in consumers' files would also be required to be disclosed, except that certain medical information could be disclosed through a medical professional. The notion that an individual be afforded some expectation of confidentiality in his or her records is also basic to fair information practices. The information maintained by credit bureaus and other consumer reporting agencies contains highly detailed, if often incomplete, accounts of financial status and dealings, and often other sensitive personal and lifestyle information. Yet the FCRA presently permits extremely wide, indeed almost unfettered access to consumer reports by persons far removed from the original credit transaction for which the consumer supplied information. - Title I would strengthen the consumer's expectation of confidentiality with respect to consumer reports. First, it would require that the consumer be notified when a consumer report is obtained for certain purposes that are routine to the consumer reporting agency but may not be expected by the consumer - employment purposes, for example. (Notification is likewise required by Titles II and V when creditors and insurers, respectively, obtain consumer reports.) Second, Title I would require the consumer's written authorization for most of the unspecified purposes now allowed by the FCRA under the heading "legitimate business need." TITLE II, "FAIR CREDIT INFORMATION PRACTICES ACT" Past efforts to ensure the accuracy of credit information have focused primarily on consumer reporting agencies, because it is there that most credit-related information accumulates. However, since credit grantors themselves are a vital link in the flow of credit information, Title II would extend to credit grantors comprehensive fair information standards, similar to those which underlie Title V, the Fair Insurance Information Practices Act. As I mentioned, creditors do not generally inform applicants of the nature and sources of additional information that will be collected, or of the disclosures of information that will be made. Many such exchanges may not be readily apparent to the applicant. In order for market forces to operate, and indeed in the interest of basic fairness, the consumer must be notified of the creditor's information practices. Title II would require such notification and would require creditors to limit their collection and disclosure practices to those specified in the notice. At present, there are practically no limits on how a creditor can disclose information it collects about consumers. Title II would establish for consumers an expectation of confidentiality with regard to information about them in the credit information system, by limiting the circumstances in which creditors may disclose personal information without obtaining the consumer's authorization. These specific circumstances cover most of the normal disclosures made by creditors within the industry. Disclosures that do not fall within these categories would require the consumer's authorization. Existing law provides only limited access by consumers to information about them in the credit industry flow. As a practical matter, the consumer must search, often in several different places and often in person, to obtain what little information may be available. The ECOA requires the creditor to give the reasons for an adverse decision, but it does not require the actual supporting information to be disclosed. The FCRA requires the creditor to disclose directly to the consumer only the nature of the information obtained from a source other than a consumer reporting agency. If the information was obtained by the creditor from a consumer reporting agency, the FCRA requires that the consumer be informed of that fact As I indicated in my discussion of Title I, access to only the nature and substance of information makes the discovery and correction of errors a matter of guesswork. Such limited access makes it virtually impossible even to discern on what information the adverse decision was based. The difficulties are multiplied when access is further limited to just the nature of the information, as is now the case when an adverse decision is based on information that the creditor collects from sources other than consumer reporting agencies. It is at the point of adverse decision that the inadequacy of the FCRA access provision is most serious, since it is at the point of adverse decision that inaccuracies have their most direct effect. Title II would require the creditor to disclose the actual information about the consumer underlying an adverse decision, including any consumer report that was used. To avoid shunting the consumer from place to place, Title II would give the consumer the right to have access to all the records used in making a decision directly from the creditor. Additionally, the adverse decision procedures would require automatic notification of the consumer's rights of correction. This fills a gap in existing law, which puts an unnecessary burden on the individual to find out what his or her rights in fact are. The rights of correction afforded by Title II would ensure that inaccuracies can be corrected, and equally importantly, that the corrections are sent to other parties to whom the creditor has disclosed the inaccurate information. As information recorded in the credit information system increasingly becomes the overriding element in a determination of whether credit will be granted, it is imperative that consumers have the ability to ensure that inaccurate information is purged from the entire system. COST CONSIDERATIONS Throughout the drafting process, as Mr. Hodges described in his testimony, we tried to minimize the cost and burden of compliance. We solicited comments from industry representatives (among others) at several stages in the bills' development, and altered many of the original requirements in response to these comments. Another source of information about the effects of the proposed legislation was a study of the projected costs to banks of implementing the Privacy Protection Study Commission's recommendations. The study, commissioned by the American Bankers Association (ABA) and conducted by Touche Ross & Co., found the most costly of any of the Privacy Commission recommendations to be the initial mass mailing of notices to existing bank customers. The ABA study estimated that if this mass mailing were eliminated, "most of the estimated costs of implementing these recommendations would be eliminated." "Accordingly, we deleted that requirement from the bills. The study suggested one other way in which a major cost element might be minimized. This was to give banks a choice as to how they would provide . We are sensitive to the burdens that even minimal legislative requirements can place on small businesses. Throughout the drafting process we consulted with other Federal agencies and with private sector groups to try to craft an appropriate, workable exemption for small businesses. Rather than establish arbitrary measures of size by which certain businesses would be excluded from coverage, Title II names only the specific types of institutions that would be covered, most of which are "financial institutions" as defined in the Right to Financial Privacy Act of 1978. Retailers, very many of whom are small businesses, would be covered only if they issued their own credit cards. It is important to note that the bills do not impose legal requirements on any class of business that is not already subject to similar provisions. Most notably, the Equal Credit Opportunity Act imposes on all creditors, large and small, the requirement to provide an individual who is the subject of an adverse credit decision with the reason for that decision. We believe that the costs of fair information practices should be evaluated in the context of the benefits obtained. In addition to the direct benefits that this legislation would provide to consumers, it may also have certain economic benefits to the institutions involved. The Federal Reserve Board recently released a study of the effect of the Equal Credit Opportunity Act's requirement that a creditor supply a rejected credit applicant with the reason for the rejection. The study showed that a majority of those who then supplied additional information were granted credit -- suggesting that considerable economic benefits to the creditors, as well as social benefits to the broader public, accrued from adopting the sort of procedures envisioned by the proposed legislation. |