Second, we are greatly disturbed by the huge exception created by new subsection 604 (b) (2) to the general principle that credit reports may only be provided to persons with whom the consumer has initiated a transaction. This new subsection states:

No consumer reporting agency may furnish a consumer report or other information relating to any consumer pursuant to (the "permissible purposes" subsection of the act) to any person referred to in (that subsection) in connection with any credit or business transaction which is not initiated by the consumer unless

-

(1) the consumer authorizes the agency directly to provide such report or other information to such person;

or

(2) the consumer

(A) has received notice that information from the consumer's file may be used in connection with any credit or business transaction which is not initiated by the consumer;

(B) has had an opportunity to notify, directly or indirectly, the agency that the consumer does not consent to the use of information from the consumer's file in connection with any credit or business transaction which is not initiated by the consumer; and

(C) has not notified the agency, directly or indirectly, of such lack of consent. (emphasis added)

Although we believe this subsection was drafted to address the circumstance in which credit reporting agencies use their extensive files to create pre-screened lists for the targeted marketing purposes of third parties, we believe the language itself authorizes disclosures that go far beyond this circumstance. Even as it applies to pre-screened lists, we believe the subsection needs substantial improvement because 1) it overturns the longstanding FTC interpretation regarding the limited purpose for which pre-screened lists may be provided; 2) it authorizes unwarranted access to the entire file; 3) it allows credit reporting agencies to identify consumers on the basis of adverse information in their files 4) it requires the consumer to affirmatively act to be omitted from such lists; and 5) it fails to describe how the consumers will be notified of their right to opt out and exercise their opt-out right.

As drafted, the provision would authorize, for example, a

local business to peruse the files of a credit reporting agency to select prospective job applicants. Indeed, the business could have a particular individual in mind whom it is interested in soliciting for employment, and gain access to that person's file. Worse, an employer could gain access to the file of a current employee whose salary is currently under review. Outside of the employment situation, a door-to-door sales company could examine the files of each person in a particular neighborhood to determine its best prospects for particular products. All these files could be accessed without the consumer's approval unless the subject of the file took affirmative steps to deny access.

In the first group of examples, the general purpose for access would be permissible under new section 604 (a) (3) (B), because the employer intends to "only use the information only for employment purposes." In the case of the vendor looking for prospective purchasers, the general purpose for access would be permissible under the catchall provisions of new subparagraph (E) because the business intends, subject to what it learns from the file, to use the information "in connection with a business transaction involving the consumer."

Many consumers would be outraged to know that their personal credit and other information is available for these purposes. The outrage would be even greater in those circumstance where the party gaining access is personally familiar with the consumer that is the subject of the file accessed.

For similar reasons and others, the provision is offensive even in connection with the particular circumstance we believe it was intended to address -- the provision of the names and addresses of consumers who fit a particular profile for purposes of targeted marketing by the recipients of the list. Here, again, the provision does not restrict the recipient of the information to the name and address of the subject of the file. The whole file may be accessed. Thus, persons with whom the consumer has not initiated any business dealings may learn the smallest and most sensitive information about the consumer without his knowledge or consent.

Further, the provision does not address the particular profile on the basis of which the credit reporting agency will develop the list identifying those consumers that fit the profile. Some creditors would like the names of individuals who are delinquent on their loans because these individuals will be vulnerable to solicitations for secured lines of credit at usurious interest rates. Are credit reporting agencies authorized to release the names of bad credit risks? Can credit repair clinics receive similar lists on the theory that they will offer their services to the consumer? Particularly given the minimal procedures credit reporting agencies use to deter unauthorized access, and the impossibility of eliminating unauthorized access altogether, we believe it is totally inappropriate to legislatively authorize

agencies to release this type of negative personal information to third parties without the consumer's knowledge and approval.

But

We believe that pre-screened lists can benefit consumers by facilitating the direct marketing of products and services. this marketing technique should not be at the price of individual privacy. Including an individual consumer on a pre-screened list compromises his privacy because inclusion on the list identifies the consumer as a person who fits the financial or other characteristics on the basis of which the list was derived. The information the list communicates about the person (e.g., his income, his account balances, his delinquencies, his employment, his vendors, his dependents, etc.) should only be provided with the consumer's knowledge and consent.

The bottom line is that no pre-screened list should be provided unless each consumer appearing on the list has specifically authorized its release. In soliciting such authorizations, the credit reporting agency must be very clear about the type of lists for which it is seeking the consumer's consent. Some consumers may be perfectly willing to be identified on the basis of their income, but unwilling to be identified on the basis of their credit histories. Some may be unwilling to be identified on the basis of their outstanding indebtedness.

Although we applaud the FTC's effort to protect consumer privacy by its narrow interpretation of the use of pre-screened lists, and its willingness to withstand the controversy that interpretation has generated, we believe that even the FTC approach could offend the privacy interests of many consumers. In its Commentary to FCRA, the FTC authorizes credit reporting agencies to release pre-screened lists only to creditors that commit to offer credit to all persons that appear on the list. However, the nature of the personal information (i.e., positive or negative) that will be associated with each person that appears on that list will depend on the creditor that receives the list. Again, loan sharks looking for consumers who are over their heads in debt will obtain lists of persons whose files contain adverse information. This type of information should not be released without the consumer's consent.

Section 103 Obsolete Information

This section will require credit reporting agencies to delete obsolete information on a schedule that parallels the seriousness of the adverse information. We believe it reasonably balances the interests of the credit reporting agency and its clients for information and the consumer's interest in clearing his records. Section 104 Accuracy and Record Keeping

We believe that this section will be useful in clarifying that

31-313 0-89-11

a credit reporting agency may not prohibit its clients from releasing the report to the consumer who is the subject of the report. A creditor willing to share the report with the consumer will save the consumer the time, trouble and cost of obtaining the report directly from the agency.

Although we strongly support the apparent intent of new subsection 607(b) (2), we believe a technical correction is required to achieve that intent. First, the subsection appears intended to ensure that the agency will keep detailed records of the routine procedures established and followed to ensure the "maximum possible accuracy" of the information it reports. Thus, for example, the agency may have to show that it has generally applicable procedures to monitor the accuracy of the debt payment information periodically received from information providers. These general procedures may include notifying providers with unreasonably high levels of inaccurate information and, if necessary, discontinuing receiving their information if the problem continues.

Second, the procedures required under this subsection should also include the specific procedures the agency followed to ensure the accuracy of an individual file. Thus, for example, if the agency is in receipt of public record information about a particular individual, its records should reflect the procedures it used to ensure the accuracy and currency of the information.

We believe the first category information, that related to the generally applicable procedures to ensure accuracy, should be made available "upon the request of any person, as subsection (b) (2) requires. The second category of information, that related to the procedures followed to ensure the accuracy of information about a specific consumer, should not be made available to anyone but the consumer and the enforcement agencies, contrary to subsection (b)(2).

Similarly, we support the basic purpose of new subsection 607 (d), requiring agencies to keep detailed records of the certified purpose for which each report is requested. However, these records should not be available to "any person," but only to the consumer and the enforcement agencies.

Section 105 Consumer Access

This section gives the consumer an important right that should have been included in the original Act-- the right to access his entire credit file upon request. Under current law, the consumer can only obtain the "nature and substance" of the information in his file. Full access will help the consumer uncover any inaccuracies and impermissible releases, and help the consumer better understand the nature of a consumer report and its contents. The summary of the consumer's rights under the Act, which the amendment also requires the credit reporting agency to provide here

and in other situations, is a basic pre-requisite to the consumer's exercise of these rights.

We suggest two improvements to this section. First, the law should require the credit reporting agency to provide a "plain english" explanation of how to interpret the report. Second, the law should clarify that the file disclosed to the consumer includes the record of the certified purpose required under new section 607 (d) any recipient of the report asserted in gaining access to the file.

Section 106 Reinvestigations

or

This section will make the re-investigation process more useful to the consumer attempting to correct inaccurate incomplete information. One of the major goals of the Act is to promote accurate credit reports, and the re-investigation procedure is one of the main mechanisms to meet this goal. Consequently, it is extremely important that the law clearly specify how this mechanism is to function, and the responsibilities of the credit reporting agency and the providers of information once the mechanism is triggered. This section takes important steps in this direction, although further improvements are needed to make the reinvestigation procedure work as intended.

On the positive side, the bill requires agencies to complete the reinvestigation within 30 days. Without a specific deadline, some agencies will continue to drag their feet during the process, knowing the consumer has no recourse and may even give up in frustration. On the other hand, new subsection 611(f) allows the reinvestigation to exceed this time period if the credit reporting agency determines an extension is necessary "despite reasonable efforts." Again, the law should specify an outside time period (30 days is more than reasonable) by which the reinvestigation must be completed. Information not verified by that time should be deleted subject to reinclusion upon later verification.

The record keeping requirement regarding reinvestigations is also a step forward. It will aid in the enforcement agencies' monitoring of the Act. The requirement should be clarified, however, to indicate that two types of records are required. First, there should be records that are not file-specific setting forth the general procedures the agency follows in conducting reinvestigations. These records should be "made available upon the request of any person." Second, there should be records regarding the specific steps taken by the agency to reinvestigate disputed information in a specific file. This information, of course, should only be available to the consumer and the enforcement agencies. (If these steps were described in the notice provided the consumer when the reinvestigation is complete but the dispute is not resolved, which we strongly recommend, a copy of the notice could also serve as the record.)