Understanding the FAIR CREDIT REPORTING ACT

NAN728/Shutterstock.com

FAIR CREDIT

REPORTING ACT

Understanding the

April/May 2016 | Practical Law

MEIR FEDER

PARTNER

JONES DAY

Meir heads the ﬁrm’s Issues & Appeals Practice in New York. He has argued

appeals in the US Supreme Court and in eight federal circuits, and has briefed

and argued state court appeals and dispositive motions at the trial level. Meir

has extensive experience with the FCRA as well as in many other practice areas,

and he has argued some of the leading FCRA cases, such as Carvalho v. Equifax

Information Services, LLC, 629 F.3d 876 (9th Cir. 2010).

RAJEEV MUTTREJA

ASSOCIATE

JONES DAY

Rajeev is a member of the ﬁrm’s Issues & Appeals Practice in New York. He has

argued before the Sixth, Seventh, and Ninth Circuits, and has drafted briefs in

the US Supreme Court, many other appellate courts, and trial courts across the

country. Rajeev has served as lead defense counsel in more than two dozen cases

arising under the FCRA.

The Fair Credit Reporting Act (FCRA)

is a widely used statute governing the

collection, maintenance, and disclosure

of consumers’ personal information.

In addition to regulating consumer

reporting agencies, the statute imposes

a number of obligations on parties

that supply consumer information to

these agencies or use consumer reports.

With FCRA litigation on the rise

nationwide, it is more important than

ever for counsel to be familiar with the

FCRA and its implications.

The Journal | Litigation | April/May 2016

ongress enacted the Fair Credit Reporting Act (FCRA)

in 1970 to promote the accuracy, fairness, and privacy of

information in the files of consumer reporting agencies

(CRAs) while also satisfying the important commercial

need for consumer reports (15 U.S.C. § 1681; see TRW Inc. v. Andrews,

534 U.S. 19, 23 (2001)). The FCRA has been amended numerous

times, most significantly in 1996 and 2003, and generally regulates:

 How CRAs must maintain their files on consumers.

 How parties may furnish information about

consumers to CRAs.

 How consumers may dispute information in their

consumer reports.

 When a party may request and use a consumer report.

The FCRA is most often associated with reports on a consumer’s

credit history, commonly known as credit reports, but covers

other types of reports as well. Consumer reports typically

include an individual’s credit history and payment patterns,

demographic and identifying information, and public records

information, such as arrests, judgments, and bankruptcies.

Parties can use this information, for example, when making

decisions on applications for credit cards, mortgages,

apartments, and employment to predict the risk that a consumer

might not satisfy a future debt or obligation.

The Federal Trade Commission and Consumer Financial

Protection Bureau share enforcement authority under the FCRA,

and both have issued related regulations and informal guidance.

Yet private consumer lawsuits seeking to recover actual or

statutory damages for violations of the FCRA far outnumber

agency actions. Moreover, plaintiffs’ counsel increasingly are

aggregating consumer claims for class action litigation (see Box,

Special Considerations for FCRA Class Actions).

This article provides an overview of key issues that counsel

should consider when litigating private consumer lawsuits under

the FCRA. In particular, it addresses:

 The scope of the FCRA and the entities covered by it.

 Preemption of state-law claims.

 The required mental state for civil liability under the FCRA.

 Damages and remedies available for FCRA violations.

 The FCRA provisions that most often form the basis for

consumer claims.

 Common defenses to FCRA claims.

STATUTORY SCOPE

The FCRA defines a consumer report as any written or oral

communication that meets all of the following conditions:

 It is prepared by a CRA.

 It bears on a consumer’s creditworthiness, credit standing,

credit capacity, character, general reputation, personal

characteristics, or mode of living.

 It is used or collected, at least in part, to establish a

consumer’s eligibility for:

z

credit or insurance for personal, family, or household purposes;

z

employment purposes; or

z

any other purpose authorized by Section 1681b of the FCRA

(see below Issuing or Obtaining a Consumer Report for an

Impermissible Purpose).

(15 U.S.C. § 1681a(d)(1); see Yang v. Gov’t Emps. Ins. Co., 146 F.3d

1320, 1323 (11th Cir. 1998); St. Paul Guardian Ins. Co. v. Johnson, 884

F.2d 881, 885 (5th Cir. 1989) (noting that a communication can be

a consumer report under the FCRA if it contains information that

was collected or expected to be used for a listed purpose under the

statute, even if not actually used for that purpose).)

The FCRA’s definition of a consumer report excludes:

 Reports that concern a consumer’s eligibility for commercial,

rather than personal, credit (see Ippolito v. WNS, Inc., 864 F.2d

440, 452 (7th Cir. 1988)).

 Reports about a consumer’s transactions or experiences

with the person or organization making the report, such as

retail stores, hospitals, present or former employers, banks,

mortgage servicing companies, or credit unions (15 U.S.C.

§ 1681a(d)(2)(A)(i); see, for example, Owner-Operator Indep.

Drivers Ass’n v. USIS Commercial Servs., Inc., 537 F.3d 1184,

1190-92 (10th Cir. 2008)).

 Certain communications between corporate affiliates (15

U.S.C. § 1681a(d)(2)(A)(ii)-(iii); see, for example, Am. Bankers

Ass’n v. Gould, 412 F.3d 1081, 1084 (9th Cir. 2005)).

 Decisions on potential extensions of credit (15 U.S.C. §

1681a(d)(2)(B)-(C)).

 Reports that are disclosed to only the consumer, rather

than a third party (see Wantz v. Experian Info. Sols., 386

F.3d 829, 834 (7th Cir. 2004), abrogated on other grounds

by Safeco Ins. Co. of Am. v. Burr, 551 U.S. 47 (2007);

Pettway v. Equifax Info. Servs., LLC, 2010 WL 653708, at *7

(S.D. Ala. Feb. 17, 2010)).

Disclosures of basic identifying or demographic information,

such as a consumer’s name or address, typically are not

considered consumer reports. However, communications about

a person’s income, employment, or medical history have been

held to qualify as consumer reports because they bear on a

consumer’s personal characteristics. (See Rowe v. UniCare Life &

Health Ins. Co., 2010 WL 86391, at *3 (N.D. Ill. Jan. 5, 2010).)

REGULATED ENTITIES

In regulating consumer reports, the FCRA imposes duties on:

 CRAs, which prepare consumer reports and maintain the

reported information.

 Furnishers, which provide information about their experiences

with consumers to CRAs.

 Third parties that request and use consumer reports.

CRAs

A CRA is an organization that regularly assembles or evaluates

consumer credit information or other consumer information

(typically from a variety of sources, including credit card companies,

banks, and public records), to prepare and provide consumer

reports to third party users (15 U.S.C. § 1681a(f); see, for example,

Hodge v. Texaco, Inc., 975 F.2d 1093, 1097 (5th Cir. 1992)).

April/May 2016 | Practical Law

Under the FCRA, CRAs must:

 Maintain reasonable procedures to ensure:

z

the accuracy of their consumer reports; and

z

that the consumer reports are provided only for permissible

purposes (see Box, Permissible Purposes: Reasonable

Procedures and Certifications).

 Reasonably investigate consumers’ disputes of reported

information.

The largest CRAs include Equifax Information Services, LLC,

Experian Information Solutions, Inc., and TransUnion LLC,

which each maintain vast repositories of consumer credit

information. However, the definition of CRA also reaches smaller

organizations that provide credit screenings and reports for use

by employers, landlords, banks, mortgage companies, retail

stores, casinos, and insurance companies, among others.

INFORMATION FURNISHERS

A furnisher provides information to CRAs for inclusion in

consumer reports. Under the FCRA, furnishers must:

 Provide accurate and complete information to the CRAs.

 Investigate consumers’ disputes of the accuracy of furnished

information.

(15 U.S.C. § 1681s-2.)

The term furnisher is not defined in the statute, but is generally

understood to include organizations that provide information

about their customers to CRAs. Examples of furnishers include

banks, credit card issuers, mortgage lenders, collection agencies,

and auto finance lenders.

USERS OF CONSUMER REPORTS

Under the FCRA, third-party users of consumer reports must:

 Have a permissible purpose to obtain the consumer report

(see below Issuing or Obtaining a Consumer Report for an

Impermissible Purpose).

 Make certifications to the CRA on their intended use of

consumer reports (see Box, Permissible Purposes: Reasonable

Procedures and Certifications).

 Notify consumers when adverse actions are taken, or certain

other decisions are made, based on a consumer report

(15 U.S.C. § 1681m).

 Follow specific policies and procedures related to identity

theft (15 U.S.C. § 1681c-1).

 Adequately resolve discrepancies related to a consumer’s

address (15 U.S.C. § 1681c(h)).

Apart from these requirements, the FCRA imposes additional

obligations on creditors that use consumer reports in connection

with an application for, or a grant of, an extension or a provision of

credit to the consumer. These creditors must provide consumers

with a risk-based pricing notice if both of the following apply:

 The credit’s material terms are materially less favorable than

the most favorable terms available to a substantial proportion

of consumers.

 The credit’s terms are based in whole or in part on the

consumer report.

(15 U.S.C. § 1681m(h).)

Search Consumer Regulations Governing Debt Collection for

information on the federal consumer laws that govern debt collection

activities, including how the FCRA applies to debt collectors.

PREEMPTION OF STATE-LAW CLAIMS

When alleging FCRA violations, consumers often also bring

claims under various state laws in the same action. However,

the FCRA preempts certain state statutes and common law,

including:

 Inconsistent state laws. The FCRA preempts state statutes,

regulations, and common law that purport to govern the

collection, distribution, or use of any consumer information,

or to prevent or mitigate identity theft, where the state law is

inconsistent with the FCRA. These state laws are preempted

to the extent of the inconsistency (15 U.S.C. § 1681t(a)).

This occurs, for example, when complying with the state

law would violate the FCRA (see, for example, Davenport v.

Farmers Ins. Grp., 378 F.3d 839, 843 (8th Cir. 2004)).

 Defamation, privacy, and negligence claims. The FCRA

specifically bars defamation, invasion of privacy, and

negligence claims that concern the reporting of information

from being brought against any CRA, any user of a consumer

report, or any furnisher of reported information, except

for false information furnished with malice or willfully

intended to injure the consumer (15 U.S.C. § 1681h(e); see,

for example, Thornton v. Equifax, Inc., 619 F.2d 700, 703

(8th Cir. 1980)). For a state-law claim to stand under this

provision, a defendant’s misconduct must be truly malicious

and not simply careless (see Ross v. FDIC, 625 F.3d 808, 817

(4th Cir. 2010)).

The FCRA also preempts any law or regulation addressing the

series of subjects listed in Section 1681t(b), including any subject

matter relating to, for example, the responsibilities of furnishers

or persons who take adverse actions against consumers

(15 U.S.C. § 1681t(b)(1)(F)).

Search Federal Preemption Issues in Banking for information on the

federal preemption doctrine under US banking law, including more on

conflicts between the FCRA and state law.

CULPABLE MENTAL STATES UNDER THE FCRA

The FCRA is not a strict liability statute. An inaccurate consumer

report therefore does not automatically result in liability. Instead,

the FCRA imposes civil liability for negligent and willful failures

to comply with its requirements (15 U.S.C. §§ 1681n, 1681o).

NEGLIGENT VIOLATIONS

Negligence liability typically turns on whether the defendant

acted reasonably (see below Common Claims Under the FCRA).

To prove a claim for negligent failure to comply with the FCRA,

a consumer must show a causal relationship between the

defendant’s FCRA violation and the claimed harm, such as a

loss of credit. Absent this causal relationship, there can be no

liability. (See, for example, Crabill v. Trans Union, L.L.C., 259 F.3d

662, 664 (7th Cir. 2001); Cahlin v. Gen. Motors Acceptance Corp.,

936 F.2d 1151, 1160-61 (11th Cir. 1991).)

The Journal | Litigation | April/May 2016

For example, it is not enough for a consumer to show that his

consumer report is inaccurate and that he was denied credit.

Instead, the consumer must also prove that the inaccuracy, rather

than other aspects of the report, or other factors altogether,

caused the alleged harm. (See, for example, Pettus v. TRW

Consumer Credit Serv., 879 F. Supp. 695, 698 (W.D. Tex. 1994).)

Causation has two components:

 The violation must be the factual cause of the plaintiff’s injury.

Some courts have held that the violation must have been the

but-for cause of the plaintiff’s injury (see, for example, Matise

v. Trans Union Corp., 1998 WL 872511, at *7 (N.D. Tex. Nov. 30,

1998) (requiring a plaintiff to show that the inaccurate

information contained in a CRA-defendant’s report, “rather

than other lines in the [defendant’s] report or a report from a

different CRA, caused his injury”)). Others have held that the

violation must have been a “substantial factor” in causing the

injury (see, for example, Enwonwu v. Trans Union, LLC, 364 F.

Supp. 2d 1361, 1366 (N.D. Ga. 2005)).

 The violation must be the proximate cause of the plaintiff’s

injury (see, for example, Reeves v. Equifax Info. Servs., LLC,

2010 WL 2036661, at *6 (S.D. Miss. May 20, 2010)). This

means the connection between the violation and the alleged

injury cannot be too remote or indirect.

WILLFUL VIOLATIONS

To establish a willful violation of the FCRA, a consumer must

demonstrate that the defendant either knowingly or recklessly

violated the statute. This scienter requirement involves two

inquiries:

 Is there an objectively reasonable interpretation of the

statute under which the defendant’s conduct could be

considered lawful? There is no willful violation of the FCRA

if, at the time of the defendant’s actions, his conduct could

reasonably have been thought lawful. This objective inquiry

is made by the court rather than the jury. The defendant’s

subjective intent is irrelevant. (See Safeco, 551 U.S. at 70 & n.20.)

 If the defendant’s conduct was objectively unreasonable

under the statute, how unreasonable was it? For the

defendant’s conduct to have been reckless, the risk of violating

the FCRA must have been substantially greater than the risk

associated with a merely careless reading of the statute (see

Safeco, 551 U.S. at 69). A jury often must decide this question

based, in part, on the facts surrounding the defendant’s

particular interpretation of the statute (see Fuges v. Sw.

Fin. Servs., Ltd., 707 F.3d 241, 251 (3d Cir. 2012)). The US

Supreme Court in Safeco suggested (but did not hold) that

a defendant’s good-faith reliance on legal advice could be

relevant to this inquiry (Safeco, 551 U.S. at 70 n.20).

The objective nature of the first part of the Safeco test lends

itself well to a motion to dismiss or a motion for summary

judgment because a defendant can argue as a matter of law

that his alleged conduct did not violate any clearly established

FCRA requirement or prohibition (for more on strategies to

defend against FCRA claims, see below Common Defenses to

FCRA Claims).

DAMAGES AND REMEDIES

When claiming negligence liability, consumers may seek their

actual damages arising from an FCRA violation (15 U.S.C. §

1681o(a)(1)-(2)). Consumers alleging a willful failure to comply

with an FCRA requirement may seek:

 Either:

z

actual damages (15 U.S.C. § 1681n(a)(1)(A)); or

z

statutory damages of $100 to $1,000 (15 U.S.C. § 1681n(a)(1)(A)).

 Punitive damages (15 U.S.C. § 1681n(a)(2)).

Whether claiming a negligent or willful violation, a plaintiff

may recover costs and reasonable attorneys’ fees (15 U.S.C. §§

1681n(a)(3), 1681o(a)(2)).

Actual damages can include damages for emotional distress,

even if the plaintiff suffered no economic damages (see, for

example, Cortez v. Trans Union, LLC, 617 F.3d 688, 719 (3d Cir.

2010); Guimond v. Trans Union Credit Info. Co., 45 F.3d 1329,

1333 (9th Cir. 1995)). Courts generally require compelling proof

of a plaintiff’s emotional damages (see, for example, Sloane v.

Equifax Info. Servs., LLC, 510 F.3d 495, 502-03 (4th Cir. 2007);

Ruffin-Thompkins v. Experian Info. Sols., Inc., 422 F.3d 603, 610

(7th Cir. 2005) (holding that conclusory statements of emotional

harm were insufficient)).

Damages for alleged lost opportunities, such as those that

might have happened had a loan been approved, typically are

not available because they are too speculative (see, for example,

Casella v. Equifax Credit Info. Servs., 56 F.3d 469, 475 (2d Cir.

1995); Lee v. Sec. Check, LLC, 2010 WL 3075673, at *13 (M.D. Fla.

Aug. 5, 2010)). Additionally, business-related damages are not

It is not enough for a consumer to show that his consumer

report is inaccurate and that he was denied credit.

Instead, the consumer must also prove that the inaccuracy,

rather than other aspects of the report, or other factors

altogether, caused the alleged harm.

April/May 2016 | Practical Law

recoverable (see, for example, Tilley v. Global Payments, Inc., 603

F. Supp. 2d 1314, 1328-29 (D. Kan. 2009)).

Also, courts generally have held that injunctive relief is not

available to private litigants under the FCRA, although there is

limited older authority that reaches a contrary conclusion (see,

for example, Washington v. CSC Credit Servs. Inc., 199 F.3d 263,

268 (5th Cir. 2000) (summarizing older authority and finding

no private right to injunctive relief); White v. First Am. Registry,

Inc., 378 F. Supp. 2d 419, 421-24 (S.D.N.Y. 2005) (following

Washington); Howard v. Blueridge Bank, 371 F. Supp. 2d 1139,

1145-46 (N.D. Cal. 2005) (same)).

COMMON CLAIMS UNDER THE FCRA

Although the FCRA imposes a variety of requirements, plaintiffs

most frequently raise claims alleging that a defendant violated

the FCRA by negligently or willfully:

 Failing to follow reasonable procedures for ensuring the

accuracy of consumer information.

 Failing to properly investigate or reinvestigate a consumer’s

dispute.

 Issuing or obtaining a consumer report for an impermissible

purpose.

Courts have consistently held that to prevail on a reasonable

procedures or reinvestigation claim, a consumer must

demonstrate that the reported consumer information is

inaccurate (see, for example, DeAndrade v. Trans Union LLC, 523

F.3d 61, 65-67 (1st Cir. 2008) (collecting cases)). Courts generally

have agreed that the question of accuracy may be addressed at

summary judgment, but they have adopted different definitions

of accuracy (see, for example, Gorman v. Wolpoff & Abramson,

LLP, 584 F.3d 1147, 1163 (9th Cir. 2009) (a consumer report is

inaccurate if it is factually accurate but misleading, for example,

because it omits certain information); Spence v. TRW, Inc., 92

F.3d 380, 382 (6th Cir. 1996) (a consumer report’s accuracy

depends solely on the correctness of the information reported)).

Notably, the FCRA does not provide for a private right of action

for alleged violations of a party’s duties when using a consumer

report (which are different from a party’s duties when requesting

a consumer report under Section 1681b) (see 15 U.S.C. § 1681m(h)(8)).

Instead, only the federal government can enforce those duties

(see, for example, Perry v. First Nat’l Bank, 459 F.3d 816, 819-23

(7th Cir. 2006)). In these actions, the user cannot be held liable if

he shows by a preponderance of the evidence that he maintained

reasonable procedures to assure compliance with the FCRA at

the time of the alleged violation (15 U.S.C. § 1681m(c)).

FAILURE TO FOLLOW REASONABLE PROCEDURES

The FCRA requires CRAs to follow reasonable procedures to

assure maximum possible accuracy when preparing consumer

reports (15 U.S.C. § 1681e(b); see Thompson v. San Antonio Retail

Merchants Ass’n, 682 F.2d 509, 513 (5th Cir. 1982) (noting that

Section 1681e(b) imposes a duty of reasonable care on CRAs)).

Therefore, a CRA will not be liable if, for example, it accurately

reports information from a reliable source, but that source

provided inaccurate information (15 U.S.C. § 1681e(b); see, for

example, Henson v. CSC Credit Servs., 29 F.3d 280, 285 (7th Cir.

1994); Burke v. Experian Info. Sols., Inc., 2011 WL 1085874, at *5

(E.D. Va. Mar. 18, 2011); Stewart v. Abso, Inc., 2010 WL 3853114, at

*11 (W.D. Ky. Sept. 28, 2010)).

To establish liability under Section 1681e(b), a plaintiff must

show that:

 His consumer report contained inaccurate information.

 The CRA provided his consumer report to a third party.

 The inaccuracy was due to the defendant’s unreasonable

procedures.

 He suffered injury.

 His injury was caused by the inclusion of the inaccurate entry.

(See Cortez, 617 F.3d at 708; Wantz, 386 F.3d at 834.) One

possible exception to this list may apply to cases in the Ninth

Circuit, which has suggested that Section 1681e(b) liability does

not require provision of a consumer report to a third party (see

Guimond, 45 F.3d at 1333).

The circuit courts disagree on who bears the burden of proving

the reasonableness of the CRA’s procedures. The Ninth and

Eleventh Circuits have suggested that the CRA bears the burden

of showing that it acted reasonably (see Guimond, 45 F.3d at 1333

(noting that a CRA “can escape liability if it establishes that an

inaccurate report was generated despite the agency’s following

reasonable procedures”); Cahlin, 936 F.2d at 1156 (same)).

By contrast, the Fourth and DC Circuits have held that the

plaintiff bears the burden of showing that the defendant’s

procedures were unreasonable (see Dalton v. Capital Associated

Indus., Inc., 257 F.3d 409, 416 (4th Cir. 2001); Stewart v. Credit

Bureau, Inc., 734 F.2d 47, 51 & n.5 (D.C. Cir. 1984)). These courts

have noted that Congress explicitly shifted the burden of proof

from a plaintiff to a CRA elsewhere in the FCRA. By not also

doing so in Section 1681e(b), Congress intended that the default

burden would apply to claims under that provision. (See Stewart,

734 F.3d at 51 n.5 (citing 15 U.S.C. §§ 1681d(c), 1681m(c)).)

FAILURE TO INVESTIGATE OR REINVESTIGATE

If a consumer believes that information on his consumer

report is inaccurate, he can dispute the inaccuracy with the

CRA or directly with the furnisher. The consumer’s filing of a

dispute with the CRA triggers “reinvestigation” duties for the

CRA and investigation duties for the furnisher. Filing a dispute

with the furnisher, by contrast, triggers only the furnisher’s

duties. These duties call for a reasonable examination of the

consumer dispute by the CRA and the furnisher (see 15 U.S.C.

§§ 1681i(a)(1)(A), 1681s-2(b)). Notably, one circuit court has held

that a claim concerning reinvestigation applies to information

contained in a consumer’s file at a CRA, even if the CRA did

not provide the information to a third party (although, without

this disclosure, a consumer likely will have trouble proving

damages) (see Collins v. Experian Info. Sols., Inc., 775 F.3d 1330,

1333 (11th Cir. 2015)).

CRA Liability for Failing to Reinvestigate

Consumers commonly dispute the accuracy of information in

their consumer reports with the CRA that prepared the report.

Within 30 days after receiving notice of a dispute, subject to

an extension of 15 days if the consumer supplies additional

The Journal | Litigation | April/May 2016

information, the CRA must conduct and complete a reasonable

reinvestigation to determine whether the disputed information is

inaccurate (15 U.S.C. § 1681i(a)(1)(A)).

A reasonable reinvestigation calls for “reasonable diligence”

by the CRA (Dennis v. BEH-1, 520 F.3d 1066, 1071 (9th Cir.

2008)). This typically requires asking the furnisher whether the

reported information should be modified or deleted based on

the consumer’s dispute. There ordinarily is no need for the CRA

to require original documentation from the furnisher, and it is

typically reasonable for the agency to rely on the furnisher’s

verification or modification of the reported information. (See, for

example, Fed. Trade Comm’n, 40 Years of Experience with the

Fair Credit Reporting Act, at 76 (July 2011).) But if the CRA knows

or should know that the furnisher is unreliable, and if verifying

the reported information would not be too costly, then a

“reasonable reinvestigation” may in some circumstances require

verifying the accuracy of the furnisher’s information (Cushman v.

Trans Union Corp., 115 F.3d 220, 225 (3d Cir. 1997)).

However, a CRA is not required to resolve a legal dispute

between a furnisher and a consumer by, for example,

determining which side has the better interpretation of

a contract governing a reported debt (see, for example,

Carvalho v. Equifax Info. Servs., LLC, 629 F.3d 876, 892 (9th

Cir. 2010) (observing that a “CRA is not required as part of its

reinvestigation duties to provide a legal opinion on the merits”);

DeAndrade, 523 F.3d at 68; Krajewski v. Am. Honda Fin. Corp.,

557 F. Supp. 2d 596, 616-17 (E.D. Pa. 2008)).

If the CRA reasonably determines that a consumer’s dispute

is frivolous or irrelevant, the agency may terminate the

reinvestigation (15 U.S.C. § 1681i(a)(3)(A)). This can occur if,

for example, the consumer does not give the agency a reason

to believe that the reported information is inaccurate, or

the consumer’s dispute duplicates a previous dispute (see,

for example, Ruffin-Thompkins, 422 F.3d at 608-09). After

terminating the reinvestigation, the agency must notify the

consumer within five business days (15 U.S.C. § 1681i(a)(3)(B)).

After a consumer dispute is raised, the CRA must:

 Provide prompt notice to furnishers. Within five business

days of receiving notice of a dispute, the CRA must notify the

furnisher of the dispute and provide all relevant information

regarding the dispute that the agency received (15 U.S.C.

§ 1681i(a)(2)(A)). However, this does not require the CRA to

transmit the consumer’s statements on the dispute, if the CRA

provides an accurate and reasonable summary of the dispute

(see, for example, Paul v. Experian Info. Sols., Inc., 793 F. Supp.

2d 1098, 1103 (D. Minn. 2011); Boothe v. TRW Credit Data, 768

F. Supp. 434, 438-39 (S.D.N.Y. 1991)). The furnisher must then

reasonably investigate the matter and report the results of the

investigation to the CRA (15 U.S.C. § 1681s-2(b)).

 Modify or delete inaccurate or unverifiable information. The

CRA must promptly modify or delete the disputed information

as appropriate and notify the furnisher of any changes, if the

agency either:

z

determines that the disputed information is inaccurate or

incomplete; or

z

cannot verify the information within the timeframe for

completing the reinvestigation.

(15 U.S.C. § 1681i(a)(5)(A).) If the agency deletes any

information, it cannot later reinsert the information unless

the furnisher certifies that the information is accurate. If the

furnisher provides this certification, the CRA must notify the

consumer within five business days after the reinsertion (15

U.S.C. § 1681i(a)(5)(B)).

CRAs must observe reasonable procedures to limit the

issuance of consumer reports to permissible purposes.

These procedures can include:

 Requiring that a party requesting a consumer report

certify the purposes for which it is seeking the

information.

 Making a reasonable effort to verify the user’s identity

and certified purposes.

 Declining to provide a consumer report if the CRA has

reasonable grounds to believe the report will not be used

for a permissible purpose.

(15 U.S.C. § 1681e(a).)

Most courts have held a CRA’s reliance on a party’s

blanket certification that reports are being requested for

a permissible purpose to be reasonable as a matter of

law, particularly when the CRA has no reason to doubt the

requesting party’s purposes (see, for example, Hernandez

v. Lamboy Furniture, Inc., 2008 WL 4061344, at *9-10 (E.D.

Pa. Sept. 2, 2008); Enoch v. Dahle/Meyer Imports, L.L.C.,

2007 WL 4106264, at *5 (D. Utah Nov. 16, 2007); Dobson

v. Holloway, 828 F. Supp. 975, 977 (M.D. Ga. 1993); Davis

v. Asset Servs., 46 F. Supp. 2d 503, 508 (M.D. La. 1998);

Boothe v. TRW Credit Data, 557 F. Supp. 66, 71 (S.D.N.Y.

1982)). No court has held that blanket certifications are

impermissible, and that a CRA must individually review

every request for a consumer report.

Some courts, however, have held that whether the use of a

blanket certification is a “reasonable procedure” in certain

circumstances is a question of fact (see, for example,

Pintos v. Pac. Creditors Ass’n, 565 F.3d 1106, 1114 (9th Cir.

2009), amended and superseded on other grounds by 605

F.3d 665 (9th Cir. 2010); Sheldon v. Experian Info. Sols., Inc.,

2010 WL 3768362, at *5 (E.D. Pa. Sept. 28, 2010)).

Permissible Purposes: Reasonable Procedures and Certiﬁcations

April/May 2016 | Practical Law

 Provide its reinvestigation findings to the consumer. After

completing or terminating a reinvestigation, the CRA must

notify the consumer of the results within five business days

(15 U.S.C. § 1681i(a)(3)(B), (a)(6)). The CRA should provide,

among other things, a revised consumer report and, on the

consumer’s request, a statement describing the procedures

it used to reinvestigate the allegedly inaccurate information

(15 U.S.C. § 1681i(a)(6)(B)).

If the reinvestigation does not resolve the dispute to the

consumer’s satisfaction, the consumer may file a brief statement

about the dispute that must appear on all consumer reports

listing the information, unless the CRA has reasonable grounds

to believe the statement is frivolous or irrelevant (15 U.S.C. §

1681i(b)-(c)).

Furnisher Liability for Failing to Investigate

If a consumer disputes the accuracy of information in his consumer

report directly with a furnisher, the furnisher must conduct and

complete an investigation within 30 days (15 U.S.C. § 1681s-2(a)(8)).

If the furnisher determines that the reported information is

inaccurate, it must promptly correct the information with all CRAs

to which it furnished the information (15 U.S.C. § 1681s-2(a)(2)).

As discussed above, a furnisher also must investigate disputed

information after receiving notice from a CRA that a consumer

filed a dispute with the agency (15 U.S.C. § 1681s-2(b)).

Although the FCRA does not specify the duty of care a

furnisher must use in its investigation, courts have held that the

investigation must be reasonable (see, for example, Johnson v.

MBNA Am. Bank, NA, 357 F.3d 426, 431 (4th Cir. 2004)). It can

be unreasonable, for example, for a furnisher not to consult

the underlying documents when verifying that information is

accurately reported.

A consumer may sue a furnisher over the accuracy of information

only after the consumer has formally disputed the information

with the CRA, which triggers the furnisher’s investigation duties

(15 U.S.C. § 1681s-2(c)). Before a consumer files a dispute with

the CRA, only the federal and state governments may sue the

furnisher (15 U.S.C. § 1681s-2(a), (e); see, for example, Seamans

v. Temple Univ., 744 F.3d 853, 864 (3d Cir. 2014); Nelson v. Chase

Manhattan Mortg. Corp., 282 F.3d 1057, 1060 (9th Cir. 2002)).

ISSUING OR OBTAINING A CONSUMER REPORT FOR AN

IMPERMISSIBLE PURPOSE

A consumer may sue a CRA or user for negligently or willfully

issuing or obtaining a consumer report for an impermissible

purpose (15 U.S.C. § 1681b). Commonly litigated purposes

include:

 Firm offers of credit or insurance.

 Employment matters.

 Credit transactions.

 Other legitimate business needs.

Except for consumer reports issued for employment purposes,

consumer consent is not a prerequisite to a permissible purpose

(15 U.S.C. §§ 1681b(b), 1681a(h); see, for example, Hinton v. Trans

Union, LLC, 2009 WL 2461439, at *6 (E.D. Va. Aug. 11, 2009)).

Instead, requesting a report with a consumer’s consent qualifies

as its own permissible purpose, distinct from the others listed in

the FCRA (see 15 U.S.C. § 1681b(a)(2)).

CRAs are not required to police how a user ultimately uses the

consumer report, but they must maintain reasonable procedures

to limit improper disclosures (see Box, Permissible Purposes:

Reasonable Procedures and Certifications).

Firm Offers

CRAs may disclose consumer credit information in connection

with the extension of a firm offer of credit or insurance that is not

initiated by the consumer if both:

 The consumer has been pre-screened.

 The offer meets the criteria set forth at Section 1681a(l).

(15 U.S.C. § 1681b(c).)

Plaintiffs commonly allege that a defendant, often a credit card

company, made a firm offer merely as a pretext for obtaining the

plaintiff’s consumer report. However, courts typically consider

these offers to be legitimate firm offers if the creditor will extend

credit if the consumer meets the specified pre-selection criteria

(see, for example, Gelman v. State Farm Mut. Auto. Ins. Co., 583

F.3d 187, 194-95 (3d Cir. 2009); Poehl v. Countrywide Home

Loans, Inc., 528 F.3d 1093, 1097-98 (8th Cir. 2008)).

Although the FCRA does not expressly require firm offers to

exceed a certain amount of credit, a firm offer must provide

sufficient value to be a legitimate credit product, not just a guise

for solicitation (see Cole v. U.S. Capital, Inc., 389 F.3d 719, 728

(7th Cir. 2004)).

Employment Matters

With the consumer’s consent, a CRA may provide a consumer

report for certain employment purposes, including evaluating

the consumer for employment, promotion, reassignment, or

retention. The user, typically an employer or a background check

provider, must certify to the CRA that:

 It has informed the consumer that a consumer report will be

obtained in connection with the employment matter.

 The consumer has provided written authorization for the

disclosure of the report.

 A copy of the report will be given to the consumer if any

adverse action is taken in reliance on the report.

(See 15 U.S.C. §§ 1681b(a)(3)(B), (b), 1681a(h); see, for example,

Miller v. Johnson & Johnson, 80 F. Supp. 3d 1284, 1295-96

(M.D. Fla. 2015) (holding that an employer violated the FCRA

by failing to provide the plaintiff with pre-adverse action notice

before rescinding an employment offer).)

Subject to a limited exception, the initial notice to a consumer

must be:

 Clear and conspicuous.

 In writing.

 In a document that consists solely of the notice.

 Delivered before the consumer’s report “is procured.”

(15 U.S.C. § 1681b(b)(2)(A).)

The Journal | Litigation | April/May 2016

Courts have looked to the Uniform Commercial Code and the

Truth in Lending Act for guidance when determining what

constitutes a “clear and conspicuous” notice (see, for example,

Cole v. U.S. Capital, Inc., 389 F.3d 719, 730-31 (7th Cir. 2004)).

Some courts have held that the notice may not include any

material other than the formal request for the consumer’s

consent (see, for example, Milbourne v. JRK Residential Am.,

LLC, 92 F. Supp. 3d 425, 433 (E.D. Va. 2015)). Other courts have

permitted the document to contain other material so long as the

notice remains clear and conspicuous (see, for example, Burghy

v. Dayton Racquet Club, Inc., 695 F. Supp. 2d 689, 698-700 (S.D.

Ohio 2010)).

Search Fair Credit Reporting Act (FCRA) Adverse Action Notification

Letter for a sample letter to send to job applicants not selected for a

position because of information contained in their consumer reports,

with explanatory notes and drafting tips.

Search Fair Credit Reporting Act (FCRA) Disclosure and Authorization

for Background Checks for a sample background check consent

form serving as a disclosure and authorization that an employer can

provide to job applicants and employees before seeking a consumer

report, with explanatory notes and drafting tips.

Credit Transactions

A CRA may issue a consumer report to a party that, the

agency has reason to believe, intends to use the information in

connection with:

 The extension of credit to the consumer.

 Review or collection of the consumer’s credit account.

(15 U.S.C. § 1681b(a)(3)(A); see, for example, Huertas v. Galaxy

Asset Mgmt., 641 F.3d 28, 34 (3d Cir. 2011) (holding that a

debt collector obtained the plaintiff’s credit information for

a permissible purpose under the FCRA where the plaintiff’s

accumulation of credit card debt caused the debt collector to

access the plaintiff’s credit report and collect on the debt).)

In these cases, some courts have held that the consumer report

must be used in connection with either:

 A transaction or debt that the consumer sought out or initiated.

 A debt that has been confirmed by a court.

(See, for example, Pintos, 605 F.3d at 674-75; Stergiopoulos v.

First Midwest Bancorp, Inc., 427 F.3d 1043, 1048 (7th Cir. 2005).)

However, other judges have argued that this purpose also may

apply to reports used in connection with involuntarily incurred

debts (see Pintos, 605 F.3d at 670-72 (Kozinski, J., dissenting

from denial of rehearing en banc)).

Other Legitimate Business Needs

The catchall provision contained in Section 1681b(a)(3)(F)

contemplates disclosing a consumer report where the user

articulates a legitimate business need for the information in

connection with either:

 A business transaction that is initiated by the consumer,

such as a transaction relating to credit, insurance eligibility,

employment, or licensing.

 A review of a consumer’s account to determine whether the

consumer continues to meet the terms of the account.

(See Houghton v. New Jersey Mfrs. Ins. Co., 795 F.2d 1144, 1149-51

(3d Cir. 1986); Scott v. Real Estate Fin. Grp., 956 F. Supp. 375,

382 (E.D.N.Y. 1997).) Courts have construed this provision

narrowly to require the request for a consumer’s report to be,

“as a practical matter,” “part of the transaction” the consumer

initiated (Smith v. Bob Smith Chevrolet, Inc., 275 F. Supp. 2d 808,

819 (W.D. Ky. 2003)).

A CRA may permissibly provide information about a

consumer’s spouse if the information bears on the consumer’s

creditworthiness or credit standing, such as where:

 The spouse will use the account or be contractually liable for

the account.

 The applicant relies on the spouse’s income or is acting as the

spouse’s agent.

(See, for example, Short v. Allstate Credit Bureau, 370 F. Supp. 2d

1173, 1179-80 (M.D. Ala. 2005).)

COMMON DEFENSES TO FCRA CLAIMS

A defendant in an FCRA action may assert defenses based on

statutory requirements that a plaintiff must satisfy to establish

liability. For example, a defendant can point to the failure of

proof relating to:

 Accuracy.

 Reasonableness.

 Causation.

Courts have looked to the Uniform Commercial Code and

the Truth in Lending Act for guidance when determining

what constitutes a “clear and conspicuous” notice.

April/May 2016 | Practical Law

These defenses also may serve as grounds for dismissal under

Federal Rule of Civil Procedure (FRCP) 12(b)(6) or a motion for

summary judgment under FRCP 56.

In addition to attacks on failures of proof, common defenses include:

 Expiration of the statute of limitations.

 Lack of actual injury and constitutional standing.

STATUTE OF LIMITATIONS

A plaintiff must bring an FCRA claim within the earlier of either:

 Two years after the plaintiff discovers the violation.

 Five years after the violation occurred.

(15 U.S.C. § 1681p.) Republication of information in a consumer

report does not constitute a new violation giving rising to a

new cause of action (see, for example, Bermudez v. Equifax Info.

Servs., LLC, 2008 WL 5235161, at *2 (M.D. Fla. Dec. 15, 2008)).

The shorter two-year limitations period begins to run when the

plaintiff discovers the facts giving rise to a claim, rather than

when he discovers that those facts constitute a legal violation

(see Mack v. Equable Ascent Fin., L.L.C., 748 F.3d 663, 665-66

(5th Cir. 2014)). The limitations period will run once a plaintiff

has even inquiry notice of the violation, meaning that the

plaintiff has information of sufficient specificity from which he

could have learned of the violation (see Willey v. J.P. Morgan

Chase, N.A., 2009 WL 1938987, at *5-7 (S.D.N.Y. July 7, 2009)).

Although events outside the statute of limitations cannot

form the basis of a plaintiff’s claim, those events still can be

relevant and used, for example, to demonstrate negligence or

willfulness (see Lazar v. Trans Union LLC, 195 F.R.D. 665, 671

(C.D. Cal. 2000)).

ACTUAL INJURY AND CONSTITUTIONAL STANDING

The FCRA explicitly requires a plaintiff claiming negligence

liability to establish that he suffered an actual injury (15 U.S.C. §

1681o(a)(1); see, for example, Crabill, 259 F.3d at 665).

The FCRA permits a plaintiff claiming willfulness liability to seek

only statutory damages (15 U.S.C. § 1681n(a)(1)). The federal

circuit courts are split on whether this type of plaintiff must

additionally prove an actual injury, and on what constitutes

such an injury, to establish Article III standing (compare Robins

v. Spokeo, Inc., 742 F.3d 409, 412-14 (9th Cir. 2014) (no injury

required) and Beaudry v. TeleCheck Servs., Inc., 579 F.3d 702,

705-07 (6th Cir. 2009) (same) with David v. Alphin, 704 F.3d

327, 338-39 (4th Cir. 2013) (requiring actual injury for Article

III standing in an ERISA case) and Kendall v. Emps. Ret. Plan of

Avon Prods., 561 F.3d 112, 121 (2d Cir. 2009) (same)).

The Supreme Court granted certiorari on this question in Spokeo,

Inc. v. Robins. At issue in Spokeo is whether a plaintiff has

Article III standing where he can demonstrate a willful statutory

violation under the FCRA but has not suffered a concrete injury.

(No. 13-1339, 2014 WL 1802228, at *I (U.S. May 1, 2014).) The

Supreme Court’s decision could have a significant impact on the

defenses available in FCRA litigation where the plaintiff has not

suffered a tangible injury or incurred any damages.

Consumers commonly bring FCRA claims as

class actions under FRCP 23(b)(3). Putative class

representatives often pursue only willful violations of

the FCRA to recover statutory damages. This tactic

avoids the need for individualized assessments of

damages, which often prompt commonality and

typicality challenges to class certification.

By seeking only statutory damages, however, class

representatives might be exposed to an argument

that they lack an actual injury and therefore lack

Article III standing. The Supreme Court’s decision

in Spokeo may bear significantly on this issue (see

Actual Injury and Constitutional Standing).

Search Class Action Toolkit for a collection of resources

designed to assist counsel with class action procedure,

requirements, and practice in federal court.

Special Considerations for

FCRA Class Actions

The Journal | Litigation | April/May 2016

services is subject to the Terms of Use (http://us.practicallaw.com/2-383-6690)

and Privacy Policy (http://us.practicallaw.com/8-383-6692).