Credit Scores and Credit Reports, by Evan Hendricks

Chapter 21

The 2003 FACTA Battle

"Politics isn't everything, but everything is politics."

— James R. Klonoski
Professor Emeritus, Political Science
University of Oregon

For close followers of the Fair Credit Reporting Act, 2003 was both an unusual and exciting year.

It was unusual in the sense that the "opposing sides"-the financial services industry and the consumer privacy groups-both wanted legislation.

To the financial services industry, legislation was a top priority because key provisions of the FCRA which preempted State law were set to expire on December 31, 2003. These provisions dealt with issues affecting billions of dollars in commerce: pre-approved credit card offers, duties on creditors (furnishers) to report accurately and to reinvestigate, and the sharing of personal data among corporate affiliates. Industry expressed fears that if legislation was not passed and the preemption expired, state legislatures would begin passing conflicting laws that would raise compliance costs, and worse, interfere with profits.

To the consumer and privacy groups, legislation was long overdue because the 1996 FCRA Amendments were not getting the job done. All of the long-standing problems related to privacy and fair information practices persisted: inaccuracy, faulty reinvestigations, reinsertion, non-responsiveness, and lax security. More dramatically, identity theft had been crowned the nation's "fastest growing crime," and the biggest harm from identity theft, everyone knew, was to the privacy of credit reports. Citing Congress' slow and feeble response to identity theft, as well as the admirable work of states like California, the consumer privacy forces favored letting the FCRA's preemption expire and expanding the role of the states in protecting consumers.

Both sides wanted legislation, but not the same legislation. Industry wanted a simple, straightforward bill that would do nothing more than make FCRA preemption permanent.

Consumer privacy groups called for a detailed reform bill that would set a "floor" of new protections, but which would leave the states free to go further.

The game was on.

The Drama Builds

The scene was unusual in another sense: the burden was on industry to push legislation through Congress before preemption expired on December 31, 2003. Everyone knew it was much harder to pass legislation, than to stop it.

Adding to the drama was the new committee lineup, due to the Republicans' regaining control of the Senate after the 2002 elections. Senator Richard Shelby (R-AL) for the first time became chairman of the Senate Banking Committee, through which any FCRA legislation had to pass. His predecessor, Senator Paul Sarbanes of Maryland, in turn became the Ranking Democrat.

Together, Shelby and Sarbanes were two of the Senate's biggest privacy advocates, particularly on financial issues. In years past, Shelby had been responsible for landmark privacy legislation requiring that state motor vehicles departments stop selling drivers' data to the direct marketing industry without first obtaining consent. He also was the first Senator to sponsor opt-in legislation for customer data held by financial conglomerates.

Sarbanes also had an impressive track record. Like Shelby, he was an early sponsor of financial privacy legislation that went beyond the much-criticized Gramm-Leach-Bliley Act (GLB). And, he was responsible for the "Sarbanes Amendment" to GLB, which reserved the rights of states to pass stronger financial privacy laws.

At an September 19, 2002 Senate hearing, Sarbanes and Shelby warned representatives of the financial industry that American consumers overwhelmingly favored stronger privacy safeguards and one day would prevail. Sarbanes likened the situation to the corporate neglect and wrongdoing that resulted in a series of accounting scandals, and the landmark Sarbanes-Oxley Law. He called on the industry to cooperate in creating a stronger financial privacy law. He also took issue with Fred Cate, a pro-industry, University of Indiana Law Professor, calling his argument against opt-in legislation "disingenuous."³⁵³

The financial services industry looked to Rep. Michael Oxley (R-OH), chairman of the House Financial Services Committee, to put a pro-industry preemption bill on the "fast track." But after the highly publicized corporate accounting scandals, Oxley demonstrated his ability to work with Sarbanes and other Democrats to fashion a publicly popular legislative solution.

Moreover, a Congressional aide to Oxley told an industry gathering that the price of extending FCRA preemption would be "very high," meaning that industry would have to agree to pro-consumer provisions.

"Industry described a failure to extend preemption as 'death,' and described making preemption permanent as 'everlasting life,'" said a Congressional source, looking back on the year. "Well, you don't get everlasting life for cheap."

³⁵³ "Financial Privacy and Consumer Protection," Hearing of the Senate Committee on Banking, Housing, and Urban Affairs, September 19, 2002

These comments framed the debate, and foreshadowed the outcome. In hindsight, as it turned out, there was never much question that Congress was going to extend preemption. It was also obvious that the FCRA was in need of another major upgrade.

Still, at the time, any such outcome was very much in doubt. In January 2003, the stage was set for a very interesting legislative battle.

Industry Makes Its Move

Industry knew it had no time to waste. It called out its "top guns." On January 8, 2003, the corporate-sponsored³⁵⁴ AEI-Brookings Joint Center For Regulatory Studies held a one-day discussion about the FCRA and preemption. Presiding over the affair were "the cream" of unabashed, pro-industry, anti-privacy academics: University of Indiana Law Professor Fred Cate³⁵⁵; Michael Staten³⁵⁶, a Georgetown University Business School Professor, and Robert Litan³⁵⁷, of the Brookings Institution.

A short time after, the team not surprisingly published a report³⁵⁸ concluding that the FCRA struck the right balance and that there was insufficient evidence of harm to consumers to upset that balance.

³⁵⁴ "Donors" to the AEI-Brookings Center include, Allstate. Arthur Andersen, AT&T, Cigna, Citigroup, Property and Casualty CEO Roundtable, State Farm and Visa USA
³⁵⁵ For Cate's bio and writings, see http://www.law.indiana.edu/directory/fcate.asp
³⁵⁶ Staten also is director of the Credit Research Center at the Georgetown's McDonough School of Business; his FCRA testimony is at http://financialservices.house.gov/media/pdf/050803ms.pdf
³⁵⁷ Litan's bio is at http://www.brook.edu/scholars/rlitan.htm; in a previous work, Litan co-authored an attack on the European Union's Directive on Data Protection. See Swire and Litan, "None of Your Business," Brooking Institution, 1998
³⁵⁸ "Financial Privacy, Consumer Prosperity, and the Public Good: Maintaining the Balance." www.aei-brookings.org/wnew/index.php?menuid=2

Of course, this supported the industry view that Congress should merely extend preemption and not bother with additional consumer protections. The authors disregarded specific evidence of harm to consumers (starting with identity theft and inaccuracy). The paper was consistent with a pattern of industry-funded papers arguing that consumers' best interests are best served when industry gets its way.

Robert Gellman, a privacy consultant and former House staffer, called the AEI-Brookings Paper "shockingly incompetent."

"I found an incorrect citation. The paper describes key provisions of the FCRA, but it only represents the law as it passed originally in 1970, with no acknowledgment of later amendments. It keeps citing the views of privacy advocates, but doesn't name them or cite to their publications. Nobody is perfect, but the paper looks like a slapdash job that no one reviewed with any care," Gellman wrote.³⁵⁹

The Ad Campaign

In March, a newly formed industry coalition continued to turn up the heat on Congress by launching a Washington-based radio, newspaper, and subway poster advertisement campaign in support of legislation to reauthorize preemption under the FCRA. It may have been the first time that industry had undertaken such measures in regards to a federal privacy law.³⁶⁰

³⁵⁹ Gellman, Robert, "No Fair Fight Over FCRA Provision," DM News, May 6, 2003 http://dmnews.com/cgi-bin/artprevbot.cgi?article_id=23811&dest=article
³⁶⁰ However, in North Dakota in 2001, the industry spent over $150,000 in ads against a ballot initiative for an opt-in financial privacy law. The ads predicted economic doom for the state if the voters approved the initiative. The privacy law won 72 percent to 27 percent.

The radio ads, running on WTOP, the news radio station in Washington, warned that if Congress failed to "protect the national consumer credit system," consumers would find that the process of applying for credit will slow to a standstill. As the ad's narrator explained this, his voice slowed until it stopped, much like a defective recording. The ad never mentioned the FCRA by name. The industry also took out ads in Roll Call, a newspaper read widely in Congress.

The campaign was funded by "The Partnership to Protect Consumer Credit," whose members included Fannie Mae, the National Retail Federation, the Consumer Banker's Association, the American Financial Services Association, Capital One, Consumer Data Industry Association, Citigroup, Household International, JP Morgan Chase, MasterCard, MBNA, and Morgan Stanley-Discover Financial Services. The net worth of these member companies easily ran in the billions of dollars.³⁶¹

"Unless Congress renews important Fair Credit Reporting Act provisions, the national credit system would be replaced by dozens of inconsistent state and local laws complicating the credit process for consumers and businesses, while hindering important identity theft and fraud protections," the group said on its Web site.³⁶²

Between the associations and all the banks, credit bureaus, insurers, and retailers, dozens upon dozens of well-heeled lobbyists were dispatched to Capitol Hill. Before the hearings had even started, many Members of Congress had heard first-hand that the entire financial services industry wanted prompt re-authorization of the FCRA's preemption of state law.

³⁶¹ www.protectconsumercredit.com
³⁶² Id.

The Consumer-Privacy Side

On the other side, those favoring stronger consumer protection and expansion of the state role included the U.S. Public Interest Research Group,³⁶³ the Consumer Federation of America,³⁶⁴ and Consumers Union,³⁶⁵ which is publisher of the popular magazine Consumer Reports, the National Consumer Law Center;³⁶⁶ and the National Association of Consumer Advocates.³⁶⁷

Aligned with these groups was the National Association of Attorneys General (NAAG),³⁶⁸ representing state Attorneys General. Supporting roles were played by the Electronic Privacy Information Center, a well-respected organization based in Washington, D.C.,³⁶⁹ the Identity Theft Resource Center, the American Association for Retired People (AARP), and a handful of other groups and individuals with expertise in privacy, credit reporting, and/or identity theft.³⁷⁰

The House Goes First

It is customary for Congressional committees to hold public hearings before voting on legislation. Sometimes the committee members already know how they will vote and the hearings are just a formality. But sometimes the testimony can actually have an impact.

³⁶³ Led by Consumer Programs Director Ed Mierzwinski
³⁶⁴ Exec. Director Stephen Brobeck, Legislative Affairs Dir. Travis Plunkett, and Housing Director Brad Scriber
³⁶⁵ Janell Mayo Duncan, Consumers Union legislative counsel; Shelley Curran, Policy Analyst, CU West Coast Regional Office; Gail Hillebrand, Senior Attorney, CU West Coast Regional Office; Ami Ghadia, Esther Peterson Fellow, CU Washington Office.
³⁶⁶ Margot Saunders and Anthony Rodriguez
³⁶⁷ Exec. Director Ira Rheingold and Newport News, Virg. attorney Leonard Bennett
³⁶⁸ Led by Julie Brill, an Assistant AG of Vermont, and Susan Henrichsen, Asst. AG of California
³⁶⁹ www.epic.org/privacy/fcra
³⁷⁰ Prof. Joel Reidenberg, of Fordham Law School, Prof. Peter Swire, Ohio State Univ. Law School and former senior privacy counselor of the Clinton Administration, and this author.

A subcommittee³⁷¹ of the House Financial Services Committee opened hearings on May 8, 2003. The title of the hearing, "The Importance of the National Credit Reporting System to Consumers and the U.S. Economy," reflected the committee's pro-industry stance. The opening statement of Subcommittee Chairman Spencer Bachus reflected the pro-industry conclusions of the AEI-Brookings report:

"We will hear in detail today how our uniform credit system under the FCRA benefits consumers and the economy as a whole. Among the consumer benefits afforded by our national credit system are efficient and convenient access to credit and insurance, strong competition in the financial services marketplace, and lower costs of credit."³⁷²

The Republicans had the votes in the committee. The financial industry lobbyists had blanketed the Hill. Senator Tim Johnson (D-SD) and Rep. Patrick Tiberi (R-OH) had both introduced bills that would make preemption permanent and which were silent on consumer protection.³⁷³ Everything seemed set for smooth sailing. Even Federal Reserve Board Chairman Alan Greenspan heartily endorsed keeping pre-emption of state law.³⁷⁴

³⁷¹ Subcommittee on Financial Institutions and Consumer Credit
³⁷² Opening Statement of Chairman Spencer Bachus, "The Importance of the National Credit Reporting System to Consumers and the U.S. Economy," May 8, 2003.
³⁷³ No senator agreed to co-sponsor Johnson's bill. In praising the credit card industry at a June hearing, Tiberi said his father was an immigrant who used his credit card to buy everything and received cash back at the end of the year.
³⁷⁴ Blackwell, Rob; "Greenspan Is 1st Regulator To Endorse FCRA Extension," The American Banker; February 13, 2003. Actually, Greenspan was quite vague, stating, "The system cannot function without ... the credit histories of individual borrowers," he said. "I should certainly hope that it is maintained." He did not address accuracy and reliability problems, even though his own researchers had found such problems. (See Footnote 27, Chapter 10 on history)

There was one problem. At the opening hearing, Assistant Treasury Secretary Wayne Abernathy stunned many Republicans when he testified that the Bush Administration had not yet finalized its position on the FCRA. Therefore, he said, he could not even say whether the Administration supported extension of the law's preemption provision, or whether new safeguards were needed to help consumers fight against identity theft.³⁷⁵

What happened? According to sources, "political higher ups" in the White House discovered through their polling data that the vast majority of Americans cared strongly about such issues as financial privacy, credit report accuracy, and identity theft. The polling data indicated it actually could be risky to endorse industry's wish for preemption without due consideration for consumers' interest. In other words, the Bush Administration was still at the drawing board. It was clearly a setback for the industry's fast-track timetable.

Despite the Administration's reticence, Committee Chairman Michael Oxley (R-OH) left no doubt that the committee's priority was reauthorizing preemption. While acknowledging that the committee had many issues to explore, he declared: "At the end of the day, this committee will act and will pass legislation reauthorizing the FCRA. That is job No. 1."

But Rep. Bernie Sanders (I-VT), the Ranking Independent on the subcommittee, said that extensive inaccuracy in credit reports, coupled with growing identity theft, underscored the urgent need for stronger consumer protections. Sanders repeatedly said the place to start was "one free credit report per year." Vermont was one of the first states to have a law requiring one free credit report per year. Throughout the House's spring and summer hearings, Sanders continued to harangue committee members about the need for a federal right to a free credit report.

³⁷⁵ "Bush Admin. Still Formulating Position; Oxley Vows Action," Privacy Times, Vol. 23 No. 10, May 13, 2003

Challenging Dogma

At the early hearings, pro-consumer witnesses quickly challenged industry claims that state laws were bad for commerce, or even that there were uniform national standards. Fordham Law Professor Joel Reidenberg, an author and expert on privacy law, testified that three states with the strongest credit-reporting laws — Vermont, Massachusetts, and California — ranked 50th, 49th, and 27th in bankruptcies. Moreover, those three States offered the lowest interest rates.³⁷⁶

Vermont Asst. Attorney General Julie Brill displayed three common ads from Vermont newspapers showing that "zero percent financing and instant credit for mortgages, car loans, and personal loans were widely available in the state."³⁷⁷

As every pro-consumer witness pointed out, it had been the states, and not Congress, that had enacted the best financial privacy, credit reporting, and identity theft protection laws. Preemption would shut off the key source of pro-consumer solutions to real and ever-changing problems, they argued.

None of this testimony deterred industry witnesses and some House Republicans from droning on about the "uniform national standards" and the "miracle of instant credit" made possible by the federal FCRA. By early June, the Bush Administration still had not announced its position.

On June 11, Rep. Darlene Hooley (D-OR), long-time sponsor of identity theft legislation, upped the ante. Hooley, along with 11 other so-called "New Democrats," came out in support of reauthorizing preemption, provided four major conditions were met. In a letter to Committee Chairman Michael Oxley (R-OH), and ranking member Barney Frank (D-MA) Hooley and the New Dems said it was "imperative" that the legislation address problems that had arisen since the 1996 Amendments: (1) Identity theft and mitigation; (2) expeditious handling of consumer complaints and disputes; (3) greater accuracy in credit reports; and (4) consumers' access to their credit data.

³⁷⁶ Statement of Prof. Reidenberg, House hearing, May 8, 2003, op cit.
³⁷⁷ Statement of Julie Brill, "Fair Credit Reporting Act: How it Functions for Consumers and the Economy," Subcommittee on Financial Institutions and Consumer Credit, June 4, 2003

The Hooley letter was significant because it signaled to Oxley that it was possible to reauthorize preemption with a bipartisan bill, but only if badly needed consumer protections were part of the package.

'Crippling Effects'

It was also a great prelude to the House subcommittee's June 24 hearing on identity theft, when the panel finally heard two victims describe the emotional distress and frustration they experienced spending hour upon hour trying to repair their reputations and clean up their credit reports.

"It seems rather incomprehensible that our previously impeccable credit reports, which clearly showed wise and careful use of credit along with a stable twenty year residence history, now showed over twenty five unauthorized credit inquiries and six out-of-state address changes, all of which had been entered on our credit reports between September and November of 1999," testified Maureen V. Mitchell, of Madison, Ohio.³⁷⁸

Commander Franklin D. Mellott described how the CRAs' voluntary system for fraud alerts failed to work. "I am even more concerned for those 19-year-old soldiers, sailors, and their families that are so easily victimized by this crime. Imagine their spouses, new to the ways of the military, trying to balance the day-to-day challenges of a young family with the crippling effects of identity theft and mistakes by the credit industry.

³⁷⁸ Statement of Maureen V. Mitchell, "Fighting Identity Theft — The Role of the FCRA," Subcom. On Fin. Inst., June 24, 2003

Furthermore, I am concerned because I can see how it could be nearly impossible to fight these problems from overseas."³⁷⁹

The First Bill

At the end of June, Hooley and the New Dems joined forces with Oxley, Bachus, and other Republicans, in sponsoring a bill (HR 2622) to make permanent the FCRA's preemption of state law, to provide consumers with one free credit report, to require fraud alerts, and to add other provisions to protect against identity theft and improve credit report accuracy. Senator Shelby called the bill a "good start." But consumer privacy groups said it fell short on several fronts, especially by not placing stronger duties on creditors, who are often culprits in causing inaccuracies.

Muris Calls For More

At a packed July 9 hearing on HR 2622, FTC Chairman Timothy Muris and Treasury Secretary John Snow said the Bush Administration and the FTC agreed that preemption should be reauthorized, and that new consumer protections were necessary. The pair endorsed the call for one free credit report per year.

Muris went further. He said that the reinvestigation standards that applied to CRAs should be extended to creditors. The change was significant because generally, disputing errors directly with creditors did not trigger liability. Although many may not have realized it, the current law required consumers to route all disputes through credit bureaus before they could enforce their rights.

Moreover, Muris said a new "risk-based pricing notice" was needed so consumers would know when their credit reports caused them to lose out on favorable interest rates or insurance premiums. Under current law, adverse action notices were only required when a consumer was denied credit and did not accept any counter-offers. This "counter-offer loophole" allowed creditors to avoid giving adverse actions. In such cases, consumers were not told their credit reports were causing them to lose out.

³⁷⁹ Statement of Franklin D. Mellott, June 24, 2003. Mellott is the Military Victim Assistance Coordinator for the ID Theft Resource Center

Enter Barney Frank

Until 2003, Rep. John LaFalce, from upstate New York, had been the ranking Democrat on the House Financial Services Committee. LaFalce was seen as a strong privacy advocate, having sponsored legislation to strengthen financial privacy after Gramm-Leach-Bliley. In fact, LaFalce's involvement in privacy went way back to 1978, when he played a role in the enactment of the Right to Financial Privacy Act, which regulated law enforcement agents' access to bank records.

Upon LaFalce's retirement,³⁸⁰ Barney Frank assumed the position of the committee's Ranking Democrat. Frank was considered a pro-consumer, Massachusetts liberal, but most of his attention in the financial arena had been devoted to predatory lending, community reinvestment, and bankruptcy. At the outset of 2003, it was not clear how active he would be on FCRA and financial privacy. In the early FCRA hearings, the normally animated Frank was relatively subdued.

When Frank got his turn to speak at the packed July 9 hearing, he announced that he had taken advantage of the quiet July 4 holidays to read the mounds of FCRA written testimony of hearing witnesses. In a key moment of leadership, Frank said that HR 2622 did not adequately tackle the long-standing problems of credit report accuracy, or maintain the privacy of medical data. He noted that many of the reforms Congress made in 1996 had not even achieved their goal of improving CRA reinvestigations or reporting by creditors.

³⁸⁰ Despite LaFalce's retirement, some key staff members stayed on, and played an important role in ensuring that consumer voices were heard in the early hearings.

He also advised the financial industry and House Re-publicans that, given the fact that Shelby and Sarbanes had not committed to reauthorizing preemption, their chances of achieving that goal would be greatly enhanced if the committee would report out a more consumer-friendly bill that could win overwhelming approval on the House floor.

The Massachusetts Solution

Another unknown in 2003 was whether Oxley and Frank could work together. On some congressional committees, there can be an acrimonious relationship between the chairman and ranking member that hampers cooperation. Oxley and his staff were not sure what to expect from Frank.

But after the July 9 hearing, the two offices quickly began exploring a cooperative effort in an advance of a hastily scheduled July 14 mark-up. Their collaboration resulted in several improvements in the bill, the most important of which might have been a much needed strengthening of the duty on creditors to report information accurately in the first place.

The 1996 FCRA Amendments were the first to place any duties on furnishers, but they were extremely weak. As the 2003 testimony indicated, and Frank noted, they had proven ineffective. Essentially, the 1996 provisions only prevented a creditor from reporting data it "knows or consciously avoids knowing" is inaccurate. Moreover, the FCRA generally did not permit consumers to sue creditors that violated this provision. It was only if the consumer sent a dispute to the CRA, and the CRA relayed the dispute to the creditor, and the creditor continued to report the information inaccurately, did the consumer then have the right to sue the creditor under the FCRA. Not surprisingly, it often seemed that some creditors did not take their FCRA compliance duties too seriously.

Frank noticed that the Massachusetts FCRA had a more common standard: a furnisher could not report data that it "knows or has reasonable cause to believe" was inaccurate. No company had ever complained about the Massachusetts standard in the many years it had been on the book. Working with Oxley, Frank, and Rep. Carolyn McCarthy (D-NY) succeeded in adding it to the House bill. Other pro-consumer changes were made relating to identity theft prevention, risk-based pricing notices, and medical information. Several studies about accuracy and credit scoring were mandated. The studies were to be conducted by the General Accounting Office, a research arm of Congress, or by the FTC and federal banking regulatory agencies.

At a July 24 mark-up, the committee rejected an amendment to extend preemption for 10 years, rather than make it permanent. By a 44-22 vote, the panel defeated a proposal by Reps. Bachus and Sanders to bar credit card issuers from raising their customers' interest rates based upon their payment history with a different creditor.

The Oxley-Frank compromise was approved 61-3, with Sanders and Rep. Barbara Lee (D-CA) voting against it. They, like U.S. PIRG and several other consumer-privacy groups, felt the preemption of state law was not justified by the facts and that making it permanent was a clear case of overkill. On September 10, 2003, the bill passed on the House floor by a 392-30 vote.

Follow The Money

The growing list of consumer protections added to the House bill underscored the FCRA's importance to Americans. The result was somewhat impressive in light of the money and resources that the financial services industry poured into the legislative campaign.

Two of the leading groups were the Partnership to Protect Consumer Credit, which had sponsored the pro-preemption advertisement campaign, and Financial Services Coordinating Council, which represents the biggest of the big banks. In September 2003, the National Journal reported that members of these two groups alone had contributed nearly $500,000 to members of the Senate Banking Committee, and had given a combined total of nearly $25 million to candidates, leadership PACs, and parties. The numbers were based upon research by the Center for Responsive Politics.³⁸¹

The Senate Banking Committee

With Shelby and Sarbanes at the helm, the Senate Banking Committee was where the consumer privacy groups hoped to make even greater strides in advancing consumer protection, perhaps even limiting preemption rather than make it permanent. These hopes were boosted when Senators Charles Schumer (D-NY) and John Corzine (D-NJ) indicated they too would propose additional consumer protections for identity theft and accuracy.

But underneath this veneer was the reality that most of the members of the Senate Banking Committee were primarily friendly to banking interests. If push came to shove, the banking industry had the votes. This meant that the committee had some leeway to strengthen requirements on the credit reporting industry, but had to be cautious about reforms that might be perceived as too burdensome by the more powerful banking lobby.

Unlike his counterpart in the House, Shelby worked more deliberately. The Senate Banking Committee held its first "overview" hearing on June 19. He held a hearing on affiliate sharing later in June, and conducted hearings on identity theft, accuracy, and financial literacy in July.

The hearings built an impressive record, detailing the roots of such problems as credit report inaccuracy, CRA non-responsiveness, inadequate reinvestigations by creditors, identity theft, and the toll these problems take on consumers. They also revealed that the day-to-day operation of the credit reporting system was largely unregulated, or even unsupervised, by regulatory entities. In the early 1990s, the FTC had investigated the three CRAs and reached consent agreements with them that stayed in force for several years. Throughout the decade, the staff steadily turned out opinion letters in response to specific questions from industry. Another FTC enforcement action targeted the CRAs' failure to answer consumer phone calls.

³⁸¹ The report can be found at http://www.capitaleye.org

But for the core issues of accuracy, disclosure standards, data integrity and furnisher reporting, the players in the credit reporting system were pretty much left to their own devices as long as they were not caught violating the FCRA. Further, although there were plenty of anecdotes and a series of studies over the years, the committee said more information was needed on the operation of all aspects of the credit reporting system.

Shelby: More Oversight Needed

Considering the complexity of the system and continuous impact on consumers, Shelby felt that tightening rules and increasing federal oversight of the daily operations was vital to improving credit reporting accuracy, fairness and privacy.

Shelby's draft legislation, unveiled in the form of a 98-page proposal and summary in early September 2003, reflected his emphasis on ongoing oversight. It was officially silent on the issue of extending preemption, but it was no secret Shelby would agree to it if he thought sufficiently strong national standards were enacted.

Under the proposal, for example, the FTC would have to compile complaints about credit report inaccuracy or incompleteness, and track resolution of consumer complaints referred to the "Big Three" credit bureaus. It would also study the effects of credit bureaus' use of "partial matching" criteria.

The Shelby-Sarbanes bill proposed that the FTC, along with the Treasury Department and Federal Reserve Board, issue rules as to when credit grantors would have to provide "counter-offer" notices to consumers whose negative credit histories made them ineligible for the best terms and rates. Similarly, the FTC and banking agencies would have to develop guidelines and promulgate rules regarding the accuracy and completeness of data furnished to credit bureaus, as well as rules to ensure that users of credit reports maintain the accuracy of consumer addresses. The Federal Reserve Board would conduct a study on the accuracy of credit report data and its impact on credit eligibility. The FTC would set rules to enhance opt-out notices for pre-screening. Federal banking agencies and the FTC would jointly conduct regular studies of financial institutions' data-sharing practices.

Beyond studies and regulations, the Shelby-Sarbanes draft strengthened identity theft victims' rights to block credit bureau dissemination of fraud-generated data, barred creditors from furnishing fraud data after being notified by CRAs, and required creditors to investigate identity theft data after receiving disputes directly from consumers. The measure also would require mortgage lenders to provide consumers with copies of credit reports and credit scores, rather than force consumers to go back to the bureaus.

The Shelby-Sarbanes bill, coupled with changes proposed in the House bill, signaled that the FCRA was headed for a major revamp.

Affiliate Sharing

For consumer privacy groups, there was one major disappointment. But it was not strictly about credit reporting. Instead, it was about "affiliate sharing." That is, the sharing of personal data among affiliates of huge financial conglomerates, without consumers' consent. It was an issue with a great deal of recent history. The 1996 FCRA Amendments preempted state law on affiliate sharing, but many people thought it only applied to credit reports — not the customer "transaction and experience" data that banks generate separately.

In 1999, Congress was preparing to finish years of work and eliminate depression-era rules preventing banks from operating securities and insurance businesses. However, a few scandals about banks selling credit card numbers to telemarketers drove home the point that tighter privacy rules were necessary. Shelby was one of the first to propose legislation to require banks to get customers' opt-in consent before selling their data to outsiders, or sharing it among affiliates.

As is sometimes the case, Congress responded to Shelby's "Gold Standard" with the lowest common denominator: the right to opt-out from selling to outside third parties, but no required notice or choice for affiliate sharing. The law, known as the Gramm-Leach-Bliley Act (GLB), resulted in financial institutions sending confusing notices to customers about their "privacy" policies and opt-out rights.

For consumer privacy groups, one of the best aspects of GLB was the Sarbanes Amendment, explicitly allowing states to go further than the federal law to protect privacy.

Senator Jackie Speier

One of the first officials to answer the call was California State Senator Jackie Speier. A Bay area legislator, Speier had regularly championed consumer and women's issues, and did not shy away from a good fight. Nearly 25 years earlier as a Congressional aide, she accompanied her boss, Congressmen Leo Ryan, on an ill-fated trip to Guyana to visit the infamous cult leader Jim Jones. Ryan's Bay Area constituents were worried about family members who had joined the group, known as the People's Temple. Ryan's party was ambushed by Jones' followers. Ryan died in the gunfire. Speier took a couple of bullets, but survived.

Speier started with an opt-in bill. When California Governor Gray Davis said he could support the bill if it were changed to an opt-out for affiliate sharing, she modified it to win his support. But Davis eventually reneged on his word, and helped kill the bill in successive close votes. Coincidentally or not, Davis was receiving massive campaign contributions from the banks. The San Francisco Chronicle reported that the financial industry expenditures to defeat the Speier bill exceeded $20 million. Among the biggest spenders were Citigroup, which tallied $878,875 in expenses, the American Insurance Association, $310,662, and the giant credit card company, MBNA Corp., $500,871.³⁸²

The California Ballot Initiative

If Speier had hit a nerve, then Chris Larson, CEO of E-Loan, the online lender, struck the central nervous system when he announced in July 2002 he was donating $1 million to gather signatures for a ballot initiative to create a statewide, opt-in financial privacy law. Larson made his position clear: if the California Legislature was again unable to pass Speier's bill, the voters would create an even stricter law themselves.

Larson's confidence in part stemmed from North Dakota, which in 2001 held the nation's first-ever statewide ballot initiative on an opt-in financial privacy law. The financial industry spent over $150,000 in advertising money attempting to convince the voters that the measure would result in economic doom for North Dakota. Thanks to a grant from the American Civil Liberties Union, hard-working state activists³⁸³ were able to counter with $25,000 in radio ads. The privacy initiative won 72% to 27%.

³⁸² San Francisco Chronicle, September 7, 2002; a Chronicle analysis of spending reports filed with the secretary of state's office shows that corporations opposed to the measure spent more than $8.8 million on political contributions during the last 18 months and another $12 million on lobbyists and related costs.

Larson's confidence also stemmed from the fact that opinion polls consistently showed support for the opt-in initiative, running between 80 and 90%. By July of 2003, with only halting progress on the Speier bill and with the deadline approaching, supporters of the California initiative were preparing to turn in the signatures.

Industry finally blinked. After a final round of negotiations, Speier and California Senate President John Burton hammered out the bill that was approved by a 78-1 vote. Davis, who was facing a recall drive that ultimately would oust him from office, finally supported the bill and signed it into law. It basically required a customer opt-in before banks could sell their data to outside third parties, and an opt-out for affiliate sharing. The ballot initiative was aborted.

As a last-ditch effort, major banks tried to persuade Speier to go along with an affiliate-sharing curb that only covered "marketing" data. But Speier stood firm. She recognized there was growing concern over the increasingly detailed consumer profiles that huge financial conglomerates were compiling through affiliate sharing. A marketing-only approach would not address the more profound issue of profiling.

As U.S. PIRG's Ed Mierzwinski often warned, affiliate sharing enabled large companies to create their own sort of "credit profile" beyond the reach of the FCRA.

³⁸³ The initiative's proponents were led by Charlene Nelson, of the Constitution Party, and Rep. Jim Kasper, a Republican State Representative and small businessman. Kasper later traveled to California to explain the experience, and testified before the U.S. Senate as well in 2002.

Still, spokesmen for major banks said they could live with the bill. Jon Ross, a Citigroup lobbyist, told The American Banker on August 25, 2003, "We were part of this and are pleased with the work done — it's a good fair result for everyone."

In an August 14, 2003 press release, the California Bankers Association (CBA), said, "We believe that, with the latest changes, this proposal qualifies as both reasonable and workable in many, but not all, aspects... We want to be clear that CBA would much prefer a national standard to a patchwork of state or local privacy laws."

But a new opportunity would arise to take an important part of the Speier bill "off the books."

Banks Win One In Court

Senator Jackie Speier's determined fight for privacy in Sacramento inspired several California counties and municipalities to pass ordinances granting residents opt-in rights for their financial data — both in relation to outside parties and affiliates. San Mateo and Contra Costa Counties, along with San Francisco and Daly City, all adopted local ordinances that went beyond what Speier proposed. Bank of America and other major banks filed suit, asking the courts to invalidate the local restrictions on affiliate sharing under the FCRA preemption of state law.

On July 29, 2003, U.S. District Judge Claudia Wilken ruled that the FCRA's preemption of affiliate sharing indeed barred states or localities from adopting opt-out rules for consumers. In a sweeping victory for industry, she held that the FCRA's preemption was unequivocal. The GLB's "Sarbanes Amendment" only preserved states' rights to adopt rules regarding third parties. The FCRA trumped GLB because it addressed affiliate sharing, while the GLB did not.

Although it upheld local ordinances requiring opt-in for third parties, Judge Wilken's ruling effectively meant that the affiliate-sharing provisions of the Speier bill were stillborn. The best way to restore them to life was for the FCRA Amendments either to clarify that the provisions were not preempted, or to adopt them as a national standard.

Meanwhile, Back At The U.S. Congress

To the biggest of the big banks and credit card companies, affiliate sharing was probably the priority issue in the FCRA debate. Major financial institutions view customer data as a "profit center." For a company like Citigroup, which has over 1,700 affiliates, the sharing of data helps one affiliate market to another affiliate's customers. The securities' division might want to promote to consumer banking customers. The credit card division might want to send hard-to-refuse offers to student loan recipients. In the mid-1990s, Nations Bank was caught and fined for marketing questionable securities to elderly depositors.

But marketing is only part of it. Affiliate sharing also helps major corporations make decisions about customers.

Several years ago, First Union, a bank, had developed a system enabling it to reduce the "hold-times" of preferred customers who called customer service representatives, and conversely, prolong the hold-times of less-preferred customers. The automatic number identification function would identify the customer from either the home or business phone that he was calling from, and then link to the customer's profile, enabling the system to apply something akin to "green," "yellow," or "red-light" status.

An Oct. 30, 2000 article in the Washington Post described how Capital One, the credit card company, had achieved success through superior use of customer data and computer modeling. For example, Capital One call centers received about one million calls per week from its 30 million customers.

The Capital One computers make a calculated guess as to what the customer is calling about, and the company says the computers are right 70 percent of the time, up from 40 percent when the system was installed in 1998. Then they route the caller to the most appropriate available service representative among the company's 3,500, who are stationed at five customer-service centers around the country, including Richmond and Fredericksburg. As the call is relayed, the customer's detailed credit history pops up on the rep's desktop computer... Once the customer's reason for calling has been addressed, the service rep morphs into a salesperson, clicking on a blue icon on the computer screen to see which products the computer has determined this customer might buy.

(In 1999) the company conducted 36,000 such tests; it estimates it will perform 45,000 (in 2000). All that information — coupled with data from billions of transactions by millions of cardholders over many years — has helped Capital One stratify consumers ever more finely. The company now offers thousands of credit card products that differ by price, fees, credit-line limits, and other features. Company executives hint that many other applications are possible by sifting through the mountain of consumer payment transactions they own, from which they can extract exact knowledge of what people buy, eat, and do, when they do it, where, and even why. For example, Fairbank and Morris told analysts last week, they can identify higher- and lower-risk candidates more precisely than the most widely used credit-scoring system, which was created by Fair, Isaac and Co. The FICO score is feared by every hopeful homebuyer looking for a mortgage.³⁸⁴

Clearly, such systems can be used to improve customer service or offer customers better products. But there can be a fine line between "offering" and "manipulating," and the danger of manipulation grows when a large organization holds detailed personal data on an individual and the individual does not realize it.

³⁸⁴ Washington Post, October 30, 2000

At the Senate Banking Committee's June 26 hearing on affiliate sharing, Martin Wong, Citibank Global Consumer General Counsel confirmed that his company aggressively used affiliate data.

"Citigroup is able to use the credit information and transaction histories that we collect from affiliates to create internal credit scores and models that help determine a customer's eligibility for credit. This information supplements credit reports and FICO scores to paint the most accurate picture possible of a customer. For example, CitiMortgage underwriters have access to information from affiliates that includes a customer's deposit, loan, and brokerage account balances, as well as the customer's payment history and available lines of credit. This allows our credit analysts to verify the customer's credit worthiness quickly and efficiently, minimizing the burden on the customer associated with providing this documentation," Wong said.³⁸⁵

At the same hearing, Fordham Law Prof. Joel Reidenberg warned that FCRA's current exemption for affiliate sharing had the potential to undermine the Act's privacy protections by creating a loophole for secondary use of customer data.

"Some companies justify this affiliate sharing provision by arguing that corporate families should be treated as one unit for consumer privacy purposes because corporate organizational structure does not have an effect on consumers. This claim is simply not credible. The existence of separate entities to avoid consolidated legal liability confuses operational responsibility for privacy, impacts consumers seeking to assure the fair treatment of their personal information, and undermines consumers seeking legal redress for violations. A confusing maze of companies helped Enron obscure its true behavior. The same holds true for affiliates' sharing of personal information," he said.³⁸⁶

³⁸⁵ Statement of Martin Wong, Senate Banking Comm., June 26, 2003
³⁸⁶ Statement of Joel Reidenberg, Senate Banking Comm., June 26, 2003

Flexing Their Muscle

There was great symbolism at the June 26 hearing on affiliate sharing. Shelby and Sarbanes were surrounded by the four committee members who had the reputations for being friendliest to big banks: Senators Robert Bennett (R-UT), Tim Johnson (D-SD), Elizabeth Dole (R-NC), and Thomas Carper (D-DE). These Senators could fairly be described as representing important constituents. Citibank had its credit card processing center in South Dakota. Bank of America and Wachovia were headquartered in North Carolina. MBNA and First USA were in Delaware. These Senators stayed at the affiliate sharing hearing longer than any other FCRA hearing. Their presence seemed designed to show that affiliate sharing was a major issue to major banks.

The Shelby-Sarbanes legislation included a provision requiring an opt-out for affiliate sharing, but only as it related to marketing data. Although an improvement over GLB, which did not include any opt-out rights for affiliate sharing, this was the same compromise that Speier had rejected as inadequate in California. In a mid-October mark-up in which the Committee gave final approval, Sarbanes said overall he thought the bill was a good one, but said he wished the committee could have accomplished more in the area of affiliate sharing.

Sen. Dianne Feinstein and Sen. Barbara Boxer, both California Democrats, led an effort to restore the Speier affiliate-sharing provisions by making them the national standard under the FCRA. Their effort was defeated 70-24. The bill (S 1753) passed 90-2, with Feinstein and Boxer as the lone dissenters.

The industry got their "everlasting life" in the form of permanent preemption in the areas of affiliate sharing, pre-screening, duties on furnishers, and four other areas. Yet they had to "pay a high price" in new and substantial consumer protections designed to improve accuracy and fight identity theft. They also would have to live under a new set of federal regulations and await the outcome of several studies designed to shed light on their operations.

Consumer privacy groups hailed the new protections, but were disappointed that Congress did not at least "sunset" preemption so the issues would have to be revisited down the road. They were particularly disappointed about losing the Speier affiliate-sharing provisions, but knew the fight for them would resume another day.

In fact, privacy advocates won the next battle. On June 30, 2004 in Sacramento, U.S. District Judge Morrison C. England Jr. ruled that the FCRA did not preempt the affiliate sharing provisions of the California financial privacy law. In reaching the opposite conclusion of his judicial colleague, Judge England called Judge Wilken's reasoning "faulty." The FCRA only preempted state laws on affiliate sharing of credit reports; it did not "broadly preempt all State laws regulating information sharing by affiliates, whatever the purpose or context," he wrote. The American Bankers Assoc., Consumer Bankers Assoc. and the Financial Services Roundtable immediately appealed to the U.S. Court of Appeals for the Ninth Circuit, where the case was pending when this book went to print.

President Bush Signs The Bill

On December 4, President George W. Bush held a small, hurriedly arranged signing ceremony in the White House for the Fair and Accurate Credit Transactions Act (FACT Act).

"The bill I'm about to sign will help make sure that hardworking, law-abiding citizens are treated fairly when they apply for credit," he said.³⁸⁷

³⁸⁷ The President's full statement, with additional links to Treasury Dept. fact sheets, is at http://www.whitehouse.gov/news/releases/2003/12/20031204-2.html.

"This bill also confronts the problem of identity theft. A growing number of Americans are victimized by criminals who assume their identities and cause havoc in their financial affairs. With this legislation, the federal government is protecting our citizens by taking the offensive against identity theft," he said.³⁸⁸

"As we help people [get] access to credit, we're strengthening the protections that help consumers build and keep a good credit history. That good record is ruined when criminals steal identities and run up purchases under stolen names. Like other forms of stealing, identity theft leaves the victim feeling terribly violated. And undoing the damage caused by identity theft can take months," President Bush said.

"In an age when information about individuals can be found easily, sold easily, abused easily, government must act to protect individual privacy. And with this new law, we're taking action," he continued. "First, under this law, we're giving every consumer the right to get a copy of his or her credit report free of charge every year. That's important. The credit report is more than a record of past actions — it has great influence over a person's financial future. People should be able to check their credit report for accuracy, and to challenge any errors. The bill does just that."³⁸⁹

Appearing at the ceremony was Michael Berry, who discovered he was an identity theft victim in January 2002, and who "made countless calls to credit bureaus."

³⁸⁸ Id.
³⁸⁹ Id.

"He closed the credit card accounts as fast as he could, but applications for more credit in his name were being made every day. And many were getting approved. He had to call every credit card company to get each card canceled before it was issued. Nearly two years later, Michael is still fighting the effects of the fraud. The system was broken. Michael is living testimony to what I'm saying when I said the system was broken. And Congress acted. I want to thank you all for stepping up and doing the right thing here," President Bush said.³⁹⁰

Author's Note:

For a preliminary version of the FCRA, as amended by the FACT Act, go to:
http://www.ftc.gov/os/statutes/031224fcra.pdf

For the text of the pre-2003 FCRA, go to:
http://www.ftc.gov/os/statutes/fcra.htm

The FTC's announcement of effective dates is:
www.ftc.gov/opa/2004/02/fyi0410.htm and www.ftc.gov/os/2004/02/040203facta.pdf

³⁹⁰ Id.

Continue to Next Chapter

Credit Repair Specialists are Ready to Help!

Call Veracity and Begin Improving Your Credit Score Today!