“(a) Every consumer reporting agency shall maintain reasonable procedures designed to avoid violations of section 605 and to limit the furnishing of consumer reports to the purposes listed under section 604. These procedures shall require that prospective users of the information identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose. Every consumer reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by such prospective user prior to furnishing such user a consumer report. No consumer reporting agency may furnish a consumer report to any person if it has reasonable grounds for believing that the consumer report will not be used for a purpose listed in Section 604.

(b) Whenever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.”

1. Procedures To Avoid Reporting Obsolete Information

A. General. A consumer reporting agency should establish procedures with its sources of adverse information that will avoid the risk of reporting obsolete information. For example, the agency should either require a creditor to supply the date an account was placed for collection or charged off, or the agency should use a conservative date for such placement or charge off (such as the date of the last regularly scheduled payment), to be sure of complying with the statute.

B. Retention of obsolete information for reporting in excepted circumstances. If a consumer reporting agency retains adverse information in its files that is “obsolete” under section 605(a) (e.g., information about a satisfied judgment that is more than seven years old), so that it may be reported for use in transactions described by section 605(b) (i.e., applications for credit or life insurance for $50,000 or more, or employment at an annual salary of $20,000 or more), it must have procedural safeguards to avoid reporting the information except in those situations. The procedure should require that such obsolete information be released only after an internal decision that its release will not violate section 605.

2. Procedures To Avoid Reporting for Impermissible Purposes

A. Verification. A consumer reporting agency should have a system to verify that it is dealing with a legitimate business having a “permissible purpose” for the information reported. What constitutes adequate verification will vary with the circumstances. If the consumer reporting agency is not familiar with the user, appropriate procedures might require an on-site visit to the user's place of business, or a check of the user's references.

B. Required certification by user. A consumer reporting agency should adopt procedures that require prospective report users to identify themselves, certify the purpose for which the information is sought, and certify that the information will be used for no other purpose. A consumer reporting agency should determine initially that users have permissible purposes and ascertain what those purposes are. It should obtain a specific, written certification that the recipient will obtain reports for those purposes and no others. The user's certification that the report will be used for no other purposes should expressly prohibit the user from sharing the report or providing it to anyone else, other than the subject of the report or to a joint user having the same purpose. A consumer reporting agency should refuse to provide reports to those refusing to provide such certification.

C. Blanket or individual certification. Once the consumer reporting agency obtains a certification from a user (e.g., a creditor) that typically has a permissible purpose for receiving a consumer report, stating that it will use those reports only for specified permissible purposes (e.g., for credit or employment purposes), a certification of purpose need not be furnished for each individual report obtained, provided there is no reason to believe the user may be violating its certification. However, in furnishing reports to users that typically could have both permissible and impermissible purposes for ordering consumer reports (e.g., attorneys and detective agencies), the consumer reporting agency must require the user to provide a separate certification each time it requests a consumer report.

D. Procedures to avoid recipients' abuse of certification. When doubt arises concerning any user's compliance with its contractual certification, a consumer reporting agency must take steps to insure compliance, such as requiring a separate, advance certification for each report it furnishes that user, or auditing that user to verify that it is obtaining reports only for permissible purposes. A consumer reporting agency must cease furnishing consumer reports to users who repeatedly request consumer reports for impermissible purposes.

E. Unauthorized access. A consumer reporting agency should take several other steps when doubt arises concerning whether a user is obtaining reports for a permissible purpose from a computerized system. If it appears that a third party, not a subscriber, has obtained unauthorized access to the system, the consumer reporting agency should take appropriate steps such as altering authorized users' means of access, such as codes and passwords, and making random checks to ensure that future reports are obtained only for permissible purposes. If a subscriber has inadvertently sought reports for impermissible purposes or its employee has obtained reports without a permissible purpose, it would be appropriate for the consumer reporting agency to alter the subscriber's means of access, and require an individual written certification of the permissible purpose for each report requested or randomly verify such purposes. A consumer reporting agency should refuse to furnish any further reports to a user that repeatedly violates certifications.

F. Use of computerized systems. A consumer reporting agency may furnish consumer reports to users via terminals, provided the consumer reporting agency has taken the necessary steps to ensure that the users have a permissible purpose to receive the reports. (The agency would have to record the identity of consumer report recipients for each consumer, to be able to make any disclosures required under section 609(a)(3) or section 611(d)).

G. Activity reports. If a consumer reporting agency provides “activity reports” on all customers who have open-end accounts with a credit grantor, it must make certain that the credit grantor always notifies the agency when accounts are closed and paid in full, to avoid furnishing reports on former customers or other customers for whom the credit grantor lacks a permissible purpose. (See also discussion in section 604(3)(A), item 1, supra.)

3. Reasonable Procedures To Assure Maximum Possible Accuracy

A. General. The section does not require error free consumer reports. If a consumer reporting agency accurately transcribes, stores and communicates consumer information received from a source that it reasonably believes to be reputable, and which is credible on its face, the agency does not violate this section simply by reporting an item of information that turns out to be inaccurate. However, when a consumer reporting agency learns or should reasonably be aware of errors in its reports that may indicate systematic problems (by virtue of information from consumers, report users, from periodic review of its reporting system, or otherwise) it must review its procedures for assuring accuracy. Examples of errors that would require such review are the issuance of a consumer report pertaining entirely to a consumer other than the one on whom a report was requested, and the issuance of a consumer report containing information on two or more consumers (e.g., information that was mixed in the file) in response to a request for a report on only one of those consumers.

B. Required steps to improve accuracy. If the agency's review of its procedures reveals, or the agency should reasonably be aware of, steps it can take to improve the accuracy of its reports at a reasonable cost, it must take any such steps. It should correct inaccuracies that come to its attention. A consumer reporting agency must also adopt reasonable procedures to eliminate systematic errors that it knows about, or should reasonably be aware of, resulting from procedures followed by its sources of information. For example, if a particular credit grantor has often furnished a significant amount of erroneous consumer account information, the agency must require the creditor to revise its procedures to correct whatever problems cause the errors or stop reporting information from that creditor.

C. Use of automatic data processing equipment. Consumer reporting agencies that use automatic data processing equipment (particularly for long distance transmission of information) should have reasonable procedures to assure that the data is accurately converted into a machine-readable format and not distorted by machine malfunction or transmission failure. Reasonable security procedures must be adopted to minimize the possibility that computerized consumer information will be stolen or altered by either authorized or unauthorized users of the information system.

D. Reliability of sources. Whether a consumer reporting agency may rely on the accuracy of information from a source depends on the circumstances. This section does not hold a consumer reporting agency responsible where an item of information that it receives from a source that it reasonably believes to be reputable appears credible on its face, and is transcribed, stored and communicated as provided by that source. Requirements are more stringent where the information furnished appears implausible or inconsistent, or where procedures for furnishing it seem likely to result in inaccuracies, or where the consumer reporting agency has had numerous problems regarding information from a particular source.

E. Undesignated information in credit transactions. Undesignated information means all credit history information in a married (or formerly married) consumer's file, which was not reported to the consumer reporting agency with a designation indicating that the information relates to either the consumer's joint or individual credit experience. The question arises what is meant by reasonable procedures under this section for treatment of credit history in the file of only one (present or former) spouse (usually the husband) that has not been designated by the procedure in Regulation B, 12 CFR 202.10, which implements the Equal Credit Opportunity Act. (This situation exists only for certain credit history file information compiled before June 1, 1977, and certain accounts opened before that date.) A consumer reporting agency may report information solely in the file of spouse A, when spouse B applies for a separate extension of credit, only if such information relates to accounts for which spouse B was either a user or was contractually liable, or the report recipient has a permissible purpose for a report on spouse A. A consumer reporting agency may not supply all undesignated information from the file of a consumer's spouse in response to a request for a report on the consumer, because some or all of that information may not relate to both spouses. Consumer reporting agencies must honor without charge the request of a married or formerly married individual that undesignated information (that appears only in the files of the individual's present or former spouse) be segregated—i.e., placed in a separate file that is accessible under that individual's name. This procedure insures greater accuracy and protection of the privacy of spouses than does the automatic reporting of undesignated information.

F. Reporting of credit obligation—(1) Past due accounts. A consumer reporting agency must employ reasonable procedures to keep its file current on past due accounts (e.g., by requiring its creditors to notify the credit bureau when a previously past due account has been paid or discharged in bankruptcy), but its failure to show such activity in particular instances, despite the maintenance of reasonable procedures to keep files current, does not violate this section. For example, a consumer reporting agency that reports accurately in 1985 that as of 1983 the consumer owed a retail store money, without mentioning that the consumer eventually paid the debt, does not violate this section if it was not informed by the store or the consumer of the later payment.

(2) Significant, verified information. A consumer reporting agency must report significant, verified information it possesses about an item. For instance, a consumer reporting agency may continue to report a paid account that was previously delinquent, but should also report that the account has been paid. Similarly, a consumer reporting agency may include delinquencies on debts discharged in bankruptcy in consumer reports, but must accurately note the status of the debt (e.g., discharged, voluntarily repaid). Finally, if a reported bankruptcy has been dismissed, that fact should be reported.

(3) Guarantor obligations. Personal guarantees for obligations incurred by others (including a corporation) may be included in a consumer report on the individual who is the guarantor. The report should accurately reflect the individual's involvement (e.g., as guarantor of the corporate debt).

4. Effect of Criminal Sanctions

Notwithstanding the fact that section 619 provides criminal sanctions against persons who knowingly and willfully obtain information on a consumer from a consumer reporting agency under false pretenses, a consumer reporting agency must follow reasonable procedures to limit the furnishing of reports to those with permissible purposes.

5. Disclosure of Credit Denial

When reporting that a consumer was denied a benefit (such as credit), a consumer reporting agency need not report the reasons for the denial.

6. Content of Report

A consumer report need not be tailored to the user's needs. It may contain any information that is complete, accurate, and not obsolete on the consumer who is the subject of the report. A consumer report may include an account that was discharged in bankruptcy (as well as the bankruptcy itself), as long as it reports a zero balance due to reflect the fact that the consumer is no longer liable for the discharged debt. A consumer report may include a list of recipients of reports on the consumer who is the subject of the report.

7. Completeness of Reports

Consumer reporting agencies are not required to include all existing derogatory or favorable information about a consumer in their reports. (See, however, discussion in section 611, item 14, infra, concerning conveying consumer dispute statements.) However, a consumer reporting agency may not mislead its subscribers as to the completeness of its reports by deleting nonderogatory information and not disclosing its policy of making such deletions.

8. User Notice of Adverse Action Based on a Consumer Report

A consumer reporting agency need not require users of its consumer reports to provide any notice to consumers against whom adverse action is taken based on a consumer report. The FCRA imposes such notice requirements directly on users, under the circumstances set out in section 615.