“(a) Every consumer reporting agency shall, upon request and proper identification of any consumer, clearly and accurately disclose to the consumer:

(1) The nature and substance of all information (except medical information) in its files on the consumer at the time of the request.

(2) The sources of the information; except that the sources of information acquired solely for use in preparing an investigative consumer report and actually used for no other purpose need not be disclosed: Provided, That in the event an action is brought under this title, such sources shall be available to the plaintiff under appropriate discovery procedures in the court in which the action is brought.

(3) The recipients of any consumer report on the consumer which it has furnished

(A) for employment purposes within the two-year period preceding the request, and

(B) for any other purpose within the six-month period preceding the request.

(b) The requirements of subsection (a) respecting the disclosure of sources of information and the recipients of consumer reports do not apply to information received or consumer reports furnished prior to the effective date of this title except to the extent that the matter involved is contained in the files of the consumer reporting agency on that date.”

1. Relation to Other Sections

This section states what consumer reporting agencies must disclose to consumers, upon request and proper identification. Section 610 sets forth the conditions under which those disclosures must be made, and section 612 sets forth the circumstances under which consumer reporting agencies may charge for making such disclosures. The term “file” as used in section 609(a)(1) is defined in section 603(g). The term “investigative consumer report,” which is used in section 609(a)(2), is defined in section 603(e). The term medical information, which is used in section 609(a)(1), is defined in section 603(i).

2. Proper Identification

A consumer reporting agency must take reasonable steps to verify the identity of an individual seeking disclosure under this section.

3. Manner of “Proper Identification”

If a consumer provides sufficient identifying information, the consumer reporting agency cannot insist that the consumer execute a “request for interview” form, or provide the items listed on it, as a prerequisite to disclosure. However, the agency may use a form to identify consumers requesting disclosure if it does not use the form to inhibit disclosure, or to obtain any waiver of the consumers' rights. A consumer reporting agency may provide disclosure by telephone without a written request, if the consumer is properly identified, but may insist on a written request before providing such disclosure.

4. Power of Attorney

A consumer reporting agency may disclose a consumer's file to a third party authorized by the consumer's written power of attorney to obtain the disclosure, if the third party presents adequate identification and fulfills other applicable conditions of disclosure. However, the agency may also disclose the information directly to the consumer.

5. Nature of Disclosure Required

A consumer reporting agency must disclose the nature and substance of all items in the consumer's file, no matter how or where they are stored (e.g., in other offices of the consumer reporting agency). The consumer reporting agency must have personnel trained to explain to the consumer any information furnished in accordance with the Act. Particularly when the file includes coded information that would be meaningless to the consumer, the agency's personnel must assist the consumer to understand the disclosures. Any summary must not mischaracterize the nature of any item of information in the file. The consumer reporting agency is not required to provide a copy of the file, or any other written disclosure, or to read the file verbatim to the consumer or to permit the consumer to examine any information in its files. A consumer reporting agency may choose to usually comply with the FCRA in writing, by providing a copy of the file to the consumer or otherwise.

6. Medical Information

Medical information includes information obtained with the consumer's consent from physicians and medical facilities, but does not include comments on a consumer's health by non-medical personnel. A consumer reporting agency is not required to disclose medical information in its files to consumers, but may do so. Alternatively, a consumer reporting agency may inform consumers that there is medical information in the files concerning them and supply the name of the doctor or other source of the information. Consumer reporting agencies may also disclose such information to a physician of the consumer's choice, upon the consumer's written instructions pursuant to section 604(2).

7. Ancillary Information.

A consumer reporting agency is not required to disclose information consisting of an audit trail of changes it makes in the consumer's file, billing records, or the contents of a consumer relations folder, if the information is not from consumer reports and will not be used in preparing future consumer reports. Such data is not included in the term “information in the files” which must be disclosed to the consumer pursuant to this section. A consumer reporting agency must disclose claims report information only if it has appeared in consumer reports.

8. Information on Other Consumers

The consumer has no right to information in the consumer reporting agency's files on other individuals, because the disclosure must be limited to information “on the consumer.” However, all information in the files of the consumer making the request must be disclosed, including information about another individual that relates to the consumer (e.g., concerning that individual's dealings with the subject of the consumer report).

9. Disclosure of Sources of Information

Consumer reporting agencies must disclose the sources of information, except for sources of information acquired solely for use in preparing an investigative consumer report and actually used for no other purpose. When it has used information from another consumer reporting agency, the other agency should be reported as a source.

10. Disclosure of Recipients of Consumer Reports

Consumer reporting agencies must maintain records of recipients of prior consumer reports sufficient to enable them to meet the FCRA's requirements that they disclose the identity of recipients of prior consumer reports. A consumer reporting agency that furnishes a consumer report directly to a report user at the request of another consumer reporting agency must disclose the identity of the user that was the ultimate recipient of the report, not the other agency that acted as an intermediary in procuring the report.

11. Disclosure of Recipients of Prescreened Lists

A consumer reporting agency must furnish to a consumer requesting file disclosure the identity of recipients of any prescreened lists that contained the consumer's name when submitted to creditors (or other users) by the consumer reporting agency.

12. Risk Scores.

A consumer reporting agency is not required to disclose a risk score (or other numerical evaluation, however named) that is provided to the agency's client (based on an analysis of data on the consumer) but not retained by the agency. Such a score is not information “in (the agency's) files at the time of the request” by the consumer for file disclosure.