The IT Law Wiki


Fair Credit Reporting Act of 1970 (FCRA), Pub. L. No. 91-508, tit. 6, §601, 84 Stat. 1128, codified as amended, 15 U.S.C. §1681-1681x (Oct. 26, 1970) (full-text).


The FCRA was enacted on October 26, 1970, and became effective on April 25, 1971. The FCRA is a part of a group of acts contained in the Federal Consumer Credit Protection Act[1] such as the Truth in Lending Act of 1968 and the Fair Debt Collection Practices Act. Congress substantively amended FCRA when it passed the Consumer Credit Reporting Reform Act of 1996[2] and the Fair and Accurate Credit Transactions Act of 2003 (FACT Act).[3]

The Act regulates credit bureaus, entities or individuals who uses credit reports, and businesses that furnish information to credit bureaus.

The FCRA was passed in 1970 in response to a pattern of abuse and misinformation by the consumer reporting industry. In addition to highly inaccurate reports, Congress was concerned that data brokers were reporting conclusions about consumers' "lifestyle," including assessments about marital status.

The Act opens with the following findings:

The Congress makes the following findings:
  1. The banking system is dependent upon fair and accurate credit reporting. Inaccurate credit reports directly impair the efficiency of the banking system, and unfair credit reporting methods undermine the public confidence which is essential to the continued functioning of the banking system.
  2. An elaborate mechanism has been developed for investigating and evaluating the credit worthiness, credit standing, credit capacity, character, and general reputation of consumers.
  3. Consumer reporting agencies have assumed a vital role in assembling and evaluating consumer credit and other information on consumers.
  4. There is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy.[4]

As amended in 2003, the FCRA imposes safeguarding requirements designed to prevent identity theft and assist identity theft victims.


The purpose of the FCRA is “to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information.”[5] The FCRA applies to the files maintained by “consumer reporting agencies,” a term broadly defined to include anyone in the business of furnishing reports on the credit worthiness of consumers to third parties.[6] Consumer credit reports generally include information about a consumer’s “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.”[7] This information is gathered and sold to creditors, employers, landlords and other businesses.

Consumer rights and credit reporting agency responsibilities[]

“[A] major purpose of the Act is the privacy of a consumer’s credit-related data.”[8] The Act sets forth rights for individuals and responsibilities for consumer reporting agencies in connection with the preparation and dissemination of personal information in a consumer report. Under the FCRA consumer reporting agencies are prohibited from disclosing consumer reports to anyone who does not have a permissible purpose.

The FCRA covers information gathered by consumer reporting agencies on consumers to evaluate qualifications for credit, employment, insurance, and other transactions; covered information may include identifying (name, address, employer and former address and employer), credit (transactions, etc.), and public record information as well as information on entities seeking credit reports on the consumer.

The Act ensures that “reasonable procedures” are employed (including making reasonable efforts to verify the identity of each new prospective user of consumer report information and the uses certified by each prospective user prior to furnishing such user a consumer report) to ensure that consumer reports are supplied only to those with a permissible purpose,[9] and for correcting information in a consumer’s report that may be incorrect or the result of fraud. Permissible purposes include decisions involving credit, insurance, or employment.[10] A consumer reporting agency is also permitted to provide reports to persons having “a legitimate business need” for the information in connection with a consumer-oriented transaction.

A limited amount of identifying information from a credit bureau’s file on a consumer (i.e., “header information” — name, address, employment and previous address) may be disclosed upon request. No notice is required. Consumer credit reports and any other information in a consumer’s file can be disclosed pursuant to a court order or grand jury subpoena; or in connection with the application for a license or for determining eligibility for a government benefit or license.


The Federal Trade Commission enforces the FCRA. A violation under the FCRA is deemed to be an unfair or deceptive act or practice in violation of Section 5(a) of the FTC Act. When the FTC has reason to believe that any person has used or is using unfair or deceptive practices in or affecting commerce, it may issue a complaint against such person in an administrative proceeding, if it believes such a proceeding to be in the public interest.[11]

There are various penalties for violating the FCRA, the applicability of a particular provision depends on such factors as who brings the action and the degree of the violator’s noncompliance. For example, the Act imposes liability for both willful noncompliance and negligent noncompliance.[12] The monetary penalties include actual damages sustained by a consumer, plus costs and attorney's fees.

In the case of willful violations, the court may also award punitive damages to a consumer. Any person who procures a consumer report under false pretenses, or knowingly without a permissible purpose, is liable for $1000 or actual damages (whichever is greater) to both the consumer and to the consumer reporting agency.[13] Also, the Act governs enforcement actions brought by the Commission, other agencies, and the states, and provides for various monetary and injunctive penalties.[14] For those who knowingly violate the FCRA, the monetary penalties include up to $2500 per violation in a civil action brought by the Commission.[15]

Data disclosure[]

The FBI, for foreign counterintelligence investigative purposes, may obtain names and addresses of financial institutions at which consumers maintain or have maintained accounts, provided the request is signed by an appropriate official who has certified that the investigation is not conducted solely on the basis of activity protected under the First Amendment.

The USA PATRIOT Act amended the FCRA to authorize the disclosure of consumer reports and any other information in a consumer’s file upon request in writing from any government agency authorized to conduct international terrorism investigations, or intelligence or counterintelligence activities related thereto, stating that such information is necessary for the agency’s conduct of that activity and signed by an appropriate supervisor. No notice is required.


  1. 15 U.S.C. §1601 et seq.
  2. Title II, Subtitle D, Chapter 1, of the Omnibus Consolidated Appropriations Act for Fiscal Year 1997, Pub. L. No. 104-208 (Sept. 30, 1996).
  3. Pub. L. No. 108-159, 117 Stat. 1952 (Dec. 4, 2003).
  4. 15 U.S.C. §1681(a)(1)‐(4)
  5. 15 U.S.C. §1681(b).
  6. Id. §1681a(f).
  7. Id. §1681a(d). In addition to credit information, consumer reporting agencies are allowed to include information on the failure of the consumer to pay overdue child support, if such information has been provided to the agency by a state or local child support enforcement agency or verified by any state or federal government agency. This information remains on the consumer report for up to 7 years. Id. §1681s-1.
  8. Trans Union Corp. v. FTC, 81 F.3d 228, 234 (D.C. Cir. 1996) (full-text).
  9. 15 U.S.C. §1681e.
  10. Id. §1681b.
  11. Id. §45(b).
  12. Id. §1681n(a).
  13. Id. §1681n(b).
  14. Id. §1681s.
  15. Id. §1681s(2)(A).