed 
for three months, the nationwide specialty consumer reporting agencies 
would be protected from surges in request volume likely to occur as a 
result of publicity and consumer education surrounding the December 1, 
2004, launch of the centralized source. Similarly, CDIA proposes that 
the final rule provide for the nationwide specialty consumer reporting 
agencies to activate their systems on December 1, 2004, but that they 
be given a three-month grace period, such that they would not be 
required to actually comply with the rule until March 1, 2005.
    The Commission declines to delay the effective date for Sec.  610.3 
of the final rule for several reasons. Under Sec.  610.3(g) of the 
final rule, discussed infra, the nationwide specialty consumer 
reporting agencies already receive protections from surges in volume 
that exceed the reasonably anticipated volume for that time. Although 
the rule provisions relating to nationwide

[[Page 35493]]

specialty consumer reporting agencies may require the development of 
some new operations or systems, by December 1, 2004, they will have had 
nearly one year since the FACT Act became effective to study the 
issues, reasonably anticipate the volume, and implement appropriate 
procedures to accept requests via toll-free numbers. In addition, the 
Commission is adopting the same effective date for all parts of the 
rule in order to help consumers better understand the availability of 
annual file disclosures. The Commission believes that implementing a 
grace period would provide industry very little in the way of useful 
flexibility in complying with the rule, and would lead to greater 
confusion by the public. Accordingly, December 1, 2004, is the 
effective date for rule provisions relating to both nationwide consumer 
reporting agencies and nationwide specialty consumer reporting 
agencies. Final rule Sec.  610.3(f).

Section 610.3(g)--High request volume and extraordinary request volume 
during initial transition

    Nationwide specialty consumer reporting agencies must establish and 
operate a streamlined process with adequate capacity to meet consumer 
demand for annual file disclosures. Under the proposed rule, Sec.  
610.3(g), during the first three months after the rule becomes 
effective, liability under this provision would have been limited when 
the agencies experience extraordinary request volume of more than twice 
the anticipated request volume in a 24-hour period. After the three-
month transition, extraordinary request volume would have been 
calculated as twice the daily rolling 90-day average.
    Two nationwide specialty consumer reporting agencies and CDIA 
suggest that these entities need greater protection against high volume 
during a transition period, including a staggered rollout and lower 
request volume thresholds to trigger relief from liability. CDIA 
suggests that (in addition to delaying the effective date for three 
months) the rule should: 1) expand the transition period for the 
nationwide specialty consumer reporting agencies to encompass March 1, 
2005 through November 30, 2005; 2) during the transition period, lower 
the trigger for extraordinary request volume to 125% of the daily total 
number of reasonably anticipated requests; and 3) add a high request 
volume trigger that would allow the nationwide specialty consumer 
reporting agencies to place requests into a queue for later processing 
when the volume in a 24-hour period exceeds the daily total number of 
reasonably anticipated requests.
    The Commission recognizes that demand for consumer file disclosures 
from nationwide specialty consumer reporting agencies may increase 
significantly as a result of the new annual file disclosure 
availability. In order to assist these agencies in meeting this 
increase in demand, the Commission has modified Sec.  610.3(g), by 
adding a high request volume benchmark to provide added protection from 
liability. High request volume during the transition is defined as, in 
any 24-hour period, more than 115% of the daily total number of 
requests that were reasonably anticipated. Final rule Sec.  
610.3(g)(1). Further, the extraordinary request volume provision has 
been lowered to 175%. Thus, the thresholds for extraordinary request 
volume and high request volume during the transition for the nationwide 
specialty consumer reporting agencies are comparable to those 
applicable to the nationwide consumer reporting agencies during the 
centralized source transition. See discussion under Sec.  610.2(e) of 
this notice, supra.
    Further, the final rule retains the proposed three-month transition 
period. Final rule Sec.  610.3(g). For the same reasons discussed under 
Sec.  610.3(f) of this notice, supra, the Commission has concluded 
that, given the limited requirements of the final rule as it applies to 
nationwide specialty consumer reporting agencies, neither a lengthy 
transition period nor a geographic rollout are appropriate.

Part 698 Appendix D--Standardized form for requesting annual file 
disclosures

    Section 211 of the FACT Act directs the Commission to prescribe a 
regulation requiring that nationwide consumer reporting agencies employ 
a standardized form for consumers to request, either by mail or through 
an Internet website, annual file disclosures from the centralized 
source. Section 610.2(b)(3) of the rule requires that the nationwide 
consumer reporting agencies establish this form and make it available 
through the centralized source. In addition, the Commission proposed a 
model form, to be published in 16 CFR part 698, Appendix D (the ``model 
standardized form''). The Commission stated in the proposed rule that 
nationwide consumer reporting agencies could use this form to comply 
with Sec.  610.2(b)(3) of the rule.
    A trade association representing real estate brokers expressed 
general support for the model standardized form, stating that it 
provided adequate information and was minimally intrusive. No 
commenters oppose the model standardized form, but several propose 
modifications.
    The Commission received several comments from nationwide consumer 
reporting agencies and CDIA on the model standardized form. Some 
commenters object to the section of the model that would permit a 
consumer to designate the manner in which the consumer may be contacted 
by the nationwide consumer reporting agency if additional information 
is needed to process the consumer's request. These commenters assert 
that permitting the consumer to designate an alternative telephone or 
email address that the nationwide consumer reporting agency might not 
be able to verify could create a risk of consumer fraud or identity 
theft. In response to these comments, the Commission has modified the 
model standardized form by deleting that section.
    The same commenters also object to the last sentence of the 
proposed model standardized form, which stated ``[y]ou can expect to 
receive your report within 15 days after we receive your request.'' 
Nationwide consumer reporting agencies and CDIA point out that the 
statute requires the nationwide consumer reporting agency to provide 
the annual file disclosure ``no later than'' 15 days after receipt of 
the request and that reports sent by mail might involve additional time 
before the consumer actually receives the report. The Commission agrees 
that an annual file disclosure mailed on the fifteenth day would meet 
this requirement. Accordingly, the Commission has changed the last 
sentence of the model standardized form to the following: ``[y]our 
report will be sent within 15 days after we receive your request.''
    Some commenters also suggest other changes to the form, which the 
Commission did not adopt. Nationwide consumer reporting agencies and 
CDIA object to the provision of the proposed model standardized form 
that would allow the consumer to indicate his or her preferred delivery 
method for the annual file disclosure. These commenters express concern 
that the consumer's preferred delivery method might not be available or 
appropriate under various circumstances. However, FCRA Sec.  610(b), 15 
U.S.C. 1681h(b) specifies that disclosures may be made in such forms as 
may be specified by the consumer and available from the agency. 
Further, the model standardized form clearly states that the nationwide 
consumer reporting agencies ``may not be able to offer every delivery 
method to every consumer.'' The Commission

[[Page 35494]]

views the proposed change as inconsistent with the statute and has 
declined to alter this part of the model standardized form.
    The nationwide consumer reporting agencies also propose various 
additions to the model standardized form. These commenters suggest that 
the form include additional information adapting it to Internet use, a 
certification by the consumer that the information provided by the 
consumer is accurate, a warning to the consumer of the consequences of 
making a fraudulent request, and a warning to the consumer that an 
altered form will constitute an invalid request. One nationwide 
consumer reporting agency proposes that the model standardized form add 
more specific directions as to how the consumer's name and address 
should be provided and request a former address for a consumer who has 
resided less than two years at the current address. The Commission 
declines to add such additional information to its model standardized 
form, but notes that, as this form is a ``model,'' the nationwide 
consumer reporting agencies may add additional information, provided 
that such information or instructions are ``clear and easily 
understandable,'' in compliance with final rule Sec.  610.2(b)(2)(iv). 
Similarly, the nationwide consumer reporting agencies may require 
additional categories of information, provided such information is 
reasonably necessary to process the request, consistent with the 
standard set forth in Sec.  610.2(b)(2)(ii) of the final rule. The form 
could also, as one commenter suggests, be modified to offer credit 
scores to consumers, provided that such additions did not interfere 
with, detract from, contradict, or otherwise undermine the purpose of 
the centralized source, as required under Sec.  610.2(g) of the rule.

IV. Substantially Nationwide Consumer Reporting Agencies.

    Section 211(d)(6)(A) of the FACT Act directs the Commission to 
determine, by rulemaking, ``whether to require a consumer reporting 
agency that compiles and maintains files on consumers on substantially 
a nationwide basis, other than one described in section 603(p) of the 
Fair Credit Reporting Act, to make [annual file disclosures] available 
upon consumer request, and if so, whether such consumer reporting 
agencies should make such [annual file disclosures] available through 
the centralized source described in paragraph (1)(A).''\75\
---------------------------------------------------------------------------

    \75\ In making this determination, the Commission is required by 
the Act to consider the number of consumer reports sold by such 
entities, the overall scope of operations of such entities, the 
costs to such entities of providing annual file disclosures to 
consumers, and the competitive viability of such entities if they 
are required to provide free annual file disclosures.
---------------------------------------------------------------------------

    The term ``a consumer reporting agency that compiles and maintains 
files on consumers on substantially a nationwide basis, other than one 
described in section 603(p) of the Fair Credit Reporting Act'' 
(hereinafter ``substantially nationwide consumer reporting agencies'') 
is not defined under the FCRA or under the FACT Act. In its NPR, the 
Commission posed questions seeking detailed information about the 
existence of such entities in the U.S., including their identity and 
location, the population served by such agencies, the number of 
requests for file disclosures received and consumer reports generated 
by such entities, and the categories of information contained in such 
reports. In addition, the Commission sought information about the 
costs, benefits, and competitive effect of requiring any such agencies 
to provide free annual file disclosures and to do so through the 
centralized source.
    The Commission received only minimal response to this question and 
very little specific information. Two nationwide consumer reporting 
agencies suggest that associated consumer reporting agencies, described 
above as agencies that own or maintain consumer files within systems 
operated by one or more nationwide consumer reporting agencies, should 
be deemed to be substantially nationwide consumer reporting agencies 
for purposes of this rule and required to participate in the 
centralized source. As explained in the discussion under Sec.  610.2(d) 
of this notice, supra, however, the Commission is not convinced that 
associated consumer reporting agencies should be deemed substantially 
nationwide based solely on their contractual relationships with 
nationwide consumer reporting agencies.
    Only one associated consumer reporting agency filed comments. It 
states that, apart from the nationwide consumer reporting agencies, it 
does not believe there are consumer reporting agencies in the U.S. that 
compile and maintain consumer files on substantially a nationwide 
basis.
    In addition, a consumer advocacy organization suggests that 
nationwide specialty consumer reporting agencies should be considered 
to be substantially nationwide consumer reporting agencies. Pursuant to 
Sec.  211(a) of the FACT Act, codified at FCRA Sec.  612(a), 15 U.S.C. 
1681j(a) and Sec.  610.3 of the final rule, however, the nationwide 
specialty consumer reporting agencies will be obligated to provide 
consumers with free annual file disclosures. The FACT Act clearly 
contemplated that these nationwide specialty agencies would not be 
required to participate in the centralized source, but would be subject 
to a different regulatory scheme.
    In light of the information available to it, the Commission 
determines that substantially nationwide consumer reporting agencies 
should not, at this time, be required to provide annual file 
disclosures. The Commission may, at a later time, determine that such 
entities should provide annual file disclosures, and that such 
disclosures should be made through the centralized source required by 
this rule.

V. Final Regulatory Flexibility Analysis.

    The Regulatory Flexibility Act (``RFA''), 5 U.S.C. 601-612, 
requires that the Commission provide an Initial Regulatory Flexibility 
Analysis (``IRFA'') with a proposed rule and a Final Regulatory 
Flexibility Analysis (``FRFA''), if any, with the final rule, unless 
the Commission certifies that the rule will not have a significant 
economic impact on a substantial number of small entities (i.e., those 
with less than $6,000,000 in average annual receipts). 5 U.S.C. 603-
605.
    The Commission hereby certifies that the final rule will not have a 
significant economic impact on a substantial number of small entities. 
The rule applies to two types of consumer reporting agencies: (1) 
nationwide consumer reporting agencies, and (2) nationwide specialty 
consumer reporting agencies.\76\ As noted above, the Commission is 
aware of three entities that meet the rule's definition, in Sec.  
610.1(b)(9), of a ``nationwide

[[Page 35495]]

consumer reporting agency.'' The Commission has concluded that none of 
these is a small entity. In addition, the Commission estimates, based 
on its own experience and knowledge of industry practices and members, 
that there are fewer than 50 nationwide specialty consumer reporting 
agencies currently doing business in the U.S. The Commission has been 
unable to determine how many, if any, of these nationwide specialty 
consumer reporting agencies are small entities. In the March 19, 2004, 
NPR, the Commission asked several questions related to the existence, 
number and nature of small business entities covered by the proposed 
rule, as well as the economic impact of the proposed rule on such 
entities. The Commission received no comments responsive to these 
questions. Based on its own experience and knowledge of industry 
practices and members, however, the Commission believes that the number 
of such agencies that are small entities, if any, is likely to be 
insubstantial. While the economic impact of the final rule on a 
particular small entity could be significant, overall the final rule 
will not have a significant economic impact on a substantial number of 
small entities. This document serves as notice to the Small Business 
Administration of the agency's certification of no effect. Nonetheless, 
the Commission has determined to publish a Final Regulatory Flexibility 
Analysis with this final rule. Therefore, the Commission has prepared 
the following analysis:
---------------------------------------------------------------------------

    \76\ In addition, the Commission's NPR solicited information 
about two other types of consumer reporting agencies. As discussed 
in section IV, supra, the FACT Act directed the Commission to 
determine whether to promulgate a rule covering ``a consumer 
reporting agency that compiles and maintains files on consumers on 
substantially a nationwide basis.'' The Commission, at this time, is 
not adopting a rule provision relevant to such agencies, if in fact 
any such entities exist. In addition, the Commission sought 
information about associated consumer reporting agencies, i.e., 
those consumer reporting agencies that own or maintain consumer 
files within the systems of nationwide consumer reporting agencies. 
The final rule, however, does not directly cover such agencies. The 
rule obligates nationwide consumer reporting agencies that house 
within their systems consumer files owned by associated consumer 
reporting agencies to provide annual file disclosures to those 
affected consumers.
---------------------------------------------------------------------------

A. Need for and objectives of the rule.

    The Fair and Accurate Credit Transactions Act of 2003, Pub. L. 108-
159, 117 Stat. 1952 (FACT Act or the Act), directs the Commission to 
adopt a rule, no later than June 4, 2004, to require the establishment 
of: (1) a centralized source through which consumers may request a free 
annual file disclosure from each nationwide consumer reporting agency; 
(2) a standardized form for consumer use in making such requests; and 
(3) a streamlined process for consumers to request free annual file 
disclosures from nationwide specialty consumer reporting agencies. In 
this action, the Commission promulgates a final rule to fulfill the 
statutory mandate. The rule is authorized by and based upon Sec.  
211(a) and (d) of the FACT Act.

B. Significant issues raised by public comment.

    The Commission received no public comments on the specific impact, 
if any, of the rule on small entities. As explained above, the 
Commission has estimated that there are few or no small entities that 
will be affected by the final rule. In that regard, the rule generally 
applies only to entities that would not be considered ``small 
entities'' for purposes of the Regulatory Flexibility Act.\77\
---------------------------------------------------------------------------

    \77\ For example,Sec.  610.2 of the rule addresses the 
establishment and operation of the centralized source through which 
consumers may request a free annual file disclosure from each 
nationwide consumer reporting agency, none of which is a small 
entity. Similarly, Appendix D to Part 698 sets forth a model 
standardized form for consumer use in making such requests from the 
centralized source. The impact, if any, of this form is on 
individuals, i.e., natural persons, who also are not small entities 
under the Regulatory Flexibility Act.
---------------------------------------------------------------------------

    The Commission has considered that Sec.  610.3 of the rule, which 
establishes requirements for a streamlined process for consumers to 
request free annual file disclosures from nationwide specialty consumer 
reporting agencies, could apply to small entities, if any of them meets 
the definition of such a reporting agency. See final rule Sec.  
610.1(b)(10); FCRA Sec.  603(w), 15 U.S.C. 1681a(w). Several commenters 
questioned certain aspects of the streamlined process provisions set 
forth in Sec.  610.3, although none directly commented on the potential 
impact of those requirements on small entities, if any. In this 
Statement of Basis and Purpose, the Commission has explained its 
consideration of and response to those comments. The Commission has 
made certain changes in the final rule that should further minimize its 
impact on all nationwide specialty consumer reporting agencies, which 
would include those, if any, that may be small entities. These changes, 
which address limitations on liability during periods of high request 
volume, are explained above in the discussion of the revisions made to 
Sec.  610.3 of the rule.

C. Small entities to which the rule will apply.

    The rule will apply to two types of consumer reporting agencies: 
(1) nationwide consumer reporting agencies, and (2) nationwide 
specialty consumer reporting agencies. The Commission has concluded 
that none of the three identified nationwide consumer reporting 
agencies is a small entity. In the NPR, the Commission estimated that 
the number of nationwide specialty consumer reporting agencies that are 
small entities is either very small or none. In addition, the 
Commission invited comment and information on this issue. No comments 
addressed this issue, and no information with respect to small entities 
that might be affected by the rule was provided. Based on the lack of 
response to its request for comments, the Commission believes that its 
previous estimate is likely to be accurate.

D. Projected reporting, recordkeeping and other compliance 
requirements.

    Under the rule, nationwide specialty consumer reporting 
agencies,\78\ which would be the only class of entities that could 
include small entities, if any, will be required to do the following: 
(1) provide consumers with free annual file disclosures; (2) establish 
a streamlined process, including a toll-free telephone number, for 
accepting and processing such consumer requests; (3) provide consumers 
with clear instructions on how to obtain free annual file disclosures; 
and (4) make additional disclosures to consumers during situations when 
adverse circumstances or extraordinary request volume affect the 
ability of the agency to accept consumer requests. The types of 
professional skills that will be necessary to fulfill these compliance 
requirements were described in the Commission's Paperwork Reduction Act 
analysis, 69 FR at 13201-03.
---------------------------------------------------------------------------

    \78\ Nationwide consumer reporting agencies will have similar, 
but more extensive, obligations under the rule. As stated above, 
however, the Commission has concluded that there are no nationwide 
consumer reporting agencies that are small entities.
---------------------------------------------------------------------------

E. Steps taken to minimize significant economic impact of the rule on 
small entities.

    The Commission invited comment and information with regard to (1) 
the existence of small business entities for which the proposed rule 
would have a significant economic impact; and (2) suggested alternative 
methods of compliance that, consistent with the statutory requirements, 
would reduce the economic impact of the rule on such small entities.
    The Commission received no information or suggestions in response 
to these questions. As explained above, however, the Commission has 
made certain changes to the final rule to minimize its impact on all 
entities that are subject to the rule, including small entities, if 
any, that may be subject to the rule.

VI. Paperwork Reduction Act.

    In accordance with the Paperwork Reduction Act, as amended, 44 
U.S.C. 3501 et seq., the Commission submitted the proposed Rule to the 
Office of Management and Budget (``OMB'') for review. The OMB has 
approved the Rule's information collection requirements through April 
30, 2007, and has assigned OMB control number 3084-0128.

[[Page 35496]]

VII. Final Rule.

List of Subjects

16 CFR Part 610

    Fair Credit Reporting Act, Consumer reports, Consumer reporting 
agencies, Credit, Trade practices.

16 CFR Part 698

    Fair Credit Reporting Act, Consumer reports, Consumer reporting 
agencies, Credit, Trade practices.

0
Accordingly, for the reasons set forth above, the FTC amends chapter I, 
title 16, Code of Federal Regulations, as follows:
0
1. Revise the heading of subchapter F of this chapter to read as 
follows:

SUBCHAPTER F-FAIR CREDIT REPORTING ACT

0
2. Add new part 610 to read as follows:

PART 610-FREE ANNUAL FILE DISCLOSURES

Sec.
610.1 Definitions and rule of construction.
610.2 Centralized source for requesting annual file disclosures from 
nationwide consumer reporting agencies.
610.3 Streamlined process for requesting annual file disclosures 
from nationwide specialty consumer reporting agencies.

    Authority: Pub. L. 108-159, sections 211 (a) and (d).


Sec.  610.1  Definitions and rule of construction.

    (a) The definitions and rule of construction set forth in this 
section apply throughout this part.
    (b) Definitions.
    (1) Annual file disclosure means a file disclosure that is provided 
to a consumer, upon consumer request and without charge, once in any 
12-month period, in compliance with section 612(a) of the Fair Credit 
Reporting Act, 15 U.S.C. 1681j(a).
    (2) Associated consumer reporting agency means a consumer reporting 
agency that owns or maintains consumer files housed within systems 
operated by one or more nationwide consumer reporting agencies.
    (3) Consumer means an individual.
    (4) Consumer report has the meaning provided in section 603(d) of 
the Fair Credit Reporting Act, 15 U.S.C. 1681a(d).
    (5) Consumer reporting agency has the meaning provided in section 
603(f) of the Fair Credit Reporting Act, 15 U.S.C. 1681a(f).
    (6) Extraordinary request volume, except as provided in sections 
610.2(i) and 610.3(g) of this part, occurs when the number of consumers 
requesting or attempting to request file disclosures during any 24-hour 
period is more than 175% of the rolling 90-day daily average of 
consumers requesting or attempting to request file disclosures. For 
example, if over the previous 90 days an average of 100 consumers per 
day requested or attempted to request file disclosures, then 
extraordinary request volume would be any volume greater than 175% of 
100, i.e., 176 or more requests in a single 24-hour period.
    (7) File disclosure means a disclosure by a consumer reporting 
agency pursuant to section 609 of the Fair Credit Reporting Act, 15 
U.S.C. 1681g.
    (8) High request volume, except as provided in sections 610.2(i) 
and 610.3(g) of this part, occurs when the number of consumers 
requesting or attempting to request file disclosures during any 24-hour 
period is more than 125% of the rolling 90-day daily average of 
consumers requesting or attempting to request file disclosures. For 
example, if over the previous 90 days an average of 100 consumers per 
day requested or attempted to request file disclosures, then high 
request volume would be any volume greater than 125% of 100, i.e., 126 
or more requests in a single 24-hour period.
    (9) Nationwide consumer reporting agency means a consumer reporting 
agency that compiles and maintains files on consumers on a nationwide 
basis as defined in section 603(p) of the Fair Credit Reporting Act, 15 
U.S.C. 1681a(p).
    (10) Nationwide specialty consumer reporting agency has the meaning 
provided in section 603(w) of the Fair Credit Reporting Act, 15 U.S.C. 
1681a(w).
    (11) Request method means the method by which a consumer chooses to 
communicate a request for an annual file disclosure.
    (c) Rule of construction. The examples in this part are 
illustrative and not exclusive. Compliance with an example, to the 
extent applicable, constitutes compliance with this part.


Sec.  610.2  Centralized source for requesting annual file disclosures 
from nationwide consumer reporting agencies.

    (a) Purpose. The purpose of the centralized source is to enable 
consumers to make a single request to obtain annual file disclosures 
from all nationwide consumer reporting agencies, as required under 
section 612(a) of the Fair Credit Reporting Act, 15 U.S.C. 1681j(a).
    (b) Establishment and operation. All nationwide consumer reporting 
agencies shall jointly design, fund, implement, maintain, and operate a 
centralized source for the purpose described in paragraph (a) of this 
section. The centralized source required by this part shall:
    (1) Enable consumers to request annual file disclosures by any of 
the following request methods, at the consumer's option:
    (i) A single, dedicated Internet website;
    (ii) A single, dedicated toll-free telephone number; and
    (iii) Mail directed to a single address;
    (2) Be designed, funded, implemented, maintained, and operated in a 
manner that:
    (i) Has adequate capacity to accept requests from the reasonably 
anticipated volume of consumers contacting the centralized source 
through each request method, as determined in accordance with paragraph 
(c) of this section;
    (ii) Collects only as much personally identifiable information as 
is reasonably necessary to properly identify the consumer as required 
under the Fair Credit Reporting Act, section 610(a)(1), 15 U.S.C. 
1681h(a)(1), and other applicable laws and regulations, and to process 
the transaction(s) requested by the consumer;
    (iii) Provides information through the centralized source website 
and telephone number regarding how to make a request by all request 
methods required under section 610.2(b)(1) of this part; and
    (iv) Provides clear and easily understandable information and 
instructions to consumers, including, but not necessarily limited to:
    (A) Providing information on the progress of the consumer's request 
while the consumer is engaged in the process of requesting a file 
disclosure;
    (B) For a website request method, providing access to a ``help'' or 
``frequently asked questions'' screen, which includes specific 
information that consumers might reasonably need to request file 
disclosures, the answers to questions that consumers might reasonably 
ask, and instructions whereby a consumer may file a complaint with the 
centralized source and with the Federal Trade Commission;
    (C) In the event that a consumer requesting a file disclosure 
through the centralized source cannot be properly identified in 
accordance with the Fair Credit Reporting Act, section 610(a)(1), 15 
U.S.C. 1681h(a)(1), and other applicable laws and regulations, 
providing a statement that the consumer's identity cannot be verified; 
and directions on how to complete the request, including what 
additional information or documentation will be required to complete 
the request, and how to submit such information; and

[[Page 35497]]

    (D) A statement indicating that the consumer has reached the 
website or telephone number operated by the national credit reporting 
agencies for ordering free annual credit reports, as required by 
federal law; and
    (3) Make available to consumers a standardized form established 
jointly by the nationwide consumer reporting agencies, which consumers 
may use to make a request for an annual file disclosure, either by mail 
or on the Internet website required under section 610.2(b)(1) of this 
part, from the centralized source required by this part. The form 
provided at 16 CFR Part 698, Appendix D, may be used to comply with 
this section.
    (c) Requirement to anticipate. The nationwide consumer reporting 
agencies shall implement reasonable procedures to anticipate, and to 
respond to, the volume of consumers who will contact the centralized 
source through each request method, to request, or attempt to request, 
a file disclosure, including developing and implementing contingency 
plans to address circumstances that are reasonably likely to occur and 
that may materially and adversely impact the operation of the 
nationwide consumer reporting agency, a centralized source request 
method, or the centralized source.
    (1) The contingency plans required by this section shall include 
reasonable measures to minimize the impact of such circumstances on the 
operation of the centralized source and on consumers contacting, or 
attempting to contact, the centralized source.
    (i) Such reasonable measures to minimize impact shall include, but 
are not necessarily limited to:
    (A) To the extent reasonably practicable under the circumstances, 
providing information to consumers on how to use another available 
request method;
    (B) To the extent reasonably practicable under the circumstances, 
communicating, to a consumer who attempts but is unable to make a 
request, the fact that a condition exists that has precluded the 
centralized source from accepting all requests, and the period of time 
after which the centralized source is reasonably anticipated to be able 
to accept the consumer's request for an annual file disclosure; and
    (C) Taking all reasonable steps to restore the centralized source 
to normal operating status as quickly as reasonably practicable under 
the circumstances.
    (ii) Reasonable measures to minimize impact may also include, as 
appropriate, collecting request information but declining to accept the 
request for processing until a reasonable later time, provided that the 
consumer is clearly and prominently informed, to the extent reasonably 
practicable under the circumstances, of when the request will be 
accepted for processing.
    (2) A nationwide consumer reporting agency shall not be deemed in 
violation of section 610.2(b)(2)(i) of this part if a centralized 
source request method is unavailable to accept requests for a 
reasonable period of time for purposes of conducting maintenance on the 
request method, provided that the other required request methods remain 
available during such time.
    (d) Disclosures required. If a nationwide consumer reporting agency 
has the ability to provide a consumer report to a third party relating 
to a consumer, regardless of whether the consumer report is owned by 
that nationwide consumer reporting agency or by an associated consumer 
reporting agency, that nationwide consumer reporting agency shall, upon 
proper identification in compliance with section 610(a)(1) of the Fair 
Credit Reporting Act, 15 U.S.C. 1681h(a)(1), provide an annual file 
disclosure to such consumer if the consumer makes a request through the 
centralized source.
    (e) High Request volume and extraordinary request volume.
    (1) High request volume. Provided that a nationwide consumer 
reporting agency has implemented reasonable procedures developed in 
accordance with paragraph (c) of this section, entitled ``requirement 
to anticipate,'' the nationwide consumer reporting agency shall not be 
deemed in violation of paragraph (b)(2)(i) of this section for any 
period of time in which a centralized source request method, the 
centralized source, or the nationwide consumer reporting agency 
experiences high request volume, if the nationwide consumer reporting 
agency:
    (i) Collects all consumer request information and delays accepting 
the request for processing until a reasonable later time; and
    (ii) Clearly and prominently informs the consumer of when the 
request will be accepted for processing.
    (2) Extraordinary request volume. Provided that the nationwide 
consumer reporting agency has implemented reasonable procedures 
developed in compliance with paragraph (c) of this section, entitled 
``requirement to anticipate,'' the nationwide consumer reporting agency 
shall not be deemed in violation of paragraph (b)(2)(i) of this section 
for any period of time during which a particular centralized source 
request method, the centralized source, or the nationwide consumer 
reporting agency experiences extraordinary request volume.
    (f) Information use and disclosure. Any personally identifiable 
information collected from consumers as a result of a request for 
annual file disclosure, or other disclosure required by the Fair Credit 
Reporting Act, made through the centralized source, may be used or 
disclosed by the centralized source or a nationwide consumer reporting 
agency only:
    (1) To provide the annual file disclosure or other disclosure 
required under the FCRA requested by the consumer;
    (2) To process a transaction requested by the consumer at the same 
time as a request for annual file disclosure or other disclosure;
    (3) To comply with applicable legal requirements, including those 
imposed by the Fair Credit Reporting Act and this part; and
    (4) To update personally identifiable information already 
maintained by the nationwide consumer reporting agency for the purpose 
of providing consumer reports, provided that the nationwide consumer 
reporting agency uses and discloses the updated personally identifiable 
information subject to the same restrictions that would apply, under 
any applicable provision of law or regulation, to the information 
updated or replaced.
    (g) Communications provided by centralized source.
    (1) Any communications or instructions, including any advertising 
or marketing, provided through the centralized source shall not 
interfere with, detract from, contradict, or otherwise undermine the 
purpose of the centralized source stated in paragraph (a) of this 
section.
    (2) Examples of interfering, detracting, inconsistent, and[sol]or 
undermining communications include:
    (i) A website that contains pop-up advertisements or other offers 
or promotions that hinder the consumer's ability to complete an online 
request for an annual file disclosure;
    (ii) Centralized source materials that represent, expressly or by 
implication, that a consumer must purchase a paid product in order to 
receive or to understand the annual file disclosure;
    (iii) Centralized source materials that represent, expressly or by 
implication, that annual file disclosures are not free, or that 
obtaining an annual file disclosure will have a negative impact on the 
consumer's credit standing; and
    (iv) Centralized source materials that falsely represent, expressly 
or by implication, that a product or service offered ancillary to 
receipt of a file

[[Page 35498]]

disclosure, such as a credit score or credit monitoring service, is 
free, or fail to clearly and prominently disclose that consumers must 
cancel a service, advertised as free for an initial period of time, to 
avoid being charged, if such is the case.
    (h) Effective date. Sections 610.1 and 610.2 shall become effective 
on December 1, 2004.
    (i) Transition.
    (1) Regional rollout. The centralized source required by this part 
shall be made available to consumers in a cumulative manner, as 
follows:
    (i) For consumers residing in Alaska, Arizona, California, 
Colorado, Hawaii, Idaho, Montana, New Mexico, Nevada, Oregon, Utah, 
Washington, and Wyoming, the centralized source shall become available 
on or before December 1, 2004;
    (ii) For consumers residing in Illinois, Indiana, Iowa, Kansas, 
Michigan, Minnesota, Missouri, Nebraska, North Dakota, Ohio, South 
Dakota, and Wisconsin, the centralized source shall become available on 
or before March 1, 2005;
    (iii) For consumers residing in Alabama, Arkansas, Florida, 
Georgia, Kentucky, Louisiana, Mississippi, Oklahoma, South Carolina, 
Tennessee, and Texas, the centralized source shall become available on 
or before June 1, 2005; and
    (iv) For all other consumers, including consumers residing in 
Connecticut, Delaware, District of Columbia, Maine, Maryland, 
Massachusetts, New Hampshire, New Jersey, New York, North Carolina, 
Pennsylvania, Rhode Island, Vermont, Virginia, West Virginia, and all 
United States territories and possessions, the centralized source shall 
become available on or before September 1, 2005.
    (2) High request volume during transition.
    (i) During the period of December 1, 2004 through December 7, 2004, 
high request volume shall mean the following:
    (A) For an individual request method: High request volume occurs 
when the number of consumers contacting or attempting to contact the 
centralized source through the request method in any 24-hour period is 
more than 115% of the daily total number of consumers that were 
reasonably anticipated to contact the centralized source, in compliance 
with paragraph (c) of this section, through that request method.
    (B) For the centralized source as a whole: High request volume 
occurs when the number of consumers contacting or attempting to contact 
the centralized source in any 24-hour period is more than 115% of the 
daily total number of consumers that were reasonably anticipated to 
contact the centralized source, in compliance with paragraph (c) of 
this section, through any request method.
    (C) For a nationwide consumer reporting agency: High request volume 
occurs when the number of consumers contacting or attempting to contact 
the nationwide consumer reporting agency to request file disclosures in 
any 24-hour period is more than 115% of the daily total number of 
consumers that were reasonably anticipated to contact that nationwide 
consumer reporting agency to request file disclosures, in compliance 
with paragraph (c) of this section.
    (ii) During the period of December 8, 2004 through August 31, 2005, 
high request volume shall mean the following:
    (A) For an individual request method: High request volume occurs 
when the number of consumers contacting or attempting to contact the 
centralized source through the request method in any 24-hour period is 
more than 115 % of the rolling 7-day daily average number of consumers 
who contacted or attempted to contact the centralized source to request 
file disclosures through that request method.
    (B) For the centralized source as a whole: High request volume 
occurs when the number of consumers contacting or attempting to contact 
the centralized source in any 24-hour period is more than 115% of the 
rolling 7-day daily average number of consumers who contacted or 
attempted to contact the centralized source to request file disclosures 
through any request method.
    (C) For a nationwide consumer reporting agency: High request volume 
occurs when the number of consumers contacting or attempting to contact 
the nationwide consumer reporting agency to request file disclosures in 
any 24-hour period is more than 115% of the rolling 7-day daily average 
of consumers who requested any type of file disclosure from that 
nationwide consumer reporting agency.
    (3) Extraordinary request volume during transition.
    (i) During the period of December 1, 2004 through December 7, 2004, 
extraordinary request volume shall mean the following:
    (A) For an individual request method: Extraordinary request volume 
occurs when the number of consumers contacting or attempting to contact 
the centralized source through the request method in any 24-hour period 
is more than 175% of the daily total number of consumers that were 
reasonably anticipated to contact the centralized source, in compliance 
with paragraph (c) of this section, through that request method.
    (B) For the centralized source as a whole: Extraordinary request 
volume occurs when the number of consumers contacting or attempting to 
contact the centralized source in any 24-hour period is more than 175% 
of the daily total number of consumers that were reasonably anticipated 
to contact the centralized source, in compliance with paragraph (c) of 
this section, through any request method.
    (C) For a nationwide consumer reporting agency: Extraordinary 
request volume occurs when the number of consumers contacting or 
attempting to contact the nationwide consumer reporting agency to 
request file disclosures in any 24-hour period is more than 175% of the 
daily total number of consumers that were reasonably anticipated to 
contact that nationwide consumer reporting agency to request their file 
disclosures, in compliance with paragraph (c) of this section.
    (ii) During the period of December 8, 2004 through August 31, 2005, 
extraordinary request volume shall mean the following:
    (A) For an individual request method: Extraordinary request volume 
occurs when the number of consumers contacting or attempting to contact 
the centralized source through the request method in a 24-hour period 
is more than 175% of the rolling 7-day daily average number of 
consumers who contacted or attempted to contact the centralized source 
to request file disclosures through that request method.
    (B) For the centralized source as a whole: Extraordinary request 
volume occurs when the number of consumers contacting or attempting to 
contact the centralized source in a 24-hour period is more than 175% of 
the rolling 7-day daily average number of consumers who contacted or 
attempted to contact the centralized source to request file disclosures 
through any request method.
    (C) For a nationwide consumer reporting agency: Extraordinary 
request volume occurs when the number of consumers contacting or 
attempting to contact the nationwide consumer reporting agency to 
request file disclosures in a 24-hour period is more than 175% of the 
rolling 7-day daily average of consumers who requested any type of file 
disclosure from that nationwide consumer reporting agency.

[[Page 35499]]

Sec.  610.3  Streamlined process for requesting annual file disclosures 
from nationwide specialty consumer reporting agencies.

    (a) Streamlined process requirements. Any nationwide specialty 
consumer reporting agency shall have a streamlined process for 
accepting and processing consumer requests for annual file disclosures. 
The streamlined process required by this part shall:
    (1) Enable consumers to request annual file disclosures by a toll-
free telephone number that:
    (i) Provides clear and prominent instructions for requesting 
disclosures by any additional available request methods, that do not 
interfere with, detract from, contradict, or otherwise undermine the 
ability of consumers to obtain annual file disclosures through the 
streamlined process required by this part;
    (ii) Is published, in conjunction with all other published numbers 
for the nationwide specialty consumer reporting agency, in any 
telephone directory in which any telephone number for the nationwide 
specialty consumer reporting agency is published; and
    (iii) Is clearly and prominently posted on any website owned or 
maintained by the nationwide specialty consumer reporting agency that 
is related to consumer reporting, along with instructions for 
requesting disclosures by any additional available request methods; and
    (2) Be designed, funded, implemented, maintained, and operated in a 
manner that:
    (i) Has adequate capacity to accept requests from the reasonably 
anticipated volume of consumers contacting the nationwide specialty 
consumer reporting agency through the streamlined process, as 
determined in compliance with paragraph (b) of this section;
    (ii) Collects only as much personal information as is reasonably 
necessary to properly identify the consumer as required under the Fair 
Credit Reporting Act, section 610(a)(1), 15 U.S.C. 1681h(a)(1), and 
other applicable laws and regulations; and
    (iii) Provides clear and easily understandable information and 
instructions to consumers, including but not necessarily limited to:
    (A) Providing information on the status of the consumer's request 
while the consumer is in the process of making a request;
    (B) For a website request method, providing access to a ``help'' or 
``frequently asked questions'' screen, which includes more specific 
information that consumers might reasonably need to order their file 
disclosure, the answers to questions that consumers might reasonably 
ask, and instructions whereby a consumer may file a complaint with the 
nationwide specialty consumer reporting agency and with the Federal 
Trade Commission; and
    (C) In the event that a consumer requesting a file disclosure 
cannot be properly identified in accordance with the Fair Credit 
Reporting Act, section 610(a)(1), 15 U.S.C. 1681h(a)(1), and other 
applicable laws and regulations, providing a statement that the 
consumer's identity cannot be verified; and directions on how to 
complete the request, including what additional information or 
documentation will be required to complete the request, and how to 
submit such information.
    (b) Requirement to anticipate. A nationwide specialty consumer 
reporting agency shall implement reasonable procedures to anticipate, 
and respond to, the volume of consumers who will contact the nationwide 
specialty consumer reporting agency through the streamlined process to 
request, or attempt to request, file disclosures, including developing 
and implementing contingency plans to address circumstances that are 
reasonably likely to occur and that may materially and adversely impact 
the operation of the nationwide specialty consumer reporting agency, a 
request method, or the streamlined process.
    (1) The contingency plans required by this section shall include 
reasonable measures to minimize the impact of such circumstances on the 
operation of the streamlined process and on consumers contacting, or 
attempting to contact, the nationwide specialty consumer reporting 
agency through the streamlined process.
    (i) Such reasonable measures to minimize impact shall include, but 
are not necessarily limited to:
    (A) To the extent reasonably practicable under the circumstances, 
providing information to consumers on how to use another available 
request method;
    (B) To the extent reasonably practicable under the circumstances, 
communicating, to a consumer who attempts but is unable to make a 
request, the fact that a condition exists that has precluded the 
nationwide specialty consumer reporting agency from accepting all 
requests, and the period of time after which the agency is reasonably 
anticipated to be able to accept the consumer's request for an annual 
file disclosure; and
    (C) Taking all reasonable steps to restore the streamlined process 
to normal operating status as quickly as reasonably practicable under 
the circumstances.
    (ii) Measures to minimize impact may also include, as appropriate, 
collecting request information but declining to accept the request for 
processing until a reasonable later time, provided that the consumer is 
clearly and prominently informed, to the extent reasonably practicable 
under the circumstances, of when the request will be accepted for 
processing.
    (2) A nationwide specialty consumer reporting agency shall not be 
deemed in violation of section 610.3(a)(2)(i) if the toll-free 
telephone number required by this part is unavailable to accept 
requests for a reasonable period of time for purposes of conducting 
maintenance on the request method, provided that the nationwide 
specialty consumer reporting agency makes other request methods 
available to consumers during such time.
    (c) High request volume and extraordinary request volume.
    (1) High request volume. Provided that the nationwide specialty 
consumer reporting agency has implemented reasonable procedures 
developed in accordance with paragraph (b) of this section, entitled 
``requirement to anticipate,'' a nationwide specialty consumer 
reporting agency shall not be deemed in violation of paragraph 
(a)(2)(i) of this section for any period of time during which a 
streamlined process request method or the nationwide specialty consumer 
reporting agency experiences high request volume, if the nationwide 
specialty consumer reporting agency:
    (i) Collects all consumer request information and delays accepting 
the request for processing until a reasonable later time; and
    (ii) Clearly and prominently informs the consumer of when the 
request will be accepted for processing.
    (2) Extraordinary request volume. Provided that the nationwide 
specialty consumer reporting agency has implemented reasonable 
procedures developed in accordance with paragraph (b) of this section, 
entitled ``requirement to anticipate,'' a nationwide specialty consumer 
reporting agency shall not be deemed in violation of paragraph 
(a)(2)(i) of this section for any period of time during which a 
streamlined process request method or the nationwide specialty consumer 
reporting agency experiences extraordinary request volume.
    (d) Information use and disclosure. Any personally identifiable 
information

[[Page 35500]]

collected from consumers as a result of a request for annual file 
disclosure, or other disclosure required by the Fair Credit Reporting 
Act, made through the streamlined process, may be used or disclosed by 
the nationwide specialty consumer reporting agency only:
    (1) To provide the annual file disclosure or other disclosure 
required under the FCRA requested by the consumer;
    (2) To process a transaction requested by the consumer at the same 
time as a request for annual file disclosure or other disclosure;
    (3) To comply with applicable legal requirements, including those 
imposed by the Fair Credit Reporting Act and this part; and
    (4) To update personally identifiable information already 
maintained by the nationwide specialty consumer reporting agency for 
the purpose of providing consumer reports, provided that the nationwide 
specialty consumer reporting agency uses and discloses the updated 
personally identifiable information subject to the same restrictions 
that would apply, under any applicable provision of law or regulation, 
to the information updated or replaced.
    (e) Requirement to accept or redirect requests. If a consumer 
requests an annual file disclosure through a method other than the 
streamlined process established by the nationwide specialty consumer 
reporting agency in compliance with this part, a nationwide specialty 
consumer reporting agency shall:
    (1) Accept the consumer's request; or
    (2) Instruct the consumer how to make the request using the 
streamlined process required by this part.
    (f) Effective date. This section shall become effective on December 
1, 2004.
    (g) High request volume and extraordinary request volume during 
initial transition.
    (1) During the period of December 1, 2004 through February 28, 
2005, high request volume shall mean the following:
    (i) For an individual request method: High request volume occurs 
when the number of consumers contacting or attempting to contact the 
nationwide specialty consumer reporting agency through a streamlined 
process request method in any 24-hour period is more than 115% of the 
daily total number of consumers who were reasonably anticipated to 
contact that request method, in compliance with paragraph (b) of this 
section.
    (ii) For a nationwide specialty consumer reporting agency: High 
request volume occurs when the number of consumers contacting or 
attempting to contact the nationwide specialty consumer reporting 
agency to request file disclosures in any 24-hour period is more than 
115% of the number of consumers who were reasonably anticipated to 
contact the nationwide specialty consumer reporting agency to request 
their file disclosures, in compliance with paragraph (b) of this 
section.
    (2) Extraordinary request volume. During the period of December 1, 
2004 through February 28, 2005, extraordinary request volume shall mean 
the following:
    (i) For an individual request method: Extraordinary request volume 
occurs when the number of consumers contacting or attempting to contact 
the nationwide specialty consumer reporting agency through a 
streamlined process request method in any 24-hour period is more than 
175% of the daily total number of consumers who were reasonably 
predicted to contact that request method, in compliance with paragraph 
(b) of this section.
    (ii) For a nationwide specialty consumer reporting agency: 
Extraordinary request volume occurs when the number of consumers 
contacting or attempting to contact the nationwide specialty consumer 
reporting agency to request file disclosures in any 24-hour period is 
more than 175% of the number of consumers who were reasonably 
anticipated to contact the nationwide specialty consumer reporting 
agency to request their file disclosures, in compliance with paragraph 
(b) of this section.

0
3. Add new Part 698 with the following heading and authority citation:

PART 698 - SUMMARIES, NOTICES, AND FORMS

Sec.
698.1 Authority and purpose.
698.2 Legal effect.
     Appendix A-C to Part 698--[Reserved]
     Appendix D to Part 698--Standardized Form for Requesting Free 
File Disclosure.

    Authority: 15 U.S.C. 1681g and 1681s; Pub. L. 108-159, sections 
151, 153, 211(c) and (d), 213, and 311.


Sec.  698.1  Authority and purpose

    (a) Authority. This part is issued by the Commission pursuant to 
the provisions of the Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.), as most recently amended by the Fair and Accurate Credit 
Transactions Act of 2003, Public Law 108-159, 117 Stat. 1952 (Dec. 4, 
2003).
    (b) Purpose. The purpose of this part is to comply with sections 
607(d), 609(c), and 612(a) of the Fair Credit Reporting Act, as 
amended, and section 211 of the Fair and Accurate Credit Transactions 
Act of 2003.


Sec.  698.2  Legal effect

    These summaries, forms and notices prescribed by the FTC do not 
constitute a trade regulation rule. They carry out the directives in 
the statute that the FTC prescribe these documents, which will 
constitute compliance with the part of any section of the FCRA 
requiring that such summaries, notices, or forms be used by or supplied 
to any person.

Appendix D to Part 698--Standardized form for requesting annual file 
disclosures.

BILLING CODE 6750-01-S

[[Page 35501]]

[GRAPHIC] [TIFF OMITTED] TR24JN04.003


[[Page 35502]]


[GRAPHIC] [TIFF OMITTED] TR24JN04.004


    By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 04-14388 Filed 6-23-04; 8:45 am]
BILLING CODE 6750-01-C