§1681e Compliance procedures

Summary

Consumer reporting agencies must have and follow reasonable procedures to avoid the limits in section 1681c and to only give reports for the purposes allowed in section 1681b. They must make users identify themselves, say why they want a report, and promise not to use it for other reasons. Agencies should try to verify new users before sending a report. If an agency has good reason to believe a report would be used for an unallowed purpose, it must not send it. Agencies must also try to keep the information in reports as accurate as possible. If a business takes adverse action because of a report, the report user cannot stop that business from showing the report to the consumer. Agencies must give certain notices to people who supply them data and to people who receive reports. The Consumer Financial Protection Bureau decides what those notices should say, and a similar notice counts as compliant. Anyone who buys reports to resell them must tell the original agency who the final user is and the legal reason the end user needs the report. Resellers must have procedures to make sure reports are only resold for allowed purposes, require downstream users to identify and certify their end users and uses, and verify those statements. An exception lets resellers withhold an end-user’s identity when the end user is a U.S. agency checking eligibility for classified access and certifies nondisclosure is needed to protect classified information or safety.