Identity theft and the case for a national credit report freeze law

North Carolina Banking Institute, March, 2008 by Kristan T. Cheng

A credit freeze is a consumer protection tool that allows consumers to prohibit others from accessing their credit report information by freezing their accounts. Credit freezes prevent CRAs from issuing a consumer's report to those who do not have a current credit relationship with the consumer. (34) With a majority of creditors, lack of access to an individual's credit report in turn prevents new lines of credit from being opened in the individual's name. By preventing new accounts from being opened, consumers are then protected from the most pervasive form of identity theft.

III. CURRENT FEDERAL LAW

Current federal law addressing the use and protection of private consumer information includes the Fair Credit Reporting Act (FCRA), (35) the Fair and Accurate Credit Transactions Act (FACTA), (36) the Identity Theft and Assumption Deterrence Act of 1998 (ITADA), (37) and the Gramm-Leach Bliley Act (GLBA). (38) Although these laws provide some consumer protection, they fall short of providing sufficient data breach notification and identity theft protection.

A. The Fair Credit Reporting Act and the Fair and Accurate Credit Transactions Act

1. Protections Provided by the FCRA and the FACTA

The FCRA was enacted in 1970 in response to growing problems with the questionable practices of CRAs in the 1960s. (39) It was the first federal law to regulate the use and disclosure of personal information and was enacted to limit access to private consumer information to those with legitimate needs for it, to prevent its misuse, and to "maintain procedures to ensure 'maximum possible accuracy'" of consumer reports. (40) Prior to the passage of the FCRA, individuals had no right to view their credit files or the ability to contest mistakes in their credit records. (41) The FCRA requires that all CRAs disclose to consumers the information contained in the consumer's file, the sources from which the information was procured, and a record of all inquiries made for the consumer's report during the preceding year. (42) The FCRA limits CRAs from furnishing credit reports to individuals other than upon:

   the written instructions of the consumer to whom it relates. To a
   person which it has reason to believe (A) intends to use the
   information in connection with a credit transaction involving the
   consumer on whom the information is to be furnished ... or (B)
   intends to use the information for employment purposes; or (C)
   intends to use the information in connection with the underwriting
   of insurance involving the consumer; or (D) intends to use the
   information in connection with a determination of the consumer's
   eligibility for a license or other benefit granted by a
   governmental instrumentality ... or (E) intends to use the
   information, as a potential investor or servicer, or current
   insurer in connection with a valuation of ... an existing credit
   obligation; or (F) otherwise has a legitimate business need for the
   information. (43)

The FCRA also created a framework to address the accuracy of disputed reports and the subsequent investigation and remedying of these disputes, providing a maximum forty-five day period in which the disputed information must be verified; if the information is found to be incorrect, then it is removed from the consumer's file. (44)