The Fair Credit Reporting Act (FCRA) “governs the collection, assembly, and use of consumer report information and provides a framework for the credit reporting system in the United States.”
One of the FCRA’s goals is to prevent the misuse of sensitive consumer information by limiting recipients to those who have a legitimate need for it. That means credit unions and others using consumer reports must have a “permissible purpose” to obtain them under the FCRA.
Section 604(a) of the FCRA allows a credit bureau to release a credit report to a credit union under the following circumstances:
♦ As instructed by the consumer in writing. Consumers can provide written authorization in person, via regular mail, or electronically (email or online) in accordance with the federal Electronic Signatures in Global and National Commerce Act (ESIGN). The consumer’s written instructions must clearly authorize the issuance of the credit report. For example, “I, (consumer’s name), authorize ABC Credit Union to procure my credit report” is a clear instruction. But “I, (consumer’s name), understand ABC Credit Union may obtain my credit report” is an acknowledgement that a report may be pulled rather than an instruction from the consumer.
♦ In connection with a credit transaction involving the consumer. When a member applies for cred-it—whether in person, by phone, or online—the credit union has a permissible purpose to obtain a credit report on the applicant.
♦ For the review or collection of a consumer’s credit account. The credit union must have an existing credit account with the consumer and must use the credit report solely to consider taking action with respect to that particular account (e.g., modifying the terms of the account). A permissible purpose doesn’t exist for paid off or closed accounts.
♦ For employment purposes. Before obtaining a consumer report for employment purposes, the credit union must notify the individual in writing that a consumer report may be used and convey this infor-mation in a document consisting solely of this notice; and obtain the individual’s written authorization before pulling the consumer report.
♦ When the credit union has a legitimate business need for information:
This is the permissible purpose credit unions use to pull credit reports on potential members to establish deposit accounts; or to determine whether the terms of existing members’ accounts should be modified. (This section doesn’t apply to credit or employment scenarios covered by other permissible purposes.)
Note that credit unions can’t use this permissible purpose to pull credit reports to market products and services to members. In general, marketing is not a permissible purpose. The only exception to the FCRA’s prohibition on using credit reports for marketing purposes is prescreening, which allows credit bureaus to provide credit unions with limited information for making unsolicited credit offers.
When another permissible purpose exists (other than employment), the credit bureau can furnish the credit report without the consumer’s specific authorization. For example, if the member applies for a loan, the credit union has a permissible purpose to obtain a credit report on the applicant (i.e., in connection with a credit transaction involving the consumer). Nevertheless, many institutions still require members to sign a written authorization to pull a credit report as part of the application process.
For more information on the FCRA, visit CUNA’s e-Guide to Federal Laws and Regulations at cuna.org (select “regulations & compliance”).
VALERIE Y. MOSS is CUNA’s director of compliance information. Contact CUNA’s compliance department.