Privacy Laws and Issues

Fair Credit Reporting Act (FCRA)
15 USC §§1681-1681u

Appendix A to Part 601

A Summary of Your Rights
Under the Fair Credit Reporting Act

The federal Fair Credit Reporting Act (FCRA) is designed to promote accuracy, fairness, and privacy of information in the files of every "consumer reporting agency" (CRA). Most CRAs are credit bureaus that gather and sell information about you -- such as if you pay your bills on time or have filed bankruptcy -- to creditors, employers, landlords, and other businesses. You can find the complete text of the FCRA, 15 U.S.C. §§1681-1681u, at the Federal Trade Commission's web site (http://www.ftc.gov). The FCRA gives you specific rights, as outlined below. You may have additional rights under state law. You may contact a state or local consumer protection agency or a state attorney general to learn those rights.

• You must be told if information in your file has been used against you. Anyone who uses information from a CRA to take action against you -- such as denying an application for credit, insurance, or employment -- must tell you, and give you the name, address, and phone number of the CRA that provided the consumer report.

• You can find out what is in your file. At your request, a CRA must give you the information in your file, and a list of everyone who has requested it recently. There is no charge for the report if a person has taken action against you because of information supplied by the CRA, if you request the report within 60 days of receiving notice of the action. You also are entitled to one free report every twelve months upon request if you certify that (1) you are unemployed and plan to seek employment within 60 days, (2) you are on welfare, or (3) your report is inaccurate due to fraud. Otherwise, a CRA may charge you up to eight dollars.

• You can dispute inaccurate information with the CRA. If you tell a CRA that your file contains inaccurate information, the CRA must investigate the items (usually within 30 days) by presenting to its information source all relevant evidence you submit, unless your dispute is frivolous. The source must review your evidence and report its findings to the CRA. (The source also must advise national CRAs -- to which it has provided the data -- of any error.) The CRA must give you a written report of the investigation, and a copy of your report if the investigation results in any change. If the CRA's investigation does not resolve the dispute, you may add a brief statement to your file. The CRA must normally include a summary of your statement in future reports. If an item is deleted or a dispute statement is filed, you may ask that anyone who has recently received your report be notified of the change.

• Inaccurate information must be corrected or deleted. A CRA must remove or correct inaccurate or unverified information from its files, usually within 30 days after you dispute it. However, the CRA is not required to remove accurate data from your file unless it is outdated (as described below) or cannot be verified. If your dispute results in any change to your report, the CRA cannot reinsert into your file a disputed item unless the information source verifies its accuracy and completeness. In addition, the CRA must give you a written notice telling you it has reinserted the item. The notice must include the name, address and phone number of the information source.

• You can dispute inaccurate items with the source of the information. If you tell anyone -- such as a creditor who reports to a CRA -- that you dispute an item, they may not then report the information to a CRA without including a notice of your dispute. In addition, once you've notified the source of the error in writing, it may not continue to report the information if it is, in fact, an error.

• Outdated information may not be reported. In most cases, a CRA may not report negative information that is more than seven years old; ten years for bankruptcies.

• Access to your file is limited. A CRA may provide information about you only to persons with a need recognized by the FCRA -- usually to consider an application with a creditor, insurer, employer, landlord, or other business.

• Your consent is required for reports that are provided to employers, or reports that contain medical information. A CRA may not give out information about you to your employer, or prospective employer, without your written consent. A CRA may not report medical information about you to creditors, insurers, or employers without your permission.

• You may choose to exclude your name from CRA lists for unsolicited credit and insurance offers. Creditors and insurers may use file information as the basis for sending you unsolicited offers of credit or insurance. Such offers must include a toll-free phone number for you to call if you want your name and address removed from future lists. If you call, you must be kept off the lists for two years. If you request, complete, and return the CRA form provided for this purpose, you must be taken off the lists indefinitely.

• You may seek damages from violators. If a CRA, a user or (in some cases) a provider of CRA data, violates the FCRA, you may sue them in state or federal court.

The FCRA gives several different federal agencies authority to enforce the FCRA:

Freedom Of Information Act (FOIA)  
5 USC §552 (1966)  

Section 552 (a) of FOIA directs government agencies to disclose certain types of records and describes the manner of disclosure required.

Subsection (a) (1) lists records that must be published in the Federal Register. These include -

• Description of the agency's organizational structure - central office and field offices

• Description of the procedures that are set up to give the public access to the agency records - including where the records are located and the name of the custodian of the records

• General description of how the agency functions and its decision-making process

• The agency's rules of procedure - including a description of agency forms and where you can get them

• The agency's general policies

Subsection (1) (2) lists records that must be made available for public inspection and copying-

• Final decisions in particular administrative cases

• Policy statements that the agency uses, but hasn't published in the Federal Register

• Internal manuals written for the agency's staff that affect members of the public

• An index of the kinds of information that must be made public

Subsection (1) (3) contains a catch-all provision requiring disclosure of records not covered by (a) (1) or (a) (2). Courts have held that these provisions are to be interpreted broadly to achieve Congress' goal of full disclosure.

Two basic types of information are available under FOIA. First, you can get information about how the agency operates, what actions it has been taking, how it has been spending its money, and what statistics and other information it has collected on any subject. Citizens routinely request and receive records relating to public health, environmental hazards, consumer product safety, government spending, labor relations, business decisions, taxes, history, foreign policy, national defense and the economy.

The second type of information that citizens often request is any records that the government has about them.

Any Person Can Make A FOIA Request

The FOIA permits "any person" to request access to agency records. "Any person" includes -

• U.S. citizens

• Permanent resident aliens

• Foreign nationals

• Corporations and unincorporated associations

• Universities

• State and local governments and members of Congress

The Freedom of Information Act (FOIA) establishes a presumption that records in the possession of agencies and departments of the Executive Branch of the United States government are accessible to the person. This was not always the approach to federal information disclosure policy. Before enactment of the FOIA in 1966, the burden was on the individual to establish a right to examine these government records. There were no statutory guidelines or procedures to help a person seeking information. There were no judicial remedies for those denied access. With the passage of the FOIA, the burden of proof shifted from the individual to the government. Those seeking information are no longer required to show a need for information. Instead, the "need to know" standard has been replaced by a "right to know" doctrine. The government now has to justify the need for secrecy. The FOIA sets standards for determining which records must be disclosed and which records can be withheld. The law also provides administrative and judicial remedies for those denied access to records. Above all, the statute requires federal agencies to provide the fullest possible disclosure of information to the public.

Full text of 5 USC §552 (1966)- (FOIA) and amendments (as of 1/2/91)can be obtained from the Computer Professionals for Social Responsibility site, http://www.cpsr.org/cpsr/foia/us_foia_act.txt.

back to top

Privacy Act Of 1974 
5 USC §552A (1974)  

The Privacy Act of 1974 is a companion to the FOIA. The Privacy Act regulates federal government agency record keeping and disclosure practices. The Act allows most individuals to seek access to federal agency records about themselves.

The Act requires that personal information in agency files be accurate, complete, relevant, and timely. The subject of a record may challenge the accuracy of information. The Act requires that agencies obtain information directly from the subject of the record and that information gathered for one purpose not be used for another purpose.

As with the FOIA, the Privacy Act provides civil remedies for individuals whose rights have been violated. Another important feature of the Privacy Act is the requirement that each federal agency publish a description of each system of records maintained by the agency that contains personal information. This prevents agencies from keeping secret records. The Privacy Act also restricts the disclosure of personally identifiable information by federal agencies. Together with the FOIA, the Privacy Act permits disclosure of most personal files to the individual who is the subject of the files. The two laws restrict disclosure of personal information to others when disclosure would violate privacy interests.

Full text of 5 USC §552 (1966)- (FOIA) and amendments (as of 1/2/91)can be obtained from the Computer Professionals for Social Responsibility site, http://www.cpsr.org/cpsr/privacy/ssn/privacy_act_1974.txt.

back to top

Try one of our most popular products:

     Background
Check    

People
Search