|
Federal Fair Credit Reporting Act (as amended by the Consumer Credit Reporting
Reform Act of 1996)
Although the FCRA primarily regulates the operations of consumer credit
reporting agencies, it also affects you as a user of information.
We have included a copy of the FCRA with your membership kit. We
suggest that you and your employees become familiar with the following
sections
in particular:
604. Permissible Purposes of Reports
607. Compliance Procedures
615. Requirement on users of consumer reports
616. Civil liability for willful noncompliance
617. Civil liability for negligent noncompliance
619. Obtaining information under false pretenses
621. Administrative Enforcement
623. Responsibilities of Furnishers of Information to Consumer Reporting
Agencies
Each of these sections is of direct consequence to users who obtain
reports on consumers.
As directed by the law, credit reports may be issued only if they
are to be used for extending credit, review or collection of an
account, employment purposes, underwriting insurance or in connection
with some
other legitimate business transaction such as in investment, partnership,
etc. It is imperative that you identify each request for a report
to be used for employment purposes when such report is ordered.
Additional
state laws may also impact your usage of reports for employment
purposes.
We strongly endorse the letter and spirit of the Federal Fair Credit
Reporting Act. We believe that this law and similar state laws
recognize and preserve the delicate balance between the rights
of the consumer
and the legitimate needs of commerce.
In addition to the Federal Fair Credit Reporting Act, other federal
and state Laws addressing such topics as computer crime and
unauthorized access to protected databases have also been enacted.
As a prospective
user of consumer reports, we expect that you and your staff
will comply with all relevant federal statutes and the statutes
and
regulations of the states in which you operate.
We support consumer reporting legislation that will assure
fair and equitable treatment for all consumers and users
of credit information.
Access Security Requirements
Recognizing our obligation to fully support and implement policies,
which protect the confidential nature of the information in our database
and assure respect for consumer’s rights to privacy. Only those
companies with approved members of our service and have permissible
purpose for
obtaining credit reports are permitted access to credit information.
It is a requirement
that all end users take precautions to secure any system or device
used to access consumer credit information.
To that end, the following requirements have been established:
Your account number and password must be protected in such a way
that this sensitive information is known only to key personnel.
Under no circumstances should unauthorized persons have knowledge
of your password. The information should not be posted
in any manner within your facility. Any system access software
you may use, whether
developed by your company or purchased from a third party vendor,
must have your
account number and password “hidden” or embedded so that
the password is known only to supervisory personnel. Each user
of your system access software must then be assigned unique logon
passwords.
Your account number and passwords are not to be discussed by telephone
to any unknown caller, even if the caller claims to be an employee.
The ability to obtain credit information must be restricted to
a few key personnel. Any terminal device used to obtain credit
information should be placed in a secure location within your facility.
Access
to the devices should be difficult for unauthorized persons. Any
devices/systems used to obtain consumer reports should be turned
off
and locked after normal business hours, when unattended by your
key personnel. Hard copies and electronic files of consumer reports
are
to be secured within your facility and protected against release
or disclosure to unauthorized persons. Hard copy consumer reports
are
to be shredded or destroyed, rendered unreadable, when no longer
needed and when it is permitted to do so by applicable regulation(s).
Electronic
files containing consumer report data and/or information will be
completely erased or rendered unreadable when no longer needed
and when destruction
is permitted by applicable regulation(s). “Any person who knowingly
and willfully obtains information on a consumer from a consumer
reporting agency under false pretenses shall be fined not more
than $5,000 or
imprisoned not more than one year, or both.”
Federal Fair Credit Reporting Act (15 USC § 1681q)
|