04-14388. Free Annual File Disclosures

AGENCY:

Federal Trade Commission (FTC or Commission).

ACTION:

Final Rule.

SUMMARY:

The Fair and Accurate Credit Transactions Act of 2003 (FACT Act or the Act) requires the FTC to adopt regulations to require the establishment of a centralized source through which consumers may request a free annual file disclosure from each nationwide consumer reporting agency; a standardized form for such requests; and a streamlined process for consumers to request free annual file disclosures from nationwide specialty consumer reporting agencies. This final rule implements these requirements.

EFFECTIVE DATE:

This rule is effective on December 1, 2004.

FOR FURTHER INFORMATION CONTACT:

Helen Goff Foster or Sandra Farrington, Attorneys, Division of Financial Practices, Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580, [phone].

SUPPLEMENTARY INFORMATION:

The final rule retains all of the requirements of the proposed rule, without major substantive changes, and adds a requirement relating to the use and disclosure of personally identifiable information collected through the centralized source.

Statement of Basis and Purpose

I. Background

The Fair and Accurate Credit Transactions Act of 2003, Pub. L. 108-159, 117 Stat. 1952 (FACT Act or the Act) was signed into law on December 4, 2003. In part, the Act amends the Fair Credit Reporting Act (FCRA), 15 U.S.C. 1681 et seq., by imposing new requirements on consumer reporting agencies that compile and maintain files on consumers on a nationwide basis (nationwide consumer reporting agencies), and nationwide specialty consumer reporting agencies, as defined by §§ 603(p) and 603(w) of the FCRA, 15 U.S.C. 1681a(p) and (w), respectively. These additional requirements include the obligation to provide, upon request, one free file disclosure—commonly called a credit report—to the consumer once in a 12-month period.^[1]

The FACT Act directs the Commission to consider the concerns of both consumers and industry in prescribing these rules. Specifically, the Act directs the Commission to consider “the significant demand that may be placed on consumer reporting agencies in providing such [annual file disclosures]; appropriate means to ensure that consumer reporting agencies can satisfactorily meet those demands, including the efficacy of a system of staggering the availability to consumers of such [file disclosures]; and the ease by which consumers should be able to contact consumer reporting agencies with respect to access to such [annual file disclosures].” FACT Act § 211(d)(2). In addition to these considerations, the FACT Act also requires the Commission to provide for an orderly transition for the centralized source in a manner that does not temporarily overwhelm the nationwide consumer reporting agencies with requests for annual file disclosures and does not deny creditors and other users access to consumer reports. FACT Act § 211(d)(2). Finally, the FACT Act directs the Commission to consider, when setting the effective date for rule provisions applicable to the nationwide specialty consumer reporting agencies, the ability of each nationwide specialty consumer reporting agency to comply with the annual file disclosure requirements. FACT Act § 211 (a), codified at FCRA § 612 (a), 15 U.S.C. §1681j (a).

The Commission has carefully weighed all of these considerations as required by the FACT Act. On March 16, 2004, the Commission issued, and sought comment on, a proposed rule implementing the requirements of the FACT Act (the proposed rule).^[2] The Commission has reviewed the detailed comments received, which represented all points of view. In crafting both the proposed rule and the final rule, the Commission has strived to strike the balance that the FACT Act seeks between the availability of free annual file disclosures to consumers and the legitimate concerns of the consumer reporting agencies that are required to provide them. In issuing this final rule (the rule or the final rule), the Commission adopts the proposed rule with some modifications.

Like the proposed rule, the final rule requires nationwide consumer reporting agencies to establish a centralized source to enable consumers, with a single request, to obtain annual file disclosures from all nationwide consumer reporting agencies, in accordance with the FACT Act, § 211(d)(1)(A). The centralized source required by the final rule will provide consumers with the ability to request their free annual file disclosures from each of the nationwide consumer reporting agencies through a centralized Internet website, toll-free telephone number, and postal address. The rule also includes a standardized form for such requests, as specified in the FACT Act, § 211(d)(1)(B). Further, the rule requires nationwide specialty consumer reporting agencies to establish a streamlined process for consumer requests for annual file disclosures, as provided in the FACT Act, § 211(a)(2).

The final rule limits the obligations of nationwide consumer reporting agencies when the volume of consumer requests for annual file disclosures is excessive. It permits nationwide consumer reporting agencies to queue requests for annual file disclosures during times of “high request volume”-i.e., volume that exceeds 125% of the rolling daily average volume. It also allows nationwide consumer reporting agencies to decline to accept requests during times of “extraordinary request volume”-i.e., volume that exceeds 175% of the rolling daily average volume.

The final rule maintains the gradual roll-out of the centralized source contained in the proposed rule. In order to ensure a smooth transition, and in response to concerns regarding the volume of consumers who may request annual file disclosures when the rule first becomes effective, the centralized source will become available to consumers in four cumulative stages that roll out from west to east. See discussion under § 610.2(i) of this notice, infra. This transition will start on December 1, 2004, and will be completed within nine months, by September 1, 2005. Final rule § 610.2 (i)(1). The final rule also provides for a lower threshold for “high request volume” during this transition period.

In addition, the final rule retains, with some modifications, the proposed rule#x2019;s requirements relating to nationwide specialty consumer reporting agencies. These agencies are required to establish a streamlined process for consumers to request annual file disclosures, final rule § 610.3 (a), including a toll-free telephone number for consumers to make such requests. The rule also requires nationwide specialty consumer reporting agencies to make their toll-free telephone numbers available to consumers in specific ways. Final rule § 610.3 (a)(1). See discussion under §610.3 (a) of this notice, infra.

II. Overview of Comments Received.

The Commission received more than 2,300 comments on the proposed rule.^[3] The vast majority of these comments were from consumers. Consumer advocacy groups,^[4] members of Congress, industry trade organizations, ^[5] and various representatives of the consumer reporting industry — including the three nationwide consumer reporting agencies,^[6] other consumer reporting agencies,^[7] and a variety of other interested organizations ^[8] —also submitted comments on the proposed rule.

The Commission received comments relating to nearly every provision contained in the proposed rule. Most commenters — consumer and industry representatives alike — express general support for the concept of free annual file disclosures. Many consumers and consumer advocates note that free annual file disclosures will enhance consumer report accuracy, save consumers money, foster greater financial literacy, and prevent or mitigate the effects of identity theft. Some consumers urge the Commission to adopt provisions that extend beyond what the FACT Act provides: for example, requiring free file disclosures more often, requiring disclosure of free credit scores, or requiring free file disclosures from all consumer reporting agencies, regardless of nationwide or nationwide specialty consumer reporting agency status under the FCRA.

The overwhelming majority of comments focus on one or more aspects of the proposed requirement for nationwide consumer reporting agencies to provide annual file disclosures through a “centralized source.” Proposed rule § 610.2. Consumer commenters express concern about a variety of issues related to the centralized source. Many consumers and consumer advocates suggest that the final rule should include a limitation on the use and disclosure of information collected by nationwide consumer reporting agencies through the centralized source. Consumers also suggest that the regional roll-out of the centralized source, proposed rule § 610.2 (i), was too long, and that it placed unfair burden on consumers residing in eastern states. Consumer advocates, on the other hand, express doubt as to the need for any type of gradual transition, but generally support a regional approach if such a transition were to be retained in the final rule. Many consumer advocacy groups also express concern that the proposed rule contained no requirement to provide file disclosures and centralized source information and instructions in Spanish.

In addition, many consumers and consumer advocates urge the Commission to consider further restricting, or banning, advertising and marketing of other products through the centralized source. Many competitors of the nationwide consumer reporting agencies—including both other consumer reporting agencies^[9] as well as non-consumer reporting agencies^[10] — similarly advocate a final rule that would ban advertising and marketing through the centralized source.

The Commission also received comments relating to the centralized source from both federal and state elected officials. One U.S. Senator^[11] and a group of members of the U.S. House of Representatives Committee on Financial Services^[12] express concern that the structured roll-out of the centralized source required by the proposed rule was too slow, and discriminated against consumers who reside in eastern states. A group of United States Senators^[13] and a different group of members of the U.S. House of Representatives Committee on Financial Services^[14] comment that the proposed rule did not provide the nationwide consumer reporting agencies with sufficient guidance, and that the safe harbor contained in the proposed rule was inadequate to protect these agencies from overwhelming consumer demand for annual file disclosures. A New York State Senator also expresses concern that the proposed rule did not specify how annual file disclosures should be delivered, contained inadequate provisions to protect consumers from unwanted solicitations and other uses of their personally identifiable information, and did not contain requirements that file disclosures and other information be provided to consumers in languages other than English.

CDIA and the nationwide consumer reporting agencies also comment at length on a variety of issues relating to the centralized source. They uniformly express concern that both the proposed rule transition and the provisions relating to the “extraordinary request volume” safe harbor were inadequate and, if adopted, would have subjected the industry to dangerous uncertainties, increased liability from private actions, and wasted resources. They urge the Commission to lengthen the transition period; convert the cumulative regional roll-out approach of the proposed rule to a permanent staggering of availability of free reports by birth month or quarter; and provide additional and lower safe harbor thresholds. In addition, the nationwide consumer reporting agencies and CDIA object to the proposed rule’s requirement that nationwide consumer reporting agencies provide free annual file disclosures for consumers whose files are owned by, or maintained on the nationwide consumer reporting agency’s system by, an associated consumer reporting agency.

The Commission also received a number of comments relating to the proposed rule’s requirement that nationwide specialty consumer reporting agencies implement a “streamlined process” for accepting and processing consumer requests for free annual file disclosures. Proposed rule § 610.3. Consumer and consumer advocate comments on the “streamlined process” focus mainly on the visibility of nationwide specialty consumer reporting agencies and the convenience with which consumers should be able to contact them. A number of consumers comment that nationwide specialty consumer reporting agencies should be required to participate in the centralized source for nationwide consumer reporting agencies required under proposed rule § 610.2, or that nationwide specialty consumer reporting agencies should also develop a joint centralized source.

Representatives of nationwide specialty consumer reporting agencies^[15] express concern over the definition of that term found in the FACT Act. In addition, they object to the fact that the proposed rule did not provide nationwide speciality consumer reporting agencies with a structured roll-out for the required streamlined process. Finally, these entities urge the Commission to provide additional, and lower threshold safe harbors from both private and regulatory liability arising from unforeseen circumstances and overwhelming request volume.

III. Section-By-Section Analysis

Section 610.1—Definitions and rule of construction

Section 610.1 (a) of the final rule explains that the definitions and the rule of construction provided in § 610.1 (b) and (c) of the rule apply throughout Part 610. Terms not otherwise defined in § 610.1 of the rule have the meaning provided under the Fair Credit Reporting Act, 15 U.S.C. 1681a. See also 69 FR 29061.

Definitions.

Section 610.1 (b) of the final rule sets forth definitions for a number of terms used throughout the rule.

Annual file disclosure. The proposed rule defined “annual file disclosure” as a file disclosure that is provided to a consumer upon consumer request and without charge, once in any 12-month period, in compliance with § 612(a) of the Fair Credit Reporting Act, 15 U.S.C. 1681j(a). Proposed rule § 610.1(b)(1). A consumer advocacy group suggests that this definition be revised to provide for free file disclosures “once in a calendar year.”^[16] Such a definition, however, conflicts with the language of the FACT Act, which states free file disclosures should be provided “once during any 12-month period.” FACT Act § 211 (a)(2), codified at FCRA § 612 (a)(1), 15 U.S.C. 1691j (a)(1) (emphasis supplied). The Commission therefore has adopted the proposed rule definition of annual file disclosure in the final rule.

Associated consumer reporting agency. Section 610.1(b)(2) of the proposed rule defined an “associated consumer reporting agency” as a consumer reporting agency that maintains consumer reports within systems operated by a nationwide consumer reporting agency. In the NPR, the Commission noted that nationwide consumer reporting agencies have contractual relationships with a number of regional or local consumer reporting agencies. 69 FR at 13197. These regional or local consumer reporting agencies, traditionally called “service bureaus” or “affiliates,” generally are independently owned and operated entities—they are not corporate affiliates of a nationwide consumer reporting agency.^[17] Rather, typically, they have a right to house some or all of the consumer data that they own on the systems of one or more nationwide consumer reporting agencies. The nationwide consumer reporting agency with whom such an entity is associated, in turn, has the right to sell that consumer data to its customers.^[18] The final rule, like the proposed rule, addresses these consumer reporting agencies as “associated consumer reporting agencies.”

One associated consumer reporting agency comments that this description of associated consumer reporting agencies appropriately describes the relationship between these agencies and nationwide consumer reporting agencies. Both the associated consumer reporting agency commenter and a nationwide consumer reporting agency, however, suggest that the proposed rule definition of “associated consumer reporting agency” should be altered slightly. These commenters both note that many, if not all, associated consumer reporting agencies own — rather than merely maintain — the files that they house in nationwide consumer reporting agency systems. Accordingly, the final rule definition of associated consumer reporting agency is “a consumer reporting agency that owns or maintains consumer files housed within systems operated by one or more nationwide consumer reporting agencies.” Final rule § 610.1(b)(2) (emphasis supplied).

Consumer. The proposed rule adopted the definition of “consumer” that is found in § 603 (c) of the FCRA, 15 U.S.C. 1681a (c). The Commission received no comments suggesting changes to this definition, and it is adopted as proposed. Final rule § 610.1(b)(3).

Consumer report. The proposed rule adopted the definition of “consumer report” that is found in § 603(d) of the FCRA, 15 U.S.C. 1681a(d). The Commission received no comments suggesting changes to this definition, and it is adopted as proposed. Final rule § 610.1(b)(4).

Consumer reporting agency. The proposed rule adopted the definition of “consumer reporting agency” that is found in § 603 (f) of the FCRA, 15 U.S.C. 1681a (f). The Commission received no comments suggesting changes to this definition, and it is adopted as proposed. Final rule § 610.1(b)(5).

Extraordinary request volume. Under the proposed rule, “extraordinary request volume” occurred (except as provided in § 610.2 (i)(2)) “when the number of consumers requesting file disclosures during any 24-hour period is more than twice the daily rolling 90-day average of consumers requesting file disclosures.” For reasons discussed under § 610.2 (e) of this notice, infra, the Commission modifies the proposed rule definition of extraordinary request volume to volume that “is more than 175% of the rolling 90-day daily average of consumers requesting or attempting to request file disclosures.” Final rule § 610.1(b)(6).

File disclosure. The proposed rule, § 610.1(b)(7), defined a “file disclosure” as any disclosure made pursuant to § 609 of the FCRA.^[19] Section 612(a) of the FCRA, 15 U.S.C. 1681j(a), as amended by the FACT Act, provides that nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies must provide “all disclosures pursuant to [FCRA] section 609 once during any 12-month period upon request of the consumer and without charge to the consumer.” Accordingly, under proposed rule § 610.1(b)(1), the term “annual file disclosure” was a file disclosure made upon request, free of charge, in compliance with § 612(a) of the FCRA, 15 U.S.C. 1681j(a), as amended. Although FCRA §§ 612(b)-(e) provide for other types of free file disclosures, the term “annual file disclosure,” as defined in the proposed rule, referred only to free file disclosures made pursuant to FCRA § 612(a).^[20]

One nationwide specialty consumer reporting agency requests that the Commission consider limiting the definition of file disclosure, as it applies to nationwide specialty consumer reporting agencies, to require only the disclosure of specific types of information. This commenter notes that the FACT Act specifically limits the types of nationwide specialty consumer reporting agencies that must provide annual file disclosures to only those that compile or maintain information on medical records or payments; residential or tenant history; check writing history; employment history; or insurance claims. See FCRA § 603(w), 15 U.S.C. 1681a(w). Thus, the commenter posits, Congress must also have intended to circumscribe the content of such file disclosures to only the types of information listed in the definition of nationwide specialty consumer reporting agency.

While the FACT Act limits “nationwide specialty consumer reporting agencies” to specific types of entities — i.e., those that compile and maintain medical records or payments, residential or tenant history, check writing history, employment history, or insurance claims — the plain language of the Act is broader in describing what information those entities must provide to consumers. The FACT Act specifically requires nationwide consumer reporting agencies to make all disclosures required by § 609 of the FCRA, which, by the terms of that section, must include “all information in the consumer’s file at the time of the request.”^[21] The Commission therefore declines to limit the scope of the required disclosures as the commenter suggests. The final rule adopts the proposed rule definition of file disclosure without modification. Final rule § 610.1(b)(7).

High request volume. A definition of “high request volume” was used in the transition section—§ 610.2(i)(3)— of the proposed rule. Under that section, during the transition period, “high request volume” occurred when the number of consumers who contact or attempt to contact the centralized source, a particular request method, or a nationwide consumer reporting agency, in a 24-hour period, is more than 115% of the rolling 7-day average number of consumers who contacted or attempted to contact the centralized source, a particular request method, or a nationwide consumer reporting agency, to request file disclosures. Proposed rule § 610.2(i)(3). For reasons discussed under §§ 610.2(e) and 610.3(c) of this notice, infra, the final rule broadens the concept of high request volume to apply both during and after the defined transition periods. The final rule defines high request volume as occurring when the number of consumers requesting or attempting to request file disclosures during any 24-hour period is more than 125% of the daily rolling 90-day average of consumers requesting or attempting to request file disclosures. As with extraordinary request volume, high request volume is defined differently during the transition period. See discussion under §§ 610.2(i) and 610.3(g) of this notice, infra.

Nationwide consumer reporting agency. Under proposed rule § 610.1(b)(8), the term “nationwide consumer reporting agency” meant a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, as defined in FCRA § 603(p), 15 U.S.C. 1681a(p). The Commission received no comments suggesting changes to this definition, and it is adopted as proposed. Final rule § 610.1(b)(9).

Nationwide specialty consumer reporting agency. The term “nationwide specialty consumer reporting agency” was defined under § 610.1(b)(9) of the proposed rule, in accordance with FCRA § 603(w), 15 U.S.C. 1681a(w), as a consumer reporting agency that compiles and maintains files on consumers relating to medical records or payments, residential or tenant history, check writing history, employment history, or insurance claims, on a nationwide basis. One nationwide specialty consumer reporting agency urges the Commission to expand on the statutory definition of this term. The commenter argues that because the FACT Act added this definition to the FCRA, and because there is little or no legislative history to guide companies in the interpretation of this new definition, the Commission should further delineate the meaning of the term. Specifically, the commenter urges the Commission to adopt specific, limited meanings for the categories of information described in the definition of nationwide specialty consumer reporting agency. This same commenter similarly urges the Commission to define two other terms found within the definition of nationwide specialty consumer reporting agency: “compiles and maintains” and “nationwide.”^[22]

The Commission notes that the definition of the term nationwide specialty consumer reporting agency is set out in the FACT Act with some specificity. By the terms of the Act, its application is limited to a consumer reporting agency. Further, such consumer reporting agency must compile and maintain files on consumers, on a nationwide basis, relating to at least one of five specific categories of information. The record as developed through this rulemaking provides insufficient information to justify altering the definition used by Congress in the FACT Act. Accordingly, the Commission declines to do so. Nor does the Commission find it appropriate, in this rulemaking, to define terms — such as “nationwide” and “compiles and maintains”— that appeared in the FCRA prior to the FACT Act. The definition of nationwide specialty consumer reporting agency is adopted in the final rule as proposed. Final rule § 610.1(b)(10).

Request method. Proposed rule § 610.1(b)(10) defined “request method” as the method by which a consumer chooses to communicate a request for an annual file disclosure. The FACT Act requires nationwide consumer reporting agencies, subject to regulations to be promulgated by the Commission, to establish a centralized source that will permit consumers to make such requests by three specific request methods: Internet website, toll-free telephone number, and mail. The Commission received no comments suggesting changes to this definition, and it is adopted as proposed. Final rule § 610.1(b)(11).

Rule of construction.

Section 610.1(c) of the proposed rule sets out a rule of construction to clarify the effect of the examples used in the proposed rule. Given the complexity of the rule and its potential impact on a variety of entities, the Commission has elected, in some instances, to provide examples of conduct that would, and would not, comply with the proposed rule. This section of the proposed rule provided that these examples are not intended to be exhaustive; they are intended to illustrate how the proposed rule would apply in specific circumstances. Representatives of the nationwide consumer reporting agencies comment that the examples in the proposed rule, coupled with this rule of construction, provide useful guidance for complying with the rule. The Commission received no comments suggesting changes to this provision, and it is adopted as proposed. Final rule § 610.1(c).

Section 610.2(a)—Centralized source for requesting annual file disclosures - purpose

Under § 610.2(a) of the proposed rule, the purpose of the centralized source, consistent with § 211(d) of the FACT Act, was to enable consumers to make a single request to obtain annual file disclosures from all nationwide consumer reporting agencies, as required under § 612(a) of the Fair Credit Reporting Act, 15 U.S.C. 1681j(a). Some commenters suggest that the rule should be crafted to fulfill other purposes as well. For example, several consumer comments suggest that the rule require that credit scores be made available to consumers without charge, free file disclosures be made available more than once a year, and all consumer reporting agencies, not just nationwide consumer reporting agencies, be required to participate in the centralized source. These proposals are all inconsistent with the plain language of the FACT Act. Under § 212 of the FACT Act, codified at FCRA § 609(a)(6) and (f), 15 U.S.C. 1681g(a)(6) and (f), information about credit scores must be provided to consumers requesting file disclosures, and the scores themselves, together with additional information about them, must be provided, upon request, for a “fair and reasonable fee.” The statute also specifically limits the free annual file disclosure requirement to nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies. Furthermore, it limits the operation of the centralized source to the nationwide consumer reporting agencies. FACT Act § 211(a)(2), codified at FCRA § 612(a)(1), 15 U.S.C. 1681j(a)(1). Accordingly, § 610.2(a) has been adopted as proposed.

Section 610.2(b)—Establishment and operation

Under § 610.2(b) of the proposed rule, the nationwide consumer reporting agencies were required to jointly design, fund, implement, maintain, and operate the centralized source for the purpose stated in § 610.2(a). In addition, the centralized source was required to be designed, funded, implemented, maintained, and operated to meet specific requirements.

Joint establishment and operations.

Representatives of nationwide consumer reporting agencies object to the proposed rule requirement that the centralized source be “jointly” designed, funded, implemented, maintained, and operated. They argue that the FACT Act does not require such joint establishment and operation. The FACT Act, however, does require the Commission to “prescribe regulations applicable to consumer reporting agencies described in section 603(p) [of FCRA], to require the establishment of a centralized source through which consumers may obtain [annual file disclosures].” FACT Act § 211(d)(1). Such a “centralized source” — if it is to function as the Act contemplates — must be a joint effort of the nationwide consumer reporting agencies. Thus, the Commission believes it is appropriate to require that the centralized source be jointly designed, funded, implemented, maintained, and operated by nationwide consumer reporting agencies, and the final rule adopts this provision without modification. Final rule § 610.2(b).

Potential competitive concerns among existing nationwide consumer reporting agencies. CDIA comments that it is unaware of any anticompetitive concerns that are raised by the proposed rule’s implementation of the statutory requirement that the nationwide consumer reporting agencies jointly design, fund, implement, maintain, and operate the centralized source through which consumers may request their free file disclosures. The commenter points out that the nationwide consumer reporting agencies have operated the automated dispute resolution system required by FCRA § 611(a)(5)(D) without any competitive problems.

Further, although the final rule, like the proposed rule, requires nationwide consumer reporting agencies, which presumably are competitors, to jointly design, fund, implement, maintain, and operate the centralized source required under the FACT Act, nothing in the rule would permit any activity that is otherwise prohibited by applicable United States antitrust laws. One nationwide consumer reporting agency comments that this analysis interjects uncertainty into the ability of nationwide consumer reporting agencies to comply with existing antitrust law and the FACT Act simultaneously. As a result, the nationwide consumer reporting agencies urge the Commission to make clear that the coordination required by the statute and the rule is not subject to antitrust enforcement as it relates to the operation of the centralized source. As stated above, participation in the centralized source as required by the FACT Act and the final rule is not a violation of U.S. antitrust laws, which allow collaboration as long as it is not anticompetitive. The converse, however, is also true: Neither the FACT Act nor the final rule would permit nationwide consumer reporting agencies to engage in anticompetitive activities that would otherwise violate applicable antitrust laws.

New entrants and barriers to entry. The Commission is aware of three entities that meet the FCRA § 603(p) definition of nationwide consumer reporting agency.^[23] It is possible, however, that additional nationwide consumer reporting agencies may exist, or be created, in the future. Any entity that meets the definition of nationwide consumer reporting agency in FCRA § 603(p), 15 U.S.C. 1681a(p), cannot be excluded by the currently identified nationwide consumer reporting agencies from participating jointly in the centralized source.

One nationwide consumer reporting agency expresses concern that the “joint” establishment requirements might be interpreted to mean that the centralized source should be redesigned and reimplemented each time a new entrant is presented. The Commission agrees that to cause the entire centralized source to be reinvented for a new entrant would be inappropriate. Rather, § 610.2(b) of the rule contemplates that the centralized source would be modified only as necessary to allow consumers to request file disclosures from new entrants with the same ease as they can request file disclosures from existing participants.

Further, representatives of the nationwide consumer reporting agencies comment that the existing nationwide consumer reporting agencies, who will bear the costs of initial development and implementation of the centralized source, should be permitted to require any new entrants to reimburse them for the initial development and implementation costs associated with the centralized source. In contrast, some marketers of credit-related products and services express concern that the existing nationwide consumer reporting agencies will seek to impose unreasonable costs on potential new entrants to the centralized source in order to create an unreasonable barrier to entry. While the rule requires that the centralized source be jointly funded, it does not state how costs are to be shared among the nationwide consumer reporting agencies. In the Commission’s view, final rule § 610.2(b), which specifically requires joint funding, would permit both the sharing of ongoing operating costs as well as the reimbursement of design and development costs in an equitable manner. Section 610.2 of the final rule should not be used unreasonably to prevent new entrants from participating in the centralized source.

One nationwide consumer reporting agency urges the Commission to “assume responsibility” for identifying new entrants — i.e., those consumer reporting agencies that meet the definition of nationwide consumer reporting agency, and thus, must participate in the centralized source. This commenter argues that the determination of whether a particular consumer reporting agency is a nationwide consumer reporting agency should not be made by competitors of that agency. The Commission agrees that such a determination should not be made by an entity’s competitors. It does not follow, however, that the determination must then be made by the Commission. The determination of whether an entity meets the statutory definition of a nationwide consumer reporting agency-like the determination of whether an entity meets the definition of a consumer reporting agency-is fact specific. Thus, as is true with the determination of whether an entity is a consumer reporting agency, the entity itself must analyze its practices in light of the statute and existing law, and make its own determination.^[24]

Joint and several liability. The final rule requirement for joint design, funding, implementation, maintenance, and operation of the centralized source suggests that all nationwide consumer reporting agency participants in the centralized source could be jointly liable for violations of final rule § 610.2. The nationwide consumer reporting agencies and CDIA object to the idea that a nationwide consumer reporting agency could be held jointly and severally liable for violations committed by one or more of the others, over which that entity had no control. The Commission recognizes that any question of individual or joint and several liability would be fact specific. The Commission does not intend to alter existing applicable standards of liability.

Required Request Methods.

As specified under the FACT Act, § 211(d)(3), final rule § 610.2(b)(1), like the proposed rule, requires the centralized source to include a toll-free telephone number, an Internet website, and a mail process for consumers to make requests for annual file disclosures. Comments received relating to this provision of the proposed rule generally note that it is consistent with the mandate of the FACT Act. The Act requires the nationwide consumer reporting agencies to establish a centralized source through which, by means of a single request, consumers may obtain annual file disclosures. As noted in the NPR, the FACT Act requires that consumers be able to request their annual file disclosures through specific request methods, but does not mandate the method by which the nationwide consumer reporting agencies may deliver those file disclosures. 69 FR at 13194.

Some commenters express concern regarding particular aspects of how the request methods might be presented. One nationwide consumer reporting agency commenter urges the Commission to clarify that the FACT Act and the final rule do not require any “live” telephone assistance to consumers requesting file disclosures. The final rule, like the proposed rule, requires nationwide consumer reporting agencies to provide the request methods mandated by the Act, but does not provide detailed specifications on how each request method should be presented. The Commission notes that there is nothing in the FACT Act that would either require or prohibit a completely automated telephone system for accepting file disclosure requests.

Several commenters urge the Commission to specify in the final rule how annual file disclosures may be provided to consumers who request them. One consumer advocacy group supports requiring that all three reports be generated simultaneously, in order to facilitate comparison. Some consumers, on the other hand, urge the Commission to specify that the reports do not have to be provided at the same time, arguing that a consumer may wish to monitor their file disclosures over the course of a year. Because the consumer is entitled to a free file disclosure from each nationwide consumer reporting agency, that consumer may, for example, choose to order only one file disclosure every four months. The Commission believes that the divergence of opinion on this point illustrates the need for flexibility. Because neither the FACT Act, nor the final rule, specifies that all annual file disclosures must be delivered simultaneously, consumers benefit from having a choice of when they would prefer to request any, or all, of the available annual file disclosures.

One state official argues that the final rule must specify by what means annual file disclosures may be provided. The commenter argues that, without specificity in the final rule, nationwide consumer reporting agencies might limit the available methods of delivery in such a way as to effectively thwart certain consumers from obtaining annual file disclosures. Representatives of the nationwide consumer reporting agencies, on the other hand, argue that the proposed rule improperly allows consumers alone to select the delivery channel for annual file disclosures.

FCRA § 610(b), 15 U.S.C. 1681h(b), specifies that disclosures may be made in such form as may be specified by the consumer and available from the agency. Thus, the proposed rule allowed nationwide consumer reporting agencies flexibility in determining what methods of annual file disclosure delivery to make available generally to consumers. Similarly the final rule neither prohibits nor requires any particular method of delivery for annual file disclosures. The Commission notes that the FCRA, notwithstanding the FACT Act amendments, already specifies, in some detail, how file disclosures may be delivered to consumers.^[25] See FCRA § 610(a)-(b), 15 U.S.C. 1681h(a)-(b). Because the delivery of file disclosures to consumers is already delineated in the FCRA, the final rule neither adds to nor subtracts from those pre-existing provisions of law.^[26]

Adequate capacity.

Under § 610.2(b)(2)(i) of the proposed rule, the centralized source was required to have adequate capacity to accept requests from the reasonably anticipated volume of consumers contacting the centralized source through each request method. The reasonably anticipated volume was required to be determined in compliance with § 610.2(c), discussed infra. Under the FACT Act, nationwide consumer reporting agencies must fulfill consumers’ requests for free annual disclosures “only if the request from the consumer is made using the centralized source established for such purpose.” FACT Act § 211(a)(2), codified at FCRA § 612(a)(1)(B), 15 U.S.C. 1681j(a)(1)(B). In recognition of the importance of a centralized source with adequate capacity to ensure the ability of consumers to obtain annual file disclosures, the final rule adopts § 610.2(b)(2)(i) as proposed, and thus requires that the centralized source be designed, funded, implemented, maintained, and operated in a manner that has adequate capacity to accept requests from the reasonably anticipated volume of consumers contacting the centralized source. Final rule § 610.2(b)(2)(i).

It is important to note that, under the final rule, nationwide consumer reporting agencies are required to anticipate the number of consumers who will contact the centralized source. Because nationwide consumer reporting agencies must meet this requirement during the transition periods defined by the final rule under § 610.2(i), this language is intended to include consumers who contact the centralized source at a time when it is not yet available in their state. In the Commission’s view, the nationwide consumer reporting agencies may employ technological or other means (such as blocking non-eligible area codes during the transition) to prevent consumers from mistakenly contacting the centralized source during the transition at a time when they are not eligible to receive an annual file disclosure.

The Commission received few comments on this provision itself.^[27] CDIA comments that “it is entirely appropriate to require that the nationwide consumer reporting agencies build and maintain each individual request method of the centralized source to anticipate consumer’s request volume when there is data upon which to estimate demand.”^[28] The Commission agrees, and § 610.2(b)(2)(i) is adopted as proposed.

Collection of information and identification of consumers.

The proposed rule, in § 610.2(b)(2)(ii), required that the nationwide consumer reporting agencies collect only as much information from a consumer through the centralized source as is reasonably necessary in order to properly identify the consumer and to process the transaction(s) requested by the consumer. The final rule retains this requirement, with some modification. See final rule § 610.2(b)(2)(ii).

Personally identifiable information. One nationwide consumer reporting agency comments that the proposed rule limitation on the collection of “information” may prohibit the nationwide consumer reporting agencies from collecting useful anonymous data through the centralized source. This commenter explains that such anonymous data would be useful for system maintenance and in detecting activities that would harm the centralized source, such as fraud.

The purpose of this provision of the rule is to ensure that the centralized source will be easy for consumers to use, while allowing the nationwide consumer reporting agencies to properly identify consumers who request their file disclosures through the centralized source, in compliance with FCRA § 610(a)(1), 15 U.S.C. 1681h(a)(1). The Commission is concerned that a centralized source that collects too much personal information may discourage some consumers from requesting their annual file disclosures. The Commission also recognizes, however, the need for collection of anonymous data for purposes such as system maintenance, service improvement, or fraud prevention.^[29] Accordingly, the Commission has modified the § 610.2(b)(2)(ii) requirement to limit the collection of personally identifiable information — rather than all information — to that which is reasonably necessary to properly identify the consumer and process the transaction(s) requested by that consumer. Accordingly, final rule § 610.2(b)(2)(ii) would not prevent nationwide consumer reporting agencies from collecting anonymous information.

Social Security number. Some consumers suggest that the final rule should specify that consumers are not required to provide their Social Security numbers when requesting their free file disclosures through the centralized source. These commenters contend that, in order to prevent identity theft, consumers have been repeatedly instructed by consumer advocates and government not to provide their Social Security numbers to anyone, and that some consumers do not have Social Security numbers. Therefore, they assert, the availability of annual file disclosures should not be conditioned on providing a Social Security number.

The final rule does not specifically require or prohibit the collection of Social Security numbers through the centralized source. Section 610.2(b)(2)(ii) is intended to provide a standard for information collection that is sufficiently flexible to accommodate the proper identification of consumers requesting free annual file disclosures by all nationwide consumer reporting agencies. The collection of this information is limited to that which is “reasonably necessary” to achieve proper identification of the consumer. The Commission believes that a consumer’s Social Security number may be “reasonably necessary” to properly identify the consumer, given the requirements of the nationwide consumer reporting agencies’ current systems. Therefore, the rule does not prohibit the collection of that information. If, however, at some future time, due to changes in technology or in the consumer data industry, a Social Security number is not “reasonably necessary” for proper identification, then the collection of that information would be prohibited by final rule § 610.2(b)(2)(ii).

Separate authentication. Representatives of the nationwide consumer reporting agencies comment on the need for each agency to conduct separate authentication processes for each consumer requesting a free annual file disclosure through the centralized source. As noted in the NPR, proposed rule § 610.2(b)(2)(ii) was intended to afford each nationwide consumer reporting agency the flexibility to implement its own identification procedures for consumers who request file disclosures through the centralized source, in order to allow proper identification of consumers and to protect against fraud. File disclosures contain a great deal of very sensitive information. If misdirected to, or fraudulently obtained by, someone other than the consumer to whom it relates, a file disclosure would provide the ideal means for identity theft and other fraudulent activity. In addition, the nationwide consumer reporting agencies each maintain slightly different information in their consumer files, making it difficult to devise a common identification scheme. Moreover, a flexible approach allows the nationwide consumer reporting agencies to adjust to changing threats and patterns of fraudulent activity over time. Accordingly, like the proposed rule, the final rule does not prohibit the use of separate authentication processes by each nationwide consumer reporting agency for consumers requesting free annual file disclosures through the centralized source.

Reasonably necessary. One nationwide consumer reporting agency suggests that the final rule alter the limitation on information collection. This commenter expresses concern that the “reasonably necessary” standard creates uncertainty and would, therefore, increase the risk of litigation.^[30] The commenter also states that this risk of liability would create incentive for a nationwide consumer reporting agency to collect only the minimum necessary amount of information in order to identify consumers, thus creating increased risk of identity theft or fraud.

As noted above, the Commission intends for the final rule to strike a balance between ease of use of the centralized source and maintaining adequate identification and authentication procedures to protect against fraud and identity theft. In part, the purpose of the “reasonably necessary” standard is to allow for advances in technology or other developments that improve proper identification and authentication. The Commission believes that creating a flexible standard that can adapt over time is the most effective way of ensuring that proper procedures are implemented. Accordingly, nationwide consumer reporting agencies are required to limit the collection of personally identifiable information through the centralized source to that which is “reasonably necessary.”

Potential for fraud. In promulgating the proposed rule, the Commission posed a question as to whether and how the rule should address the potential for fraudulent websites, telephone numbers, or other ploys that might mimic the centralized source in order to gain access to personally identifiable consumer information for illegal purposes. In addition, the Commission asked whether the rule should require the nationwide consumer reporting agencies to employ measures to reassure consumers that they are contacting the legitimate centralized source.

Two of the nationwide consumer reporting agencies and CDIA responded to these questions by stating that the primary mechanism for preventing such fraudulent ploys is FTC enforcement action. These comments further assert that no specific preventive measures should be required of the nationwide consumer reporting agencies. One nationwide consumer reporting agency suggests that the nationwide consumer reporting agencies and the Commission engage in future discussions regarding effective measures to reassure consumers that they are contacting the centralized source.

At this time, the Commission has not identified any specific appropriate measures that, if incorporated into the centralized source, would sufficiently address fraudulent spoofing or mimicking of the centralized source. It welcomes further dialogue with the nationwide consumer reporting agencies regarding this important topic of fraud prevention. The Commission may also address these issues through consumer education, and, if appropriate, enforcement actions pursuant to the FTC Act, 15 U.S.C. 45(a). As a further aid to wary consumers, the Commission urges the nationwide consumer reporting agencies to make it easy for consumers to navigate from the nationwide consumer reporting agencies’ individual homepages to the centralized source website. In addition, to assist consumers in identifying the centralized source, the final rule requires the nationwide consumer reporting agencies to include a statement indicating that the consumer has reached the website or telephone number “operated by the national credit reporting agencies for ordering free annual credit reports, as required by federal law.” Final rule §610.2 (b)(2)(iv)(D).

Information on alternate request methods.

To ensure that consumers can access the centralized source request method of their choice, proposed rule § 610.2(b)(2)(iii) required the centralized source toll-free number and Internet website to provide information regarding how to make a request for annual file disclosures through all available request methods. The Commission received no comments relating to this provision and adopts the provision as set forth in the proposed rule. Final rule § 610.2(b)(2)(iii).

Clear and easily understandable instructions.

Under proposed rule § 610.2(b)(2)(iv), the centralized source was required to provide clear and easily understandable information and instructions to consumers. This provision required the nationwide consumer reporting agencies to communicate to consumers, through the centralized source, information and instructions that may be needed by a consumer to request a free annual file disclosure. Under the proposed rule, such communications include informing consumers of the progress of their request for a file disclosure while they are in the process of making the request. Proposed rule § 610.2(b)(2)(iv)(A). For a website request method, the proposed rule also required the centralized source to provide access to a “help” or “frequently asked questions” screen. Proposed rule § 610.2(b)(2)(iv)(B). Finally, in the event that a consumer cannot be properly identified through the centralized source, the proposed rule required the nationwide consumer reporting agencies to notify the consumer of that fact, and to provide instructions on how to complete the request. Proposed rule § 610.2(b)(2)(iv)(C).

As stated in the NPR, the intent of these rule provisions was to ensure that centralized source materials are provided to consumers in plain language and that the centralized source is easy for consumers to use. A nationwide consumer reporting agency argues that the phrase “clear and easily understandable” is overly broad and subject to troubling interpretation. This commenter suggests that the Commission provide model language that could be used to give consumers the instructions and information required by the rule. Similarly, some consumer commenters suggest that the final rule should require that centralized source instructions be written at a 12-year old reading level. Since the instructions and information to be provided will be determined in substantial part by the format and structure of the yet-to-be-created centralized source, the Commission has decided not to include such model “information and instructions” in the final rule. The Commission also declines to require that centralized source materials be written to a specific reading level, but notes that evaluation of centralized source communications by consumer communication experts, and consumer testing, may be instructive in determining whether centralized source materials are “clear and easily understandable.”

Many consumer advocacy groups and a state official suggest that the centralized source be required to provide instructions in languages, other than English, that are spoken by a substantial number of consumers in the United States. These commenters point to the fact that a significant portion of the United States population communicates primarily in languages other than English. Having carefully considered these comments, the Commission has determined not to require instructions in other languages. The Commission believes that requiring multi-language translations of centralized source materials, including the centralized source website itself, would impose significant additional burden on the nationwide consumer reporting agencies at a time when they will already be responding to the multiple and varied new obligations that the FACT Act imposes upon them. Accordingly, the Commission declines, at this time, to require multi-language centralized source information and instructions. The Commission, however, intends to provide education and outreach to consumers concerning the final rule in Spanish^[31] — the language most commonly mentioned by commenters on this issue — and encourages other stakeholders in the centralized source, including the nationwide consumer reporting agencies, to do the same.

Consumer advocacy groups recommend that the centralized source be required to provide additional information, including a statement of the consumer’s right to obtain a credit score, a disclosure of the other circumstances under which a consumer is entitled to a free report (e.g., when a consumer is a victim of identity theft, unemployed, or a welfare recipient), and information about nationwide speciality consumer reporting agencies. The Commission does not adopt these recommendations, primarily because requirements to provide such additional information appear elsewhere in the FCRA.^[32] Similarly, requirements relating to nationwide speciality consumer reporting agencies are contained in final rule § 610.3. The Commission believes the dissemination of information required under these statutory and rule provisions is sufficient to inform consumers.

A nationwide consumer reporting agency recommends that the requirement of proposed rule § 610.2(b)(2)(iv)(A) that the centralized source provide “information on the progress of the consumer’s request while the consumer is engaged in the process of requesting a file disclosure” be limited to requests made using the Internet website. This commenter argues that this requirement will cause confusion in the telephone request context. The Commission has decided not to adopt this recommendation because it finds such information to be useful in the context of a telephone request. The purpose of having the centralized source provide such information is to ensure that consumers do not mistakenly discontinue the order process without finishing their request. The centralized source could comply with this requirement in the telephone context, for example, by instructing consumers to “please hold while we find your record.”

A nationwide consumer reporting agency recommends that the requirement of proposed rule § 610.2(b)(2)(iv)(A) be modified to state that it is not intended to allow a consumer to return to the centralized source to check the “status” of a request for an annual file disclosure already made, but rather is intended to keep the consumer informed as the request is being made. The language of the rule provision itself is clear on this point: it requires information on the progress of the request “while the consumer is engaged in the process of requesting a file disclosure.” This provision is intended only to require the centralized source to communicate with the consumer while the consumer is in the process of providing information to make the request. Once all the requisite information is provided, there is no further obligation for the centralized source to “update” consumers on the status of the processing of their request. The Commission has determined that the rule provision is clear as stated, and accordingly, adopts it as proposed. Final rule § 610.2(b)(2)(iv)(A).

The Commission received no comments regarding the language of proposed rule §§ 610.2(b)(2)(iv)(B) and (C). The Commission adopts § 610.2(b)(2)(iv)(A)-(C) as set forth in the proposed rule.

Make standardized form available.

Proposed rule § 610.2(b)(3) required that the centralized source make available to consumers a standardized form established jointly by the nationwide consumer reporting agencies. The Commission has adopted a model form which may be used to comply with this section. See final rule § 698, App. D. and the discussion of that section in this notice, infra. The Commission did not receive comment on § 610.2(b)(3), and it is adopted as proposed.^[33]

Section 610.2(c)—Requirement to anticipate

Proposed rule § 610.2(c) required nationwide consumer reporting agencies to implement reasonable procedures to anticipate and respond to the volume of consumers who will contact the centralized source through each request method. This requirement included developing and implementing contingency plans to address circumstances that may materially and adversely impact the centralized source. These contingency plans were to include measures to minimize the impact of such circumstances.

Implement reasonable procedures to anticipate and respond to volume.

General requirement. CDIA and the nationwide consumer reporting agencies object to the proposed rule requirement that nationwide consumer reporting agencies “implement reasonable procedures to anticipate, and respond to, the volume of consumers who will contact the centralized source through each request method, to request, or attempt to request, a file disclosure.” Proposed rule § 610.2(c). These commenters argue that this requirement will put them in the untenable position of defending their “guesses” regarding the required capacity, against the perfect hindsight of consumer litigants and the Commission.

This is not the case. Proposed rule §610.2(c) required only that the nationwide consumer reporting agencies develop and implement reasonable procedures to anticipate volume. It did not require the nationwide consumer reporting agencies to anticipate volume perfectly. The nationwide consumer reporting agencies have considerable experience in anticipating the likely volume of consumer contacts. For example, in the last five years, they have developed and implemented procedures to anticipate the volume of consumer calls to their toll-free dispute telephone numbers to facilitate their compliance with FCRA requirements.^[34] Also, the nationwide consumer reporting agencies have had to anticipate consumer request volume for free disclosures in those states where, under state law, consumers have previously been granted the right to obtain them. The Commission believes it is critical to meeting the objectives of the centralized source that the nationwide consumer reporting agencies implement reasonable procedures to anticipate and respond to consumer contact volume. The Commission believes this standard is both feasible and appropriate.

Set point for initial capacity. Proposed rule § 610.2(c) required the nationwide consumer reporting agencies to implement reasonable procedures to anticipate and respond to the volume of consumer contacts, both during and after the transition period for the centralized source. CDIA and the nationwide consumer reporting agencies argue that the absence of any actual volume data for centralized source operations makes this requirement impossible to meet during the first two years of implementation of the centralized source. These commenters claim that the Commission itself has declared initial request volume impossible to estimate,^[35] and, in the absence of any reliable historical data, the nationwide consumer reporting agencies should not be required to anticipate and respond to the “unknowable” volume of consumer contacts.^[36]

CDIA and the nationwide consumer reporting agencies suggest that the Commission should designate the starting capacity for the centralized source in the rule itself. Further, they argue that the starting capacity set point should constitute a safe harbor from all liability under the rule for the first two years of operations of the centralized source. In other words, they contend that the Commission should designate the starting capacity, and the nationwide consumer reporting agencies should not be required to exceed that capacity until December 2006.

For a number of reasons, the Commission does not believe such a rule provision would be appropriate, and thus has declined to adopt this suggestion. As noted above, the Commission believes that the § 610.2(c) requirement to implement reasonable procedures to anticipate and respond to capacity is both feasible and appropriate. In the NPR, the Commission explained how such reasonable procedures might be implemented, for example, by conducting a sample analysis of the only probative data available at that time. Thus, the Commission noted that,

“Although the precise demand for consumer free annual file disclosures on a nationwide basis is largely unknown, there is some available information that appears to be instructive in anticipating request volume when the rule becomes effective. For example, according to a Congressional Research Service Report to Congress, the consumer request rate for file disclosures in states where free annual disclosures are not currently available is 0.5% to 2%. In those states where consumers are, by state law, already guaranteed the right to a free annual disclosure, the request rate ranges from 3.5% to 10%. This represents an average disclosure rate that is 231% [of] the request rate in other states.^[37] Based upon these statistics alone, and taking into account also the publicity likely to be generated by the promulgation of the final rule, it would be reasonable to anticipate that the number of requests for annual file disclosures will be 300% of the current disclosure rate, absent any unanticipated intervening factors.”

69 FR at 13198. Based upon the comments and the information available to date, the Commission continues to believe that 300% of the current rate of file disclosures is a reasonable estimation of needed initial capacity for the centralized source.

Further, the Commission believes that the comments of CDIA and the nationwide consumer reporting agencies themselves demonstrate that it is possible to implement reasonable procedures to anticipate and respond to the volume of consumers who will contact, or attempt to contact, the centralized source.^[38] The nationwide consumer reporting agencies, not the Commission, are in the best position to anticipate likely demand for annual file disclosures, particularly as the initial implementation of the centralized source begins to provide additional data on the likely level of demand. The rule is designed and intended to require only that the nationwide consumer reporting agencies develop a reasonable initial estimate of adequate capacity, and then reasonably expand capacity if those estimates prove too low. Further, the nationwide consumer reporting agencies have decades of experience in dealing with consumer requests and disputes relating to consumer reports. In the Commission’s view, it would not be appropriate to substitute its estimation of consumer demand for free annual file disclosures for that of the seasoned business judgment of organizations that have superior access to existing relevant information and experience in the industry.

Similarly, as discussed further under § 610.2(i) of this notice, infra, the Commission does not believe that reasonable estimations can be made only after a full two years of centralized source operations. The final rule does, however, provide the nationwide consumer reporting agencies with a reliable safe harbor structure, based upon request volume, that applies both during and after the centralized source transition period. See discussion under §§ 610.2(e) and 610.2(i)(2)-(3), infra.

Developing and implementing contingency plans.

As part of its requirement for reasonable procedures to anticipate and respond to consumer request volume, proposed rule § 610.2(c) required the nationwide consumer reporting agencies to develop and implement contingency plans to address circumstances that may materially and adversely impact the operation of the nationwide consumer reporting agency, a centralized source request method, or the centralized source. Examples of the types of circumstances for which the nationwide consumer reporting agencies were required to develop contingency plans included natural disasters, telecommunications interruptions, equipment malfunctions, labor shortages, computer viruses, coordinated hacker attacks, and seasonal or other fluctuations in consumer request volume.

CDIA, the nationwide consumer reporting agencies, and some members of Congress comment that these provisions of the proposed rule “essentially require[d] the nationwide consumer reporting agencies to anticipate the unpredictable”^[39] and “perform despite those disasters.”^[40] These commenters suggest that the proposed rule imposed liability upon the nationwide consumer reporting agencies even if they were unable to accept or respond to consumer requests due to some unpredictable and materially adverse event. These commenters go on to posit that it would be more appropriate for the final rule to relieve the nationwide consumer reporting agencies of liability in the event of such circumstances than to impose a requirement to reasonably anticipate and respond to events that may be completely outside their control.

The proposed rule was not intended to suggest that nationwide consumer reporting agencies should be required to process requests for annual file disclosures despite any and all unpredictable and uncontrollable events that may hamper their performance. Rather, proposed rule § 610.2(c) was intended to require only that the nationwide consumer reporting agencies consider the types of material and adverse events that are reasonably likely to occur, and develop reasonable plans to address such events in ways that will minimize impact on the centralized source. Further, the Commission did not intend that this provision should be interpreted to require nationwide consumer reporting agencies to develop precise and unique plans for every particular event listed in the proposed rule or otherwise anticipated. Rather, the intent of this provision was to require that generally appropriate plans be developed and implemented, based upon the types of interruption such events may bring. Accordingly, final rule § 610.2(c) has been modified to clarify this intent, and references to specific types of events have been removed.

As clarified, the Commission believes the requirement for nationwide consumer reporting agencies to develop and implement contingency plans for material and adverse circumstances that are reasonably likely to occur is appropriate. The Commission notes that it is common practice in many industries to develop contingency and recovery plans for events that are not completely predictable but likely enough that contingency plans are appropriate. For example, it is not possible to predict exactly where and when a hurricane may strike. The final rule would not require nationwide consumer reporting agencies to have hurricane contingency plans regardless of where centralized source operations are located. If, however, centralized source operation centers are located in Miami, Florida, it would be reasonably likely—based upon historical weather patterns for that region— that a hurricane may occur that would materially and adversely impact those operations. In such a case, the final rule would require the nationwide consumer reporting agencies to develop and implement contingency plans to minimize the impact of such events, to the extent reasonably practicable under the circumstances.

The Commission also recognizes that some events may be predictable, but are so devastating that there are no reasonable measures that can be implemented to minimize impact. Thus, the Commission intends that the required contingency plans be tempered by two factors: the likelihood of a material and adverse event occurring, and the extent to which particular measures to minimize impact are reasonable under the circumstances. For example, even though a hurricane that will materially and adversely impact the centralized source operations in Miami, Florida may be reasonably likely to occur, the contingency plan for such an event need not include measures to minimize the impact of the complete destruction of the centralized source operations by a hurricane. Even if hurricanes of such destructive magnitude may have occurred in the region previously, there are no reasonable measures that could be undertaken to minimize the impact of such a devastating event.

As revised, § 610.2(c) is intended to reflect what would be sound business planning in nearly any industry. Indeed, in the Commission’s view, the nationwide consumer reporting agencies may comply with the requirement to develop and implement contingency plans under final rule § 610.2(c) by implementing the same contingency procedures for centralized source operations that they maintain and implement for their for-profit enterprises.

Specific measures to minimize impact.

Under the proposed rule the contingency plans required by paragraph (c) were to include specific reasonable measures to minimize the impact of material and adverse circumstances on the operation of the centralized source. These measures included, but were not necessarily limited to: (1) providing information to consumers on how to use another available request method; (2) communicating, to a consumer who attempts but is unable to make a request, the fact that a condition exists that has precluded the centralized source from accepting all requests, and the period of time after which the centralized source is reasonably anticipated to be able to accept the consumer’s request for an annual file disclosure; and (3) taking all reasonable steps to restore the centralized source to normal operating status as quickly as possible. Measures to minimize impact also included, as appropriate, collecting request information but declining to accept the request for processing until a reasonable later time, provided that the nationwide consumer reporting agency clearly and prominently informs the consumer when it will accept the request for processing. Proposed rule § 610.2(c)(2).

Industry commenters on this provision generally believe the list of measures to minimize impact to be sufficiently inclusive and the measures appropriate. CDIA and one nationwide consumer reporting agency comment, however, that, as proposed, this section required some measures to be performed “to the extent possible.” These commenters argue that a standard of what is “possible” is too broad and subjective to be truly meaningful. To address these concerns, the final rule provides that these measures should be undertaken “to the extent reasonably practicable under the circumstances.” Final rule § 610.2(c)(1).

Centralized source maintenance.

One nationwide consumer reporting agency comments that temporary outages may result from the need to perform maintenance on the centralized source Internet website or telephone lines. The commenter requests that the final rule clarify that such outages are not violations of the rule. The Commission acknowledges that particular request methods may be unavailable for reasonable periods of time due to the need for maintenance. Accordingly, final rule § 610.2(c)(2) provides that nationwide consumer reporting agencies shall not be in violation of the final rule’s adequate capacity requirement if a centralized source request method is unavailable for a reasonable period of time for purposes of maintenance. This provision requires, however, that only one request method be unavailable for such maintenance at any given time.

In light of the foregoing discussion, the Commission adopts proposed rule § 610.2(c) with some modifications. As explained above, the final rule requires nationwide consumer reporting agencies to develop and implement contingency plans for material and adverse events that are reasonably likely to occur. These contingency plans must contain measures to minimize impact “to the extent reasonably practicable under the circumstances.” Further, the final rule includes a new subparagraph (3) to clarify that the nationwide consumer reporting agencies are not in violation of the rule if a centralized source request method is temporarily unavailable for maintenance. Final rule §§ 610.2(c)(1) and (2). The Commission believes that final rule § 610.2 (c) appropriately balances the considerations of minimizing potential disruptions of the centralized source, and providing nationwide consumer reporting agencies with both flexibility and sufficient guidance in their compliance obligations.

Section 610.2(d)—Disclosure of all files

The proposed rule, in § 610.2(d), required a nationwide consumer reporting agency to provide an annual file disclosure to any consumer who requests one if the consumer reporting agency has the ability to provide a consumer report to a third party relating to that consumer. As noted in the NPR, this provision was intended to ensure that every consumer can obtain annual file disclosures through the centralized source from each of the nationwide consumer reporting agency systems, regardless of whether the information in that consumer’s file is owned by the nationwide consumer reporting agency or an associated consumer reporting agency. See 69 FR at 13197.

Files Owned by Associated Consumer Reporting Agencies.

As noted in the discussion of the definition of associated consumer reporting agency, supra, some nationwide consumer reporting agencies house within their systems data owned by one or more associated consumer reporting agencies. By virtue of such relationships with associated consumer reporting agencies, a nationwide consumer reporting agency, which does not itself own consumer files in a localized area or region of the country, is able to provide consumer reports on consumers residing in that area or region to its customers. On that basis, the proposed rule required nationwide consumer reporting agencies to provide free annual file disclosures to any consumer for whom they could sell a consumer report, even if they did not “own” that particular consumer’s file.

Representatives of the nationwide consumer reporting agencies raise many objections to this requirement. They comment that requiring them to disclose files owned by another consumer reporting agency is contrary to the intent of Congress, and outside the scope of the FACT Act. These commenters assert that although, absent such a requirement, not all consumers would be able to obtain annual file disclosures from each of the three identified nationwide consumer reporting agencies through the centralized source, this is a “problem,” in their view, based in the FACT Act itself, and the Commission should not attempt to fix it.

As stated in the NPR, the Commission believes that the legislative history indicates Congressional intent that all consumers be able to obtain free annual file disclosures from each of the three known nationwide consumer reporting agencies.^[41] The Commission does not believe that it was the intent of Congress to create pockets of the country in which consumers could obtain only one or two annual file disclosures through the centralized source. Further, the language of the FACT Act places the responsibility for providing annual file disclosures solely on the nationwide consumer reporting agencies. The Commission believes, therefore, that the intent of Congress and the mandate of the FACT Act are best realized by requiring the nationwide consumer reporting agencies to disclose to consumers all files in their possession that they can provide to third parties, including those residing on their systems but owned or maintained by an associated consumer reporting agency. Moreover, the Commission believes it is appropriate that if a nationwide consumer reporting agency has the ability to provide a consumer report on a consumer to a third party, and thereby profit from the sale of that report, that nationwide consumer reporting agency should disclose the file to the consumer.

As an alternative means of providing free annual file disclosures to all consumers, the nationwide consumer reporting agencies suggest that an associated consumer reporting agency should be considered a “consumer reporting agency that compiles and maintains files on consumers on substantially a nationwide basis,” as referred to in § 211(d)(6)(A) of the FACT Act, and that such agencies should be obligated to provide consumers with annual file disclosures through the centralized source. These commenters assert that all associated consumer reporting agencies are substantially nationwide, based upon their relationships with nationwide consumer reporting agencies. The Commission notes that associated consumer reporting agencies are a diverse group of entities, including many that own consumer credit files for only a small geographic area. The Commission believes it is not appropriate to classify all associated consumer reporting agencies, regardless of their size, the scope of their operations, or the number of files they own, as compiling and maintaining files on consumers “on substantially a nationwide basis” based solely on their contractual relationships with nationwide consumer reporting agencies.^[42]

The nationwide consumer reporting agencies also assert that this provision is unfair. They argue that the requirement to provide annual file disclosures for files owned by associated consumer reporting agencies gives the associated consumer reporting agencies an overwhelming advantage in any negotiations between the two entities for supplying and paying for the file disclosures. These commenters suggest that the Commission should include in the final rule provisions that would govern the bargaining between these entities-for example, by prohibiting the charging of certain fees by the associated consumer reporting agencies. The nationwide consumer reporting agencies assert that otherwise they will have unequal bargaining power when negotiating contracts with the associated consumer reporting agencies.

The Commission does not believe it is appropriate or necessary to intervene in the contractual relationships between the nationwide consumer reporting agencies and the associated consumer reporting agencies. These relationships have existed for many years, during which the parties have managed to successfully negotiate various kinds of terms and adjust to a wide variety of economic and regulatory changes affecting the industry. The nationwide consumer reporting agencies’ assertion that they will have little leverage in these negotiations seems improbable given the reciprocal and symbiotic nature of the relationships between these entities. The parties involved rely on each other to provide products or services of value to their customers. The associated consumer reporting agencies rely on the nationwide consumer reporting agencies to obtain updates for, and to some extent, to sell their consumer reports on a national basis. In return, the nationwide consumer reporting agencies rely on the associated consumer reporting agencies for access to files in parts of the country where the nationwide agency does not own files. It is clearly in the interests of both parties to maintain these relationships, and the Commission does not believe that the final rule will disrupt those interests or be substantially unfair to any of the parties.

In addition, one nationwide consumer reporting agency comments that the proposed rule does not specify that this provision applies only to its own files and those of associated consumer reporting agencies. Therefore, this commenter asserts, the rule provision could also be read to require a nationwide consumer reporting agency to disclose files owned by any other consumer reporting agency, regardless of whether the files were housed in the system of the nationwide consumer reporting agency. In order to clarify that this obligation applies only to files that are either owned by the nationwide consumer reporting agency itself, or housed on that agency’s system but owned by an associated consumer reporting agency, the final rule includes modified § 610.2(d) that clarifies the intended limited application of this provision.

Proper Identification of Consumers.

One nationwide consumer reporting agency comments that the obligation to provide an annual file disclosure should apply only when the nationwide consumer reporting agency can confirm the requester’s identity. The Commission notes that FCRA § 610(a)(1), 15 U.S.C. 1681h(a)(1), requires consumer reporting agencies to obtain proper identification from consumers before providing file disclosures. This statutory provision applies to those disclosures requested through the centralized source. Accordingly, § 610.2(d) of the rule has been modified to clarify that the nationwide consumer reporting agencies are obligated to provide annual file disclosures only upon proper identification in compliance with § 610(a)(1) of the FCRA, and § 610.2(b)(2)(ii) of the final rule.

Section 610.2(e)—High request volume and extraordinary request volume

The Commission recognizes that there may be times when the volume of consumer requests for file disclosures may be higher than anticipated, such as may overwhelm the systems of a nationwide consumer reporting agency or a nationwide specialty consumer reporting agency. As noted in the NPR, the Commission recognizes that, even with careful planning and preparation, it may be difficult for the nationwide consumer reporting agencies to anticipate and respond to consumer request volume under all circumstances. In light of these uncertainties, and in consideration of the possible impact of unexpected and extraordinary demand for annual file disclosures on the ability of the nationwide consumer reporting agencies to produce other file disclosures and consumer reports, the proposed rule provided some limits on the liability of nationwide consumer reporting agencies during times when request volume significantly exceeds what could reasonably have been anticipated. Proposed rule § 610.2(e).

Members of Congress, industry commenters-including CDIA, nationwide and associated consumer reporting agencies, and several trade organizations-strongly support the concept of liability relief (sometimes called “surge protection”) during times of heavy consumer request volume. These comments provide a number of compelling arguments that reasonable surge protection must be a feature of the final rule. They posit that, without such protections, the nationwide consumer reporting agencies could be overwhelmed with unexpected volume and be unable to respond to consumer requests-a situation that would frustrate consumers and thwart the purposes of the FACT Act and the rule. They also contend that maintaining vast amounts of excess capacity for the sole purpose of responding to sporadic surges is wasteful and prohibitively expensive.

In addition, a number of commenters who represent organizations that furnish consumer report information to nationwide consumer reporting agencies comment that large surges in annual file disclosure request volume may have a ripple effect for the whole financial services industry. Even if nationwide consumer reporting agencies could accept and process all of the requests for annual file disclosures during a surge, the corresponding surge in consumers contacting the nationwide and associated consumer reporting agencies and furnishers to dispute information contained in those reports would constitute a significant strain on the financial services industry. These commenters assert that surge protection must be provided to manage the number of requests for annual file disclosures that are accepted by nationwide consumer reporting agencies in the first instance, in part to allow the nationwide and associated consumer reporting agencies and furnishers to manage these “back end” effects.

In response to these comments, the final rule provides two tiers of relief for times when the consumer request volume is higher than the normal fluctuations in demand. In times of “high request volume”— i.e., when volume exceeds 125% of average — nationwide consumer reporting agencies may delay accepting requests for processing until a reasonable later time.^[43] Final rule § 610.2(e)(1). In addition, the rule provides a more complete limitation on liability in times of “extraordinary request volume”—i.e. exceeding 175% of the daily average volume- by allowing nationwide consumer reporting agencies to decline requests at such times. The Commission believes the combined structure of high request volume relief and extraordinary request volume relief provides the industry with adequate protection from unexpected, overwhelming request volume.

High and extraordinary request volume thresholds.

Under the proposed rule, extraordinary request volume occurred when the volume of requests exceeded twice the daily average volume. The Commission received comment from consumer advocacy groups expressing concern that the proposed rule definition of “extraordinary request volume” set the bar too low for the nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies to obtain relief from the rule’s requirements. In particular, these commenters are concerned that because extraordinary request volume was defined as only twice the daily average of consumer requests, a single security breach or national media event could produce request volume at the “extraordinary” level, thus allowing nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies to stop fulfilling file disclosure requests too frequently. In contrast, representatives of the nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies, as well as some members of Congress, express concern that relief that is triggered at twice the daily rolling average is, in fact, no relief at all. These commenters argue that such a standard would require the nationwide consumer reporting agencies to maintain an unrealistic amount of costly, daily excess capacity.^[44]

In addition, industry commenters noted that under the proposed rule, nationwide consumer reporting agencies, during the transition period, were permitted to queue requests for file disclosures and delay accepting such requests until a reasonable later time, when “high request volume” occurs. No such relief was provided under the proposed rule for nationwide specialty consumer reporting agencies or for nationwide consumer reporting agencies after the transition period. Compare proposed rule §§ 610.2(i)(3) and 610.3(g). Accordingly, industry commenters urge the Commission to revise the final rule to (1) lower the extraordinary request volume threshold from 200% to 125%, and (2) allow nationwide consumer reporting agencies to delay accepting requests for file disclosures by queuing them at an intermediate threshold of 115%, and to continue to have this option beyond the transition period. Some commenters also ask the Commission to adopt “high request volume” provisions that would apply to nationwide specialty consumer reporting agencies, both during and after the transition period. As noted above, the Commission agrees that the addition of high request volume relief during and after the transition for both nationwide and nationwide specialty consumer reporting agencies is appropriate.

In support of their argument that “high request volume” should be defined as any volume that exceeds 115% of the rolling daily average volume, the nationwide consumer reporting agencies posit that demand for file disclosures is so volatile and difficult to predict that even modest fluctuations beyond the average volume are likely to cause significant difficulty for their operations. The Commission notes that, according to CDIA, “volatility in contact rates usually ranges no higher (or lower) than 20% of the average baseline of contact.”^[45] The Commission believes that the nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies should be prepared to respond to such day-to-day volatility. High request volume and extraordinary request volume provisions, on the other hand, should be available to address volatility that significantly exceeds the norm.

In light of these comments, the final rule provides for “high request volume” relief when the number of consumers requesting or attempting to request file disclosures exceeds 125% of the rolling daily 90-day average volume. The Commission believes requiring the nationwide consumer reporting agencies to be prepared to accept 125% of the daily rolling 90-day average of consumer requests is reasonable. As one nationwide consumer reporting agency asserted: “We believe that maintaining a 25% buffer in excess capacity should be reasonably achievable and should be sufficient based on our historical experience with surges in demand for file disclosures.”^[46]

Further, the Commission notes that the threshold for extraordinary request volume is meant to be truly extraordinary because, at that level, the rule provides complete relief from liability. For as long as that level is maintained, the nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies are protected from liability under the rule even if they decline to accept additional consumer requests for file disclosures. See final rule §§ 610.2(e)(2) and 610.3(c)(2). As noted above, the Commission believes the nationwide consumer reporting agencies should be prepared to respond to normal, day-to-day volatility of 25% over average volume. The Commission also believes, however, that a volume that is more than three times that normal variation in demand—i.e. 175% of rolling 90-day daily average—would be “extraordinary,” and consequently the level at which extraordinary relief should be provided. Accordingly, the final rule provides that “extraordinary request volume” is volume that exceeds 175% of rolling 90-day daily average volume.

As noted above, some consumer advocacy groups assert that the high and extraordinary request volume threshold should not be set at a level that is likely to be triggered by a single event. The Commission notes, however, that the capacity of the centralized source likely cannot be expanded and contracted immediately in response to sudden, unpredictable events.^[47] Accordingly, the final rule provides for high and extraordinary request volume relief at request levels that significantly exceed normal fluctuations in demand, regardless of the particular causes of such fluctuations.

To ensure that the high and extraordinary request volume threshold functions as intended, however, the final rule alters the definition of extraordinary request volume slightly. The Commission notes that, once extraordinary request volume is reached, attempts to make requests for file disclosures may be declined or queued for later processing. See final rule §§ 610.2(e) and 610.3(c). These attempted requests, to the extent that they can be tracked, should be considered part of the consumer request volume. Accordingly, the final rule modifies the proposed rule’s definition of “extraordinary request volume” to make clear that the threshold is calculated based upon “the number of consumers requesting, or attempting to request, file disclosures during any 24-hour period.” Final rule § 610.1(b)(6).

Under the final rule high and extraordinary request volume are measured on the basis of requests for all types of file disclosures, rather than only requests for annual file disclosures. Although the FACT Act requires the nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies to develop the centralized source and streamlined process described in the final rule for the purpose of receiving requests for annual file disclosures, Congress specifically directed the Commission to consider “the significant demands that may be placed on consumer reporting agencies in providing [annual file disclosures],” and “appropriate means to ensure that consumer reporting agencies can satisfactorily meet those demands.” FACT Act § 211(d)(2). The significant demands of providing annual file disclosures include demands associated with simultaneously responding to requests for other types of file disclosures, such as free file disclosures resulting from adverse action under FCRA § 612(b), 15 U.S.C. 1681j(b), and free file disclosures provided in response to suspected fraud under FCRA § 612(c)(3), 15 U.S.C. 1681j(c)(3). Further, consumer reporting agencies may face additional significant demands in responding to inquiries, or requests for reinvestigation,^[48] generated through each of these types of file disclosures.^[49] Delays in this system caused by excess demand may adversely impact consumers with a specific, immediate need for access to their file disclosures and to reinvestigation procedures. Accordingly, it is appropriate to consider the volume of request for all types of file disclosures in determining “extraordinary request volume” for the purpose of limiting liability under the final rule. Final rule § 610.1(b)(6).^[50]

In addition, the Commission recognizes that the volume of requests for annual file disclosures will be particularly difficult to predict and volatile during the transition period. Due to such special considerations during the transition period, high and extraordinary request volume is defined differently during that period.^[51] See discussion of §§ 610.2(i) and 610.3(g) infra.

High and extraordinary request volume protections.

When high request volume occurs, nationwide consumer reporting agencies may collect consumer request information and delay accepting the request for processing until a reasonable later time. The nationwide consumer reporting agency must, however, clearly and prominently inform the consumer of when the request will be accepted for processing. This provision will provide nationwide consumer reporting agencies with some protection from unexpected surges, and, as one consumer advocacy group points out, it has the benefit of eliminating the need for consumers within the surge to reinitiate contact with the centralized source at a later time in order to obtain an annual file disclosure. In order to take advantage of this high request volume protection, however, the nationwide consumer reporting agency must implement reasonable procedures to anticipate consumer request volume developed in compliance with final rule § 610.2(c).

The FACT Act requires nationwide consumer reporting agencies to provide annual file disclosures within 15 days of when the request is received. By permitting nationwide consumer reporting agencies to queue some requests for annual file disclosures during times of high request volume, the final rule allows the nationwide consumer reporting agencies to postpone receiving those requests — and thereby postpone the running of the 15-day delivery requirement — for a reasonable period of time.^[52]

Under final rule § 610.2(e)(2), when extraordinary request volume occurs, nationwide consumer reporting agencies will not be deemed in violation of the rule’s requirement for adequate capacity, provided that they implement reasonable procedures to anticipate consumer request volume in compliance with § 610.2(c). This provision is adopted as proposed, with only minor modifications.

In the event of high or extraordinary request volume affecting a particular request method, the final rule requires nationwide consumer reporting agencies to direct consumers to other available request methods to the extent reasonably practicable. Final rule § 610.2(c)(1)(i)(A). Thus, high or extraordinary request volume affecting just one request method would not necessarily lead to a limitation on liability in relation to the operation of the other request methods.

The Commission believes that—taken in combination with the provisions of the FACT Act itself— the high and extraordinary request volume protections will provide appropriate and sufficient relief to the nationwide consumer reporting agencies and other affected businesses during times of unexpected, heavy volume. The 15-day time line for providing reports prescribed under the FACT Act allows considerable flexibility for nationwide consumer reporting agencies to smooth normal fluctuations in demand for “back end” services by managing when the requested annual file disclosures are provided. In times of excess volume, final rule provisions for high and extraordinary request volume allow the nationwide consumer reporting agencies additional flexibility to manage both the acceptance of the requests and timing of the processing of the requests.

Liability limitations contingent upon reasonable procedures.

CDIA and the nationwide consumer reporting agencies also comment that, under the proposed rule, surge protection was contingent upon the nationwide consumer reporting agency having complied with the § 610.2(c) requirement to develop and implement reasonable procedures to anticipate and respond to request volume. These comments assert that the development of contingency plans for material adverse events and relief from the effects of excess consumer request volume must remain distinct. To support this argument, CDIA uses this example:

“[i]t would be possible for the nationwide consumer reporting agencies to adopt reasonable procedures to anticipate consumer request volume, but to have the actual demand exceed their reasonable expectations. Under the proposed rule, these agencies could avail themselves of the extraordinary request volume provisions or high request volume provisions only if the agencies had also developed and implemented contingency plans to address circumstances that would materially and adversely impact the operations, even if none of those circumstances affected the actual volume of requests.”^[53]

The Commission believes this argument misinterprets the intended application of the rule. The purpose of requiring the nationwide consumer reporting agencies to implement reasonable procedures at all times, including during times of high or extraordinary request volume, is to ensure that the agencies respond, to the extent reasonably practicable under the circumstances, to material and adverse circumstances that impact the centralized source. It would seem of little use to require nationwide consumer reporting agencies to develop and implement reasonable procedures to anticipate and respond to consumer demand if there was no corresponding requirement to implement those procedures when they are most needed. Final rule § 610.2(e) ensures that excessive volume does not excuse the nationwide consumer reporting agencies from their responsibility to implement reasonable procedures to minimize impact on the centralized source, as required under § 610.2(c). Conversely, final rule § 610.2(e) should not be interpreted to deny high and extraordinary request volume protections to a nationwide consumer reporting agency because the agency failed to develop and implement contingency plans for events that are unrelated to the ability of the agency to respond to request volume during the time period at issue.

Ongoing staggering of availability of file disclosures.

The FACT Act § 211(d)(2) directs the Commission to consider “appropriate means to ensure that consumer reporting agencies can satisfactorily meet [the demands of providing annual file disclosures], including the efficacy of a system of staggering the availability to consumers of such [annual file disclosures].” The proposed rule provided for a staggering of availability over a nine-month transition in which regions of the country would successively become eligible every three months. The NPR stated that “there is no basis for concluding ongoing staggering of the availability of annual file disclosures is necessary” and, accordingly, the proposed rule did not provide for such staggering beyond the transition period. 69 FR at 13196.

The nationwide consumer reporting agencies urge the Commission to change this process in two ways: (1) to permit consumers to request file disclosures only during discrete periods of time (e.g., birth month or birth quarter); and (2) to continue this segmentation in perpetuity. One nationwide consumer reporting agency expresses doubt that the Commission has properly considered ongoing, permanent staggering of annual file disclosure availability. This commenter maintains the Commission is “ignor[ing] the plain language of the statute [by] maximizing consumer ease of access at the expense of the staggered availability contemplated by the statute.”^[54] The commenter suggests that the FACT Act requires the Commission to adopt such staggering if it is found to be effective in ensuring that nationwide consumer reporting agencies can meet their responsibilities.

The Commission has considered the significant demands placed upon the nationwide and nationwide specialty consumer reporting agencies in the process of formulating both the proposed and the final rule. As noted in the NPR, these demands include not only the provision of annual file disclosures to consumers, but also demands associated with simultaneously responding to requests for other types of file disclosures, such as free file disclosures resulting from adverse action under FCRA § 612(b), 15 U.S.C. 1681j(b), and free file disclosures provided in response to suspected fraud under FCRA § 612(c)(3), 15 U.S.C. 1681j(c)(3). Further, consumer reporting agencies may face additional significant demands in responding to inquiries, or requests for reinvestigation,^[55] generated through each of these types of file disclosures. The Commission has also considered, and adopted, a number of appropriate means to ensure that nationwide consumer reporting agencies can meet those demands, including a staggered transition period and two levels of surge protection. The Commission does not agree that the FACT Act’s direction to “consider . . . appropriate means to ensure that consumer reporting agencies can satisfactorily meet [the significant demands]” (emphasis supplied) equates to a mandate to adopt a particular scheme of staggering, especially when viewed in light of the FACT Act’s direction also to consider the ease by which consumers should be able to request annual file disclosures. FACT Act § 211(d).

The nationwide consumer reporting agencies themselves state that consumer demand for annual file disclosures, after the transition period, can be reasonably anticipated based upon experiential data. The final rule provides for a gradual, staggered roll-out, final rule § 610.2(i), and for protection from unexpected surges in file disclosure demand, both during the rollout period and thereafter, § 610.2(e). Further, the FACT Act provides nationwide consumer reporting agencies with considerable flexibility in meeting the significant demands placed upon them. As noted above, the FACT Act allows nationwide consumer reporting agencies 15 days from the time a request for an annual file disclosure is received to provide that disclosure. FACT Act § 211(a), codified at FCRA § 612(a)(2), 15 U.S.C. 1681j(a)(2). The Act also allows nationwide consumer reporting agencies a significantly longer period of time to resolve requests for reinvestigation when they originate from an annual file disclosure. FACT Act § 211(a), codified at FCRA § 612(a)(3), 15 U.S.C. 1681(a)(3) (45 days, rather than 30 days). In addition, annual file disclosures must be provided only once in a 12-month period. The 12-month limitation should result in the continuation of the demand-smoothing effects of the transition roll-out scheme, for the requests that are first made during that period. This provides some ongoing limitation on unexpected volume after the transition period-i.e., a consumer who received an annual file disclosure when his or her state first became eligible under the transition provisions is not eligible to request another such disclosure for 12 months.

Accordingly, the Commission determines that ongoing staggering of the availability of the annual file disclosures is not an appropriate means to ensure that the nationwide consumer reporting agencies can meet the significant demands placed upon them by the FACT Act, particularly when balanced against the interests of consumers in having ready access to file disclosures. The high and extraordinary request volume protections incorporated into the final rule achieve the same objective, and strike a better balance between the competing interests. The Commission intends, however, to closely monitor the progress of the transition and the capability of the nationwide consumer reporting agencies to respond to actual request volume, and may adjust the rule, as necessary or appropriate, in the future.

Section 610.2(f)—Information use and disclosure

Under the proposed rule, § 610.2(f) addressed only information security. The proposed rule did not contain any limitations on use and disclosure of information collected by the centralized source.^[56] In the NPR, the Commission posed several questions regarding what, if any, use and disclosure restrictions would be appropriate for the personally identifiable information collected through the centralized source. Based upon those comments, as described below, the Commission adopts a new § 610.2(f) in the final rule, addressing information use and disclosure. The provision of the proposed rule relating to information security has been deleted, as discussed below.

Information use and disclosure.

The majority of consumer and consumer advocate commenters assert that the final rule should contain restrictions on “secondary” use and disclosure of information collected through the centralized source. These commenters argue that consumers must be reassured that providing their information to the centralized source will not subject them to unintended consequences, such as unwanted marketing. Further, these commenters note that because concern for information privacy is “a key motivating factor for consumers to request their [file disclosures],” a final rule that does not restrict use and disclosure of information “will seriously impair [consumers’] trust in the system.”^[57] For these reasons, the commenters advocate that use and disclosure of information collected through the centralized source be limited to verifying the identity of the consumer making the request.

Similarly, some marketers of credit-related products and services also recommend that secondary uses of the personally identifiable information collected through the centralized source be prohibited. One commenter asserts, for example, that without such restrictions, “consumers will be forced to choose between exercising their rights [to obtain an annual file disclosure] . . .and maintaining their privacy.”^[58] Further, these commenters argue that the ability to use and disclose this consumer information would provide the nationwide consumer reporting agencies with an unfair competitive advantage.^[59] In contrast, CDIA comments that the final rule should not attempt to interfere with the use and disclosure requirements already applicable to such personal information.

The Commission notes that the information collected by the centralized source may include information that consumers view as particularly sensitive and vulnerable to misuse-such as Social Security numbers. Under FCRA §612(a)(1)(B), 15 U.S.C. 1681j(a)(1)(B), consumers can obtain annual file disclosures from the nationwide consumer reporting agencies only through the centralized source. In obtaining free annual file disclosures, then, consumers are compelled to use the centralized source. As a result, if consumers are reluctant to use the centralized source due to concerns relating to the use and disclosure of their personal information, the purpose of the FACT Act’s requirement for free annual file disclosures would be thwarted.

Further, as some commenters point out, the Commission believes it is not appropriate to make the availability of annual file disclosures — a right conferred by federal law — contingent on a consumer’s willingness to subject personal identifying information to unrelated, secondary uses. In this sense, the final rule is analogous to the Commission’s restriction on secondary uses of the Do Not Call Registry required by the Telemarketing Sales Rule, 16 CFR Part 310 (TSR). Under the TSR, use of the Commission’s Do Not Call Registry for purposes other than to prevent telephone calls to the persons listed is prohibited. 16 CFR 310.2(b)(2). Similar reasoning applies here; consumers should not be subjected to unrelated uses of their information as a condition of availing themselves of protections and benefits afforded to them by law.

For these reasons, in the final rule § 610.2(f), the Commission limits the use and disclosure of “any personally identifiable information collected from consumers as a result of a request for annual file disclosure, or other disclosure required by the [FCRA], made through the centralized source.” This provision applies only to personally identifiable information that is collected as the result of providing a statutorily-mandated product-such as a file disclosure or credit score. As noted under § 610.2(g) of this notice, infra, the final rule does not prevent nationwide consumer reporting agencies from offering other products and services through the centralized source. The Commission notes that use and disclosure of information collected as a result of a consumer purchase of one of these non-statutorily-mandated products is not subject to the limitation of § 610.2(f).

Final rule § 610.2(f) permits use and disclosure of personally identifiable information in four ways: “[1] to provide the annual file disclosure or other disclosure requested by the consumer; [2] to process a transaction requested by the consumer at the same time as a request for annual file disclosure or other disclosure; [3] to comply with applicable legal requirements, including those imposed by the Fair Credit Reporting Act and this [rule]; and [4] to update personally identifiable information already maintained by the nationwide consumer reporting agencies for the purpose of providing consumer reports, provided that the nationwide consumer reporting agency uses and discloses the updated personally identifiable information subject to the same restrictions that would apply to the information updated.”

The final rule makes it clear that personally identifiable information collected through the centralized source may be used and disclosed as necessary to process a transaction that the consumer requests at the same time as a statutorily-mandated disclosure. The purpose of this provision is to avoid requiring consumers to reenter the information in order to purchase a non-statutorily mandated product.

Some consumer advocacy organizations express concern regarding the use of information collected through the centralized source to enhance the nationwide consumer reporting agencies’ consumer reporting files. The final rule permits nationwide consumer reporting agencies to use the information collected through the centralized source to update the information they already maintain for consumer reporting purposes, but would not permit them to add additional information that they do not already collect from other sources — such as an email address. This provision would also prevent nationwide consumer reporting agencies from using the protected information to develop new consumer files for non-consumer reporting agency purposes.

The Commission notes that the information maintained by nationwide consumer reporting agencies for consumer reporting purposes is subject to a variety of restrictions under existing law. The Commission does not believe it would be appropriate to permit the updating of such information to interfere with any use and disclosure limitations that may apply to the existing data prior to the update. For this reason, this provision makes clear that if a nationwide consumer reporting agency uses personally identifiable information obtained from consumers requesting disclosures through the centralized source to update information it maintains for consumer reporting purposes, the updated information is subject to the same restrictions that apply to the original, pre-updated data. One commenter from outside the consumer reporting industry suggests that use and disclosure of information collected through the centralized source is already limited to “permissible purposes” under the FCRA.^[60] This commenter argues that any provision of the final rule that restricts the use and disclosure of such information would be an attempt to change the operation of the FCRA itself.^[61] This is not the case. The FCRA limits the use and disclosure of “consumer reports.” As noted above, most information collected through the centralized source is not a “consumer report” as that term is defined under the FCRA, and thus, the FCRA’s restrictions on use and disclosure of consumer reports do not apply. To the extent that information collected through the centralized source is consumer report information, final rule § 610.2(f) would permit the nationwide consumer reporting agencies to use that information to update their consumer report files. Thus, contrary to the commenter’s assertions, the final rule’s restriction on use and disclosure of information collected through the centralized source does not impact the availability of consumer reports for permissible purposes under the FCRA.

Information security.

The proposed rule, in § 610.2(f), required nationwide consumer reporting agencies to comply with the requirements set forth in Standards for Safeguarding Customer Information, 16 CFR 314 (the Safeguards Rule),^[62] regarding all personally identifiable information collected through or disclosed by the centralized source. Representatives of the nationwide consumer reporting agencies comment that this provision of the proposed rule is unnecessary because consumer reporting agencies are financial institutions subject to the Commission’s jurisdiction under GLBA, and thus, already subject to the Safeguards Rule. See 67 FR 36484, 36485 (May 23, 2002). Representatives of the nationwide consumer reporting agencies also comment that by requiring compliance with the Safeguards Rule in this rule, the Commission has sought to alter the scheme of GLBA by applying the FCRA’s private right of action to GLBA violations where no private right of action previously existed.

The Commission notes that the nationwide consumer reporting agencies are subject to a variety of existing laws relating to unauthorized access and/or security of information they collect and disclose, including, but not limited to the FCRA, the Safeguards Rule and the FTC Act. The record in this rulemaking provides no basis for concluding that these existing requirements are inadequate to address the information collected and disclosed through the centralized source, or that the centralized source creates any new or unique risks that are not addressed by such existing requirements. Thus, the Commission does not believe it is necessary to duplicate or augment those requirements in the final rule. Accordingly, § 610.2(f) of the proposed rule is not adopted in the final rule.

Section 610.2(g)—Communications provided by the centralized source

The Commission noted in the NPR that the centralized source would afford the nationwide consumer reporting agencies the opportunity to communicate information to consumers about other credit-related products and services they may sell. In addition, the Commission stated that the proposed rule would not prohibit these agencies from offering other file disclosures or products and services, in addition to the required annual file disclosures, through the centralized source. In order to ensure that such advertising or marketing does not undermine the purpose of the centralized source, or mislead consumers, § 610.2(g) of the proposed rule states that any communications provided through the centralized source “shall not interfere with, detract from, contradict, or otherwise undermine the purpose of the centralized source.” In addition, the proposed rule listed examples of representations that would be unacceptable: (1) pop-up advertisements that hinder the consumer’s ability to complete an online request for annual file disclosures; (2) representations that a consumer must purchase a product in order to receive or understand the file disclosures; (3) representations that the annual file disclosures are not free or that requesting them will have a negative impact on the consumer’s credit rating; and (4) representations that other products are free, if that is not the case, or failing to disclose clearly and prominently that a service advertised as initially free must be cancelled to avoid a charge.

The final rule retains this provision with only minor modifications. The example described in § 610.2(g)(2)(i) with respect to pop-up advertisements has been modified to make clear that any offers or promotions that hinder the consumer’s ability to complete an online request for file disclosures would constitute undue interference with the purpose of the centralized source.

A number of commenters, including consumer organizations, individual consumers, and businesses that market credit-related products or services, address this issue, urging the Commission to prohibit advertising and marketing on the centralized source. Competitors of the nationwide consumer reporting agencies argue that advertising and marketing would give the nationwide consumer reporting agencies an unfair competitive advantage. Consumer advocacy organizations argue that the promotion of products or services - other than credit scores - would necessarily confuse consumers and undermine the purpose of the centralized source. Moreover, they did not believe that any regulation could address adequately the potential for confusion or deceptive advertising practices. In addition, some argue that any advertising or marketing of products on the centralized source would carry an implication of government endorsement or approval of the products offered.

Most of these commenters further argue that there is no congressional authority to allow the centralized source to be used for other purposes. In addition, some suggest that if there is to be advertising and marketing on the centralized source, the source should be made available to other sellers of credit products or services or to consumer groups that wish to provide their own information about credit issues.

Comments from the nationwide consumer reporting agencies and CDIA generally favor the Commission’s approach on this matter, although some express concern that the language of this rule provision is not sufficiently specific to provide clear guidance.

Section 212(a) of the FACT Act requires that consumer reporting agencies inform consumers about the availability of credit scores when providing file disclosures to them. Further, a credit score that is based upon consumer reporting information can only be generated from that information. A consumer must be properly identified and the appropriate consumer file must be located in order for either a credit score or a file disclosure to be generated. It would be an anomalous result, for both consumers and the nationwide consumer reporting agencies, for the law to require the centralized source to inform consumers about the availability of credit scores, but not permit them to obtain credit scores at that juncture. Accordingly, it is consistent with the FACT Act to make both file disclosures and credit scores available through the centralized source. Allowing consumers who wish to purchase credit scores to do so at the same time that they obtain their annual file disclosures will result in efficiency for both consumers and nationwide consumer reporting agencies.

The statute, however, is silent with respect to other products or services that may be advertised or marketed on the centralized source. The Commission does not interpret this silence as an indication that the nationwide consumer reporting agencies are barred from the advertising or marketing of other products or services. An absolute prohibition of such communications would have to withstand scrutiny under U.S. Supreme Court decisions regarding the First Amendment and commercial speech. See Central Hudson Gas & Elec. Corp. v. Public Serv. Comm’n., 447 U.S. 557, 564 (1980). The Commission believes that its substantial interest in preventing communications that are misleading, confusing to consumers, or undermine the purpose of the centralized source can be served by less restrictive means than an absolute ban, and it has crafted § 610.2(g) accordingly.

The purpose of the centralized source is to enable consumers to make a single request to obtain annual file disclosures from the nationwide consumer reporting agencies. Advertising or marketing must be secondary to, and constrained by, that purpose. If a consumer is hindered in the effort to make an online request for file disclosures by the need to view and respond to, or close windows for, multiple offers of products and services, such communications would interfere with or undermine the purpose of the centralized source. Any representation that a consumer must purchase a product in order to receive or understand the annual file disclosure would contradict and detract from the right to obtain the free annual disclosure. Similarly, any representation that the file disclosure request itself will have a negative effect on the consumer’s credit rating would undermine and detract from the right to the free annual disclosure. The same would be true of misrepresentations about the cost of other products or services, or the terms of any subscription service such as credit monitoring.

The Commission further notes that the specific provisions of the rule are not the only mechanisms available to it to address deceptive or unfair marketing practices in connection with the operation of the centralized source. The FTC Act’s prohibition against such practices also would apply to the nationwide consumer reporting agencies in their joint operation of the centralized source, just as it does in their individual business operations. 15 U.S.C. 45(a). For example, any express or implied claim that any product or service offered via the centralized source bears government approval or endorsement would be deceptive, and therefore a violation of the FTC Act. The Commission believes that the enforcement tools available to the agency, under both the rule and the FTC Act, will enable it to ensure that the centralized source is operated in an appropriate manner - i.e., one that enables consumers to request their annual file disclosures easily and without being subjected to deceptive or unfair practices.

The Commission believes that, in general, competition with regard to credit-related products and services may be enhanced as a result of the final rule, because easier consumer access to file disclosures may create greater consumer awareness of the entire industry. Further, any competitive advantage for the nationwide consumer reporting agencies is created by the FACT Act’s requirement to establish the centralized source, an undertaking that imposes significant costs on the industry.

Section 610.2(h)—Effective date

The FACT Act, in § 211(d)(5), requires that the Commission issue centralized source regulations in final form no later than six months after the enactment date of the FACT Act, and that these rules take effect no later than six months after the date on which the regulations are issued in final form. The statute, therefore, requires that the effective date be no later than December 4, 2004.

The Commission proposed an effective date of December 1, 2004, at which time the phase-in of consumer eligibility for free annual file disclosures would begin. Some consumers suggest that this transition would begin too late, and that free annual file disclosures should begin to be available as soon as the final rule is issued. Some members of Congress assert that the transition should be completed, and all consumers should be eligible to request their free annual file disclosures, by December 4, 2004.

Representatives of the nationwide consumer reporting agencies comment that a six-month period is the minimum necessary time prior to the initial deployment of the centralized source to any portion of the country. These commenters explain that at least six months will be required to evaluate the final rule and design and build the necessary infrastructure for the centralized source.

The Commission has considerable recent experience in designing and implementing structures to respond to large volumes of consumer requests, e.g. the implementation of the Do-Not-Call Registry. After considering the FACT Act requirements under § 211(d), and the significant technological challenges presented by designing, building and implementing the centralized source required by this part, the Commission believes it is reasonable to require the nationwide consumer reporting agencies to begin to implement the centralized source about six months after the final rule is issued. Accordingly, the final rule becomes effective on December 1, 2004. Final rule § 610.2(h).

Section 610.2(i)—Transition

The final rule — like the proposed rule— requires a cumulative regional roll-out for the centralized source. Under § 610.2(i), the centralized source will become available to consumers by region, starting in the west and moving eastward across the country, at three-month intervals. Consumers residing in the western part of the United States (California and 12 other western states) will have access to the centralized source beginning on December 1, 2004.^[63] On March 1, 2005, consumers in 12 midwestern states also will become eligible to request their annual file disclosures from the centralized source. On June 1, 2005, the centralized source will become available to consumers in 11 southern states. Finally, on September 1, 2005, the centralized source will become available to all remaining consumers, including those residing in eastern states, the District of Columbia, and all U.S. territories and possessions.

Some consumers and consumer groups comment that there is insufficient evidence to justify any gradual transition scheme. Accordingly, those commenters suggest that annual file disclosures should be available without a segmented approach to consumer eligibility. These commenters also suggest that if the final rule provides for any transition, it should allow for only a very short “test” period when the centralized source would be available to a portion of the country. If the consumer demand proved overwhelming during the “test,” they argued, the Commission could then amend the rule to provide a more structured roll-out for the rest of the country. In contrast to these comments, all representatives of the consumer reporting industry emphasize the need for a substantial structured transition in order to manage initial consumer demand for annual file disclosures.

Section 211(d)(4) of the FACT Act requires that the Commission’s regulations provide for an “orderly transition” for nationwide consumer reporting agencies to fully implement the centralized source. The FACT Act directs that this transition be conducted in a manner that does not temporarily overwhelm such consumer reporting agencies with requests for disclosures beyond their capacity to deliver; and does not deny creditors, other users, and consumers access to consumer reports on a time-sensitive basis for specific purposes, such as home purchases or suspicions of identity theft, during the transition period. This provision of the statute clearly indicates that Congress contemplated allowing the nationwide consumer reporting agencies some period of time in which to build and implement the centralized source.^[64]

Given the significant development necessary to fully implement the centralized source, the Commission believes a gradual, segmented transition is appropriate. Further, the Commission notes that conditioning a structured transition on the results of a test period, as suggested by some commenters, would subject the availability of the centralized source to unreasonable uncertainty and delay. The Commission likely would not be able to examine test data and promulgate a revised rule without delaying the complete implementation of the centralized source. In the meantime, the nationwide consumer reporting agencies would be uncertain as to what this revised rule might require. Accordingly, the Commission believes that establishing, at the outset, a structured transition over a reasonable period of time will provide the best results for both industry and consumers.

Transition Length.

Consumers, consumer groups and members of Congress comment that the nine-month transition period set out in the proposed rule is unreasonably long, and that this delay in implementation is contrary to the intent of the FACT Act. These commenters point out that because the FACT Act was signed in December of 2003, and the transition does not begin until December of 2004, the nationwide consumer reporting agencies will already have had a year to work on meeting the requirements of the rule before the transition period begins. They assert that, without specific substantiation for such a delay, an additional nine months is an unreasonable amount of time for consumers — especially those at the end of the transition scheme — to wait to receive their annual file disclosures.

On the other hand, representatives of the nationwide consumer reporting agencies assert that a transition period of nine months is too short to ensure a smooth implementation. They contend that even with this time frame, they are compelled to begin the process of building the centralized source prior to issuance of the final rule. They argue that a transition of two years is needed to fully implement the centralized source. During the first year of this suggested transition, consumers would become eligible for discrete periods of time (rather than on a cumulative basis). These commenters maintain that the centralized source’s first year of operation will not provide reliable data to determine the appropriate baseline for operations of the centralized source, because demand will be uncharacteristically high due to consumer education efforts and media campaigns. The first six to nine months of the second year of operation, they argue, would provide better data to use in anticipating normal demand. After collecting that data, the nationwide consumer reporting agencies assert, they would adjust capacity accordingly.

The Commission concludes that the proposed nine-month transition period proposed is appropriate. It is important for consumers to become eligible to obtain their annual file disclosures as quickly as practicable. The large number of consumers who commented on the proposed rule and requested a shorter transition is evidence that many consumers place much value on receiving these file disclosures.

The Commission is mindful, however, that the transition provided by the final rule must enable the nationwide consumer reporting agencies to meet the significant demands of building and adjusting a system with adequate capacity to respond to requests from all eligible consumers at the end of the transition. The nationwide consumer reporting agencies comment that significant adjustments in the capacity of the centralized source will require 60 to 90 days. Accordingly, a nine-month transition provides the nationwide consumer reporting agencies with adequate opportunity to adjust capacity based upon the experience provided by the first two segments, prior to the implementation of the centralized source nationwide. Further, this transition length and roll-out assist in smoothing out demand after the transition. That is, each group to become eligible in a period will not be able to request another annual file disclosure for 12 months, which will cause some natural staggering by groups after the transition.

For these reasons, the Commission believes that nine months provides adequate time, in light of the number of consumer files maintained by the nationwide consumer reporting agencies and the significant development demands that the centralized source will require, to gradually build capacity to meet full demand. Accordingly, § 610.2(i)(1) is adopted as proposed.

Regional Rollout.

Consumers and consumer advocacy groups comment that, in the event the final rule provides for a rollout, a regional rollout is preferable to one based on birth date or other identifier. These commenters assert that a regional approach permits better consumer education through regional and local media, and it aids in household financial management in that it allows members of the same household to obtain their free annual file disclosures at the same time.

Representatives of the nationwide consumer reporting agencies suggest, however, that a preferable method of staggering eligibility would be by consumers’ birth month, or first initial of last name, rather than by region of the country. Some commenters, including a member of Congress, advocate staggering eligibility based upon Social Security number. The nationwide consumer reporting agencies argue that a regional approach would exacerbate demand on the centralized source due to local media and advocacy group efforts.

The Commission believes that a regional approach is the most effective and appropriate method to roll out the centralized source. A regional rollout can be easily understood by consumers and will be complemented by local and regional press coverage, which will remind consumers when the centralized source becomes available to their state or media market.^[65] Further, an approach that allows members of the same household to obtain their annual file disclosures at the same time is efficient and convenient for consumers.

Some commenters assert that the rollout of eligibility from the western part of the country eastward unreasonably discriminates against consumers residing in the east. The Commission acknowledges that consumers in the east will wait longer before becoming eligible to receive annual file disclosures than consumers elsewhere in the country. The Commission notes, however, that in any transition scheme, regardless of the method of segmentation, some segment will wait longer than others. Further, of the seven states where free file disclosures are currently available under state law,^[66] five are in the eastern segment of the transition. As noted in the NPR, the transition allows implementation of the centralized source to begin with the smallest segment by population — the west — and gradually build to the capacity to handle the addition of the final, largest segment. The Commission believes this structure to be an appropriate means of facilitating a smooth transition.

Representatives of the nationwide consumer reporting agencies comment that one nationwide consumer reporting agency currently receives a disproportionate number of requests for file disclosures in the western region as compared to other regions. Accordingly, these commenters suggest beginning the transition with a region other than the west. The Commission notes that, although one nationwide consumer reporting agency may currently receive a disproportionate number of file disclosure requests from consumers in the west, there is a smaller total population in that region than in any other segment of the transition. The Commission believes that the higher request rate in that region may not repeat itself in the requests for annual file disclosures. Indeed, since the requests in that region are already higher, it may be that the incremental increase in demand for annual file disclosures will be smaller in the west than in the other regions. Accordingly, the Commission adopts a regional rollout, which will occur in four segments, moving from west to east.^[67]

Surge Protection During the Transition

High request volume during transition. The proposed rule provided nationwide consumer reporting agencies with some relief, during the transition period, in times of high request volume that does not reach the extraordinary request volume benchmark. Under proposed rule 610.2(i)(3), when consumer request volume exceeded 115% of the rolling daily seven-day average, the nationwide consumer reporting agencies were permitted to place requests into a queue for processing at a reasonable later time. See discussion under § 610.2(e) of this notice, supra.

Representatives of the nationwide consumer reporting agencies comment in support of this intermediate threshold at which they could begin to queue consumer requests. These commenters suggest, however, that the level for high request volume, during the transition, should be set at any volume above the initial capacity^[68] of the centralized source, request method or nationwide consumer reporting agency. Consumers and consumer groups also comment on this provision of the rule, asserting that the 115% threshold was set too low because fluctuations in request volume at that level were not excessive. They suggest instead using a trigger of 200% of the daily rolling seven-day average.

The Commission believes that setting the threshold for high request volume during the transition at 115% is appropriate. Request volume is likely to be particularly volatile during the transition period. Thus, a transition high request volume threshold that is slightly lower than the post-transition threshold is appropriate. The 115% level is sufficiently sensitive to provide some relief to the nationwide consumer reporting agencies during times of unexpected high demand. Accordingly, the final rule, § 610.2(i)(2), generally provides for high request volume relief during the transition when volume exceeds 115% of the daily rolling seven-day average.

Extraordinary request volume during the transition. Under the proposed rule, during the transition, extraordinary request volume was generally defined as twice the daily rolling seven-day average volume of requests. In general, comments on the threshold for extraordinary request volume during the transition track the comments made regarding extraordinary request volume outside the transition, and are discussed fully under § 610.2(e) of this notice, supra. Because the final rule provides complete relief from liability when extraordinary request volume is reached, the Commission believes the same extraordinary request volume threshold—175% —is appropriate both during the transition period and after. Thus, the Commission determines that 175% of the daily rolling 7-day average volume is appropriate to provide relief to the nationwide consumer reporting agencies during periods of truly extraordinary request volume during the transition. Final rule § 610.2(i)(3).

First week of transition. As explained under § 610.2(e) of this notice, supra, the final rule generally provides high request volume and extraordinary request volume relief for the nationwide consumer reporting agencies when request volume reaches specific thresholds based upon rolling daily average of requests over the previous 90 days. During the transition period, when request volume may be most volatile, both high and extraordinary request volume levels are generally calculated based upon seven-day rolling averages, in order to accommodate the unique structure of the transition and the volatile demand for annual file disclosures that may prevail during that time.

During the first week of the transition, high and extraordinary request volume levels are determined in reference to the reasonably anticipated volume of consumer contacts to the centralized source. In other words, the nationwide consumer reporting agencies must use the reasonable procedures required under § 610.2(c) to develop an estimate of expected volume for each centralized source request method, the centralized source as a whole, and each nationwide consumer reporting agency. During the first week of operations, high request volume will be calculated at 115% of this reasonably anticipated baseline volume. Final rule § 610.2(i)(2)(i). Similarly, extraordinary request volume will be calculated based on 175% of that baseline. Final rule § 601.2(i)(3)(i). From the second week, until the end of the transition, high and extraordinary request volume will be calculated based upon the rolling average volume of the previous seven days. Final rule §§ 610.2(i)(2)(ii) and 610.2(i)(3)(ii).

The nationwide consumer reporting agencies object to this structure as requiring them to build a system that will have vast amounts of excess capacity, and to adjust that capacity within an unreasonably short period of time-i.e., a week. As noted in the NPR, because it is tied to a seven-day time frame, the standard for extraordinary request volume in fact may produce rapid expansion of the system. If extraordinary levels of demand persist, the system’s capacity would have to increase significantly every week in order to take advantage of the extraordinary request volume protections. CDIA asserts that these provisions would require the nationwide consumer reporting agencies to double the capacity of the system within two weeks of the implementation, and that such rapid expansion is simply not possible.

The Commission believes that, viewed in light of the overall structure of the transition, these provisions are reasonable and appropriate. The development of the centralized source is a complex project, and the Commission assumes that, by necessity, the vast majority of the development will be completed before the transition period begins. It is reasonable to expect that although it will be required to service only about one quarter of the country during the initial weeks of implementation, the system will at that point be capable of handling substantially more than the anticipated volume associated with that segment of the country. Accordingly, the Commission believes it is reasonable to expect rapid expansion of the system within the first segment if, for example, request volumes prove to be even greater than could be anticipated in the first week of operations.

Representatives of the nationwide consumer reporting agencies also comment that it may be unclear how the trigger for extraordinary request volume would operate during the first seven days of the transition. These commenters express concern that the provision may be interpreted to mean that the reasonably anticipated volume would adjust daily during that week. The Commission intends that the reasonably anticipated volume for that first week of the transition would remain constant.

Accordingly, final rule § 610.2(i)(2) defines high request volume during the first week as more than 115% of the daily total number of consumers that were reasonably anticipated to contact the centralized source and, from December 8, 2004 through the end of the transition, as more than 115% of the daily rolling seven-day average number of consumers that contact the centralized source. Similarly, § 610.2(i)(3) of the final rule defines extraordinary request volume during the first week as more than 175% of the daily total number of consumers that were reasonably anticipated to contact the centralized source and, from December 8, 2004 through the end of the transition, as more than 175% of the daily rolling seven-day average number of consumers that contact the centralized source.

Section 610.3(a)—Streamlined process for requesting annual file disclosures from nationwide specialty consumer reporting agencies-Streamlined process requirements.

Section 211 of the FACT Act requires nationwide specialty consumer reporting agencies ^[69] to provide annual file disclosures to consumers, once during any 12-month period upon the request of the consumer and without charge to the consumer. The FACT Act directs the Commission to prescribe regulations^[70] to require the establishment of “a streamlined process” for consumers to request their free annual file disclosures from these nationwide specialty consumer reporting agencies.^[71] The FACT Act expressly requires that the streamlined process must, at a minimum, include the establishment by each nationwide specialty consumer reporting agency of a toll-free telephone number for such requests. FACT Act § 211(a), codified at FCRA § 612(a), 15 U.S.C. 1681j(a).

Streamlined process requirements. Under the proposed rule § 610.3(a)(1), each nationwide specialty consumer reporting agency was required to establish a streamlined process for accepting and processing consumer requests for annual file disclosures, which, at a minimum, shall include the establishment of a toll-free telephone number for accepting such requests. To enable consumers to request annual file disclosures by telephone, the proposed rule required that nationwide specialty consumer reporting agencies make their streamlined process toll-free number available to consumers in specific ways: by publication in any telephone directory in which the entity has its telephone number published, § 610.3(a)(1)(ii), and by posting the toll-free number, along with instructions for requesting disclosures via any additional request methods, on any website owned or maintained by the entity, § 610.3(a)(1)(iii).

In response to a comment by CDIA, writing on behalf of its nationwide specialty consumer reporting agency members, the Commission modifies the wording of § 610.3(a)(1)(i) and (iii) in the final rule to make clear that the only required request method is the toll-free number; provision of additional request methods, such as mail or the Internet, is optional.

Further, one nationwide specialty consumer reporting agency suggests that for companies that own and maintain many websites, the requirement to post the toll-free number and instructions for additional request methods on all websites is burdensome, may artificially increase consumer demand for annual file disclosures, and could potentially confuse consumers. The Commission has not deleted this provision, but has modified it to make it clear that a nationwide specialty consumer reporting agency need only post this information on websites that it owns and maintains and that are related to consumer reporting. The § 610.3(a)(1)(iii) requirement is designed to make it as easy as possible for consumers to locate the nationwide specialty consumer reporting agencies and to learn how to request annual file disclosures. Several consumer advocacy organizations, in a joint comment, state that many consumers may be unfamiliar with the nationwide specialty consumer reporting agencies and the types of consumer files they maintain. They stress the importance of raising the public visibility of these agencies and informing consumers about the availability of these file disclosures. As the Commission noted in the NPR, this provision was not intended to require nationwide specialty consumer reporting agencies to post the toll-free telephone number on every page of a website. Rather, it was intended to require them to provide a clear and prominent link to such information on any website that the nationwide specialty consumer reporting agency owns or maintains that is related to consumer reporting. Final rule § 610.3(a)(1)(iii) makes this clear.

Under proposed rule § 610.3(a)(1)(i), nationwide specialty consumer reporting agencies were permitted, but not required, to provide request methods in addition to the required toll-free number, provided that when consumers contact the agency via its toll-free telephone number, they were given access to clear and easily understandable instructions for requesting annual file disclosures by any other available request method. In the final rule § 610.3(a)(1)(i), the Commission modifies this provision slightly to make clear that when a nationwide specialty consumer reporting agency provides instructions to consumers for requesting disclosures by any additional available request method, these instructions must “not interfere with, detract from, contradict, or otherwise undermine the ability of consumers to obtain annual file disclosures through the streamlined process.”

One nationwide specialty consumer reporting agency suggests that, because of its own unique and unusual business methods, taking a request by telephone would present difficulties for the company, such that it might not be able to service a request by telephone in as streamlined a manner as it could via alternative methods. The Commission notes, however, that the mandate of the FACT Act is unequivocal — at a minimum, each nationwide specialty consumer reporting agency must establish a toll-free telephone number for consumers to request their free annual file disclosures. The FACT Act and the final rule require nationwide specialty consumer reporting agencies to accept consumer requests for file disclosures over the telephone. A nationwide specialty consumer reporting agency that consistently directs consumers to another request method and does not permit requests to be made by telephone-by requiring consumers to go to a website or sign a specific form, for example-does not meet the mandate of the FACT Act or the final rule.

This commenter also suggests that requiring request methods other than telephone-for example mailing a signed document-is necessary to ensure proper identification of consumers. The Commission notes that FCRA § 610(a) requires consumer reporting agencies to obtain “proper identification” from consumers as a condition of providing a file disclosure. 15 U.S.C. 1681h(a). The final rule, however, permits nationwide and nationwide specialty consumer reporting agencies to collect only as much personally identifiable information from consumers as is reasonably necessary to properly identify the consumer. Final rule §§ 610.2(b)(2)(ii) and 610.3(a)(2)(ii). The Commission does not believe that FCRA § 610 is inconsistent with the requirement to accept requests by telephone. Given the unambiguous requirement of the FACT Act that nationwide specialty consumer reporting agencies accept telephone requests for annual file disclosures, it is incumbent upon nationwide specialty consumer reporting agencies to develop methods to identify consumers by telephone, to the extent practicable.

Operation of the streamlined process.

Under the proposed rule, the streamlined process was required to be “designed, funded, implemented, maintained and operated” in a manner that: has adequate capacity to accept reasonably anticipated volume, § 610.3(a)(2)(i); collects only as much personal information as is reasonably necessary to properly identify the consumer, §610.3(a)(2)(ii); and provides clear and easily understandable information and instructions, § 610.3(a)(2)(iii). These requirements are similar to the requirements for operation of the centralized source, discussed under § 610.2(b) of this notice, supra.

The proposed rule requirement to provide clear and easily understood information and instructions to consumers included a requirement to inform consumers of the progress of their request while they are in the process of making the request. Proposed rule § 610.3(a)(2)(iii)(A). For a Web site request method, if a nationwide specialty consumer reporting agency chooses to provide such a method, the proposed rule also required the nationwide speciality consumer reporting agencies to provide access to a “help” or “frequently asked questions” screen and instructions for filing complaints with the nationwide speciality consumer reporting agencies and the Federal Trade Commission. Proposed rule § 610.3(a)(2)(iii)(B). Finally, in the event that a consumer cannot be properly identified in accordance with the FCRA § 610(a)(1), 15 U.S.C. 1681h(a)(1), and other applicable laws and regulations, the proposed rule required the nationwide specialty consumer reporting agencies to notify the consumer of that fact, and to provide instructions on how to complete the request. Proposed rule § 610.3(a)(2)(iii)(C).

One nationwide speciality consumer reporting agency objects to the proposed rule requirement to inform consumers of the progress of their request while they are in the process of making the request, suggesting that it be eliminated because it is unclear, burdensome, and unworkable. For reasons similar to those discussed above in connection with the requirements of § 610.2(b)(2)(iv)(A) of the final rule, the Commission declines to adopt this recommendation. The language of this provision, which has been retained in the final rule, makes clear that the status information requirement operates “while the consumer is in the process of making a request;” thus, it would operate in the context of both telephone and on-line requests. For example, a status message that instructs telephone consumers to “please hold while we locate your file,” would ensure that consumers do not mistakenly discontinue the telephone ordering process without finishing their request. The Commission recognizes, however, that for other possible request methods, such as mail, the requirement would be inappropriate and therefore not apply.

The Commission did not receive further significant comment relating to proposed rule § 610.3(a), and it is adopted with the modifications discussed above.

Section 610.3(b)—Requirement to anticipate

Similar to the requirements relating to the centralized source, discussed under § 610.2(c) of this notice, supra, proposed rule § 610.3(b) required that nationwide specialty consumer reporting agencies implement reasonable procedures to anticipate and respond to the volume of consumers who will contact them to request file disclosures through the streamlined process.

One nationwide specialty consumer reporting agency and CDIA suggest that the requirements for contingency planning be deleted and replaced by a provision to relieve entities of any obligation to deliver reports when conditions beyond the control of the nationwide specialty consumer reporting agency occur. The Commission declines to adopt this suggestion. Rather, the final rule retains, but modifies, the contingency planning provisions applicable to nationwide specialty consumer reporting agencies, for the same reasons discussed under § 610.2(c) of this notice, supra.

Section 610.3(c)—High request volume and Extraordinary request volume

Under proposed rule § 610.3(c), nationwide specialty consumer reporting agencies would not be deemed in violation of the adequate capacity requirement in times of extraordinary request volume, provided that they implemented reasonable procedures in compliance with § 610.3(b).^[72] CDIA and a nationwide specialty consumer reporting agency suggest that the proposed definition of extraordinary request volume— i.e., volume that exceeds 200% of the rolling 90-day daily average—be revised.^[73] In the NPR, the Commission sought data with regard to the issue of setting the extraordinary request volume threshold; however, it received very little specific information relating to nationwide specialty consumer reporting agencies in this regard. For reasons discussed under § 610.2(e) of this notice supra, however, the final rule modifies the extraordinary request volume threshold to 175% of average daily volume.

In response to comments received with regard to the centralized source, as well as comments from CDIA, writing on behalf of its nationwide specialty consumer reporting agency members, the Commission has also crafted a provision to allow nationwide specialty consumer reporting agencies to obtain relief during times of high request volume. Final rule § 610.3(c)(1) allows a nationwide specialty consumer reporting agency to collect the request information in a queue for processing at a reasonable later time, so long as the nationwide specialty consumer reporting agency informs the consumer as to when the request will be accepted for processing. The high request volume trigger for nationwide specialty consumer reporting agencies is the same as that which applies to the centralized source-more than 125% of the rolling 90-day daily average. Final rule § 610.1(b)(8).

As noted under § 610.2(c) above, one comment from a nationwide consumer reporting agency suggests the need for some protection to apply during system maintenance. The Commission notes that this need is equally applicable to the nationwide specialty consumer reporting agencies. Final rule § 610.3(b)(2) provides that a nationwide specialty consumer reporting agency will not be deemed in violation of the streamlined process requirements if the toll-free number is unavailable to take requests for a reasonable period of time for purposes of maintenance, provided that the agency makes other request methods available to consumers during such time.

Section 610.3(d)—Information use and disclosure

Final rule § 610.3(d) provides that, “[a]ny personally identifiable information collected from consumers as a result of a request for annual file disclosure, or other disclosure required by the Fair Credit Reporting Act, made through the streamlined process required by this part, may be used or disclosed by the nationwide specialty consumer reporting agencies only “[1] to provide the annual file disclosure or other disclosure required under the FCRA requested by the consumer; [2] to process a transaction requested by the consumer at the same time as a request for annual file disclosure or other disclosure; [3] to comply with applicable legal requirements, including those imposed by the Fair Credit Reporting Act and this part; and [4] to update personally identifiable information already maintained by the nationwide specialty consumer reporting agency for the purpose of providing consumer reports, provided that the nationwide specialty consumer reporting agency uses and discloses the updated personally identifiable information subject to the same restrictions that would apply, under any applicable provision of law or regulation, to the information updated.” This provision is nearly identical to the information use and disclosure provision applicable to nationwide consumer reporting agencies in § 610.2(f), and is adopted subject to the same analysis provided under § 610.2(f) of this notice, supra.

Under § 610.3(d) of the proposed rule, nationwide specialty consumer reporting agencies also were required to comply with the Safeguards Rule, 16 CFR part 314, for information collected and disclosed through the streamlined process. CDIA and America’s Community Bankers, a trade association for the banking industry, suggest that this provision should not be applied to the nationwide specialty consumer reporting agencies. They argue that to the extent these entities are already subject to the Safeguards Rule under the GLBA, this rule would subject them to another layer of regulatory oversight. In addition, the commenters contend that under this rule, unlike under the GLBA Safeguards Rule, nationwide specialty consumer reporting agencies could be subject to private rights of action.

As noted under § 610.2(f), supra, of this notice, the information collected and disclosed by nationwide specialty consumer reporting agencies is subject to a variety of existing laws relating to unauthorized access and security of information, including, but not limited to, the FCRA, the Safeguards Rule, and the FTC Act. The Commission does not believe that it is necessary to duplicate or augment those requirements in the final rule. Accordingly, the final rule does not adopt proposed rule § 610.3(d).

Section 610.3(e)—Requirement to accept or redirect requests

The FACT Act requires nationwide consumer reporting agencies to provide annual file disclosures upon request, but only if such requests are received through the centralized source. As noted in the NPR, there is no similar statutory limitation applicable to the streamlined process to be developed by the nationwide specialty consumer reporting agencies. Accordingly, recognizing that many consumers may request their free annual file disclosures through a method other than the streamlined process, the final rule — like the proposed rule — requires nationwide specialty consumer reporting agencies either to honor those requests or to redirect the consumer to the streamlined process. Final rule § 610.3(e).

CDIA suggests that this provision be revised to make it analogous to the statutory requirement for the centralized source, i.e., to limit consumers’ ability to request free annual file disclosures from these agencies to the required streamlined process methods. The Commission declines to adopt this suggestion. Although it might easily have done so, Congress did not limit the availability of annual file disclosures from nationwide specialty consumer reporting agencies to only those consumers who make requests through the streamlined process. Moreover, the rule provision does not impose an onerous burden on the nationwide specialty consumer reporting agencies; they can choose either to honor the requests they may receive outside of the streamlined process request methods, or simply redirect consumers to those methods.^[74] Accordingly, § 610.3(e) is adopted as proposed.

Section 610.3(f)—Effective date

The proposed rule provided that § 610.3 become effective on December 1, 2004, the same effective date as rule provisions for the centralized source. This provision is unchanged in the final rule. Final rule § 610.3(f).

The Commission notes that the FACT Act requires that the rules implementing the annual file disclosure requirements relating to nationwide specialty consumer reporting agencies take effect no later than six months after the date on which the regulations are issued in final form-unless the Commission determines that up to an additional three months is appropriate. Further, the FACT Act requires the Commission to consider the ability of each nationwide specialty consumer reporting agency to provide annual file disclosures in the manner required under the Act, in determining the effective date for these provisions.

The Commission has considered these, as well as the other factors required by § 211(a) of the FACT Act and has determined that December 1, 2004, is an appropriate effective date for these provisions. The Commission recognizes that while nationwide specialty consumer reporting agencies will need some time to develop and implement the streamlined process required under the proposed rule, it appears that nearly six months from the issuance of the final rule is adequate, given the limited requirements of the final rule for nationwide specialty consumer reporting agencies.

One nationwide specialty consumer reporting agency requests that the Commission delay the effective date of the streamlined process requirement for three additional months in order to allow the agency to study how it can integrate its own traditional business methods with the new annual file disclosure obligation. This commenter further suggests that if the streamlined process effective date were delayed for three months, the nationwide specialty consumer reporting agencies would be protected from surges in request volume likely to occur as a result of publicity and consumer education surrounding the December 1, 2004, launch of the centralized source. Similarly, CDIA proposes that the final rule provide for the nationwide specialty consumer reporting agencies to activate their systems on December 1, 2004, but that they be given a three-month grace period, such that they would not be required to actually comply with the rule until March 1, 2005.

The Commission declines to delay the effective date for § 610.3 of the final rule for several reasons. Under § 610.3(g) of the final rule, discussed infra, the nationwide specialty consumer reporting agencies already receive protections from surges in volume that exceed the reasonably anticipated volume for that time. Although the rule provisions relating to nationwide specialty consumer reporting agencies may require the development of some new operations or systems, by December 1, 2004, they will have had nearly one year since the FACT Act became effective to study the issues, reasonably anticipate the volume, and implement appropriate procedures to accept requests via toll-free numbers. In addition, the Commission is adopting the same effective date for all parts of the rule in order to help consumers better understand the availability of annual file disclosures. The Commission believes that implementing a grace period would provide industry very little in the way of useful flexibility in complying with the rule, and would lead to greater confusion by the public. Accordingly, December 1, 2004, is the effective date for rule provisions relating to both nationwide consumer reporting agencies and nationwide specialty consumer reporting agencies. Final rule § 610.3(f).

Section 610.3(g)—High request volume and extraordinary request volume during initial transition

Nationwide specialty consumer reporting agencies must establish and operate a streamlined process with adequate capacity to meet consumer demand for annual file disclosures. Under the proposed rule, § 610.3(g), during the first three months after the rule becomes effective, liability under this provision would have been limited when the agencies experience extraordinary request volume of more than twice the anticipated request volume in a 24-hour period. After the three-month transition, extraordinary request volume would have been calculated as twice the daily rolling 90-day average.

Two nationwide specialty consumer reporting agencies and CDIA suggest that these entities need greater protection against high volume during a transition period, including a staggered rollout and lower request volume thresholds to trigger relief from liability. CDIA suggests that (in addition to delaying the effective date for three months) the rule should: 1) expand the transition period for the nationwide specialty consumer reporting agencies to encompass March 1, 2005 through November 30, 2005; 2) during the transition period, lower the trigger for extraordinary request volume to 125% of the daily total number of reasonably anticipated requests; and 3) add a high request volume trigger that would allow the nationwide specialty consumer reporting agencies to place requests into a queue for later processing when the volume in a 24-hour period exceeds the daily total number of reasonably anticipated requests.

The Commission recognizes that demand for consumer file disclosures from nationwide specialty consumer reporting agencies may increase significantly as a result of the new annual file disclosure availability. In order to assist these agencies in meeting this increase in demand, the Commission has modified § 610.3(g), by adding a high request volume benchmark to provide added protection from liability. High request volume during the transition is defined as, in any 24-hour period, more than 115% of the daily total number of requests that were reasonably anticipated. Final rule § 610.3(g)(1). Further, the extraordinary request volume provision has been lowered to 175%. Thus, the thresholds for extraordinary request volume and high request volume during the transition for the nationwide specialty consumer reporting agencies are comparable to those applicable to the nationwide consumer reporting agencies during the centralized source transition. See discussion under § 610.2(e) of this notice, supra.

Further, the final rule retains the proposed three-month transition period. Final rule § 610.3(g). For the same reasons discussed under § 610.3(f) of this notice, supra, the Commission has concluded that, given the limited requirements of the final rule as it applies to nationwide specialty consumer reporting agencies, neither a lengthy transition period nor a geographic rollout are appropriate.

Part 698 Appendix D—Standardized form for requesting annual file disclosures

Section 211 of the FACT Act directs the Commission to prescribe a regulation requiring that nationwide consumer reporting agencies employ a standardized form for consumers to request, either by mail or through an Internet website, annual file disclosures from the centralized source. Section 610.2(b)(3) of the rule requires that the nationwide consumer reporting agencies establish this form and make it available through the centralized source. In addition, the Commission proposed a model form, to be published in 16 CFR part 698, Appendix D (the “model standardized form”). The Commission stated in the proposed rule that nationwide consumer reporting agencies could use this form to comply with § 610.2(b)(3) of the rule.

A trade association representing real estate brokers expressed general support for the model standardized form, stating that it provided adequate information and was minimally intrusive. No commenters oppose the model standardized form, but several propose modifications.

The Commission received several comments from nationwide consumer reporting agencies and CDIA on the model standardized form. Some commenters object to the section of the model that would permit a consumer to designate the manner in which the consumer may be contacted by the nationwide consumer reporting agency if additional information is needed to process the consumer’s request. These commenters assert that permitting the consumer to designate an alternative telephone or email address that the nationwide consumer reporting agency might not be able to verify could create a risk of consumer fraud or identity theft. In response to these comments, the Commission has modified the model standardized form by deleting that section.

The same commenters also object to the last sentence of the proposed model standardized form, which stated “[y]ou can expect to receive your report within 15 days after we receive your request.” Nationwide consumer reporting agencies and CDIA point out that the statute requires the nationwide consumer reporting agency to provide the annual file disclosure “no later than” 15 days after receipt of the request and that reports sent by mail might involve additional time before the consumer actually receives the report. The Commission agrees that an annual file disclosure mailed on the fifteenth day would meet this requirement. Accordingly, the Commission has changed the last sentence of the model standardized form to the following: “[y]our report will be sent within 15 days after we receive your request.”

Some commenters also suggest other changes to the form, which the Commission did not adopt. Nationwide consumer reporting agencies and CDIA object to the provision of the proposed model standardized form that would allow the consumer to indicate his or her preferred delivery method for the annual file disclosure. These commenters express concern that the consumer’s preferred delivery method might not be available or appropriate under various circumstances. However, FCRA § 610(b), 15 U.S.C. 1681h(b) specifies that disclosures may be made in such forms as may be specified by the consumer and available from the agency. Further, the model standardized form clearly states that the nationwide consumer reporting agencies “may not be able to offer every delivery method to every consumer.” The Commission views the proposed change as inconsistent with the statute and has declined to alter this part of the model standardized form.

The nationwide consumer reporting agencies also propose various additions to the model standardized form. These commenters suggest that the form include additional information adapting it to Internet use, a certification by the consumer that the information provided by the consumer is accurate, a warning to the consumer of the consequences of making a fraudulent request, and a warning to the consumer that an altered form will constitute an invalid request. One nationwide consumer reporting agency proposes that the model standardized form add more specific directions as to how the consumer’s name and address should be provided and request a former address for a consumer who has resided less than two years at the current address. The Commission declines to add such additional information to its model standardized form, but notes that, as this form is a “model,” the nationwide consumer reporting agencies may add additional information, provided that such information or instructions are “clear and easily understandable,” in compliance with final rule § 610.2(b)(2)(iv). Similarly, the nationwide consumer reporting agencies may require additional categories of information, provided such information is reasonably necessary to process the request, consistent with the standard set forth in § 610.2(b)(2)(ii) of the final rule. The form could also, as one commenter suggests, be modified to offer credit scores to consumers, provided that such additions did not interfere with, detract from, contradict, or otherwise undermine the purpose of the centralized source, as required under § 610.2(g) of the rule.

IV. Substantially Nationwide Consumer Reporting Agencies.

Section 211(d)(6)(A) of the FACT Act directs the Commission to determine, by rulemaking, “whether to require a consumer reporting agency that compiles and maintains files on consumers on substantially a nationwide basis, other than one described in section 603(p) of the Fair Credit Reporting Act, to make [annual file disclosures] available upon consumer request, and if so, whether such consumer reporting agencies should make such [annual file disclosures] available through the centralized source described in paragraph (1)(A).”^[75]

The term “a consumer reporting agency that compiles and maintains files on consumers on substantially a nationwide basis, other than one described in section 603(p) of the Fair Credit Reporting Act” (hereinafter “substantially nationwide consumer reporting agencies”) is not defined under the FCRA or under the FACT Act. In its NPR, the Commission posed questions seeking detailed information about the existence of such entities in the U.S., including their identity and location, the population served by such agencies, the number of requests for file disclosures received and consumer reports generated by such entities, and the categories of information contained in such reports. In addition, the Commission sought information about the costs, benefits, and competitive effect of requiring any such agencies to provide free annual file disclosures and to do so through the centralized source.

The Commission received only minimal response to this question and very little specific information. Two nationwide consumer reporting agencies suggest that associated consumer reporting agencies, described above as agencies that own or maintain consumer files within systems operated by one or more nationwide consumer reporting agencies, should be deemed to be substantially nationwide consumer reporting agencies for purposes of this rule and required to participate in the centralized source. As explained in the discussion under § 610.2(d) of this notice, supra, however, the Commission is not convinced that associated consumer reporting agencies should be deemed substantially nationwide based solely on their contractual relationships with nationwide consumer reporting agencies.

Only one associated consumer reporting agency filed comments. It states that, apart from the nationwide consumer reporting agencies, it does not believe there are consumer reporting agencies in the U.S. that compile and maintain consumer files on substantially a nationwide basis.

In addition, a consumer advocacy organization suggests that nationwide specialty consumer reporting agencies should be considered to be substantially nationwide consumer reporting agencies. Pursuant to § 211(a) of the FACT Act, codified at FCRA § 612(a), 15 U.S.C. 1681j(a) and § 610.3 of the final rule, however, the nationwide specialty consumer reporting agencies will be obligated to provide consumers with free annual file disclosures. The FACT Act clearly contemplated that these nationwide specialty agencies would not be required to participate in the centralized source, but would be subject to a different regulatory scheme.

In light of the information available to it, the Commission determines that substantially nationwide consumer reporting agencies should not, at this time, be required to provide annual file disclosures. The Commission may, at a later time, determine that such entities should provide annual file disclosures, and that such disclosures should be made through the centralized source required by this rule.

V. Final Regulatory Flexibility Analysis.

The Regulatory Flexibility Act (“RFA”), 5 U.S.C. 601-612, requires that the Commission provide an Initial Regulatory Flexibility Analysis (“IRFA”) with a proposed rule and a Final Regulatory Flexibility Analysis (“FRFA”), if any, with the final rule, unless the Commission certifies that the rule will not have a significant economic impact on a substantial number of small entities (i.e., those with less than $6,000,000 in average annual receipts). 5 U.S.C. 603-605.

The Commission hereby certifies that the final rule will not have a significant economic impact on a substantial number of small entities. The rule applies to two types of consumer reporting agencies: (1) nationwide consumer reporting agencies, and (2) nationwide specialty consumer reporting agencies.^[76] As noted above, the Commission is aware of three entities that meet the rule’s definition, in § 610.1(b)(9), of a “nationwide consumer reporting agency.” The Commission has concluded that none of these is a small entity. In addition, the Commission estimates, based on its own experience and knowledge of industry practices and members, that there are fewer than 50 nationwide specialty consumer reporting agencies currently doing business in the U.S. The Commission has been unable to determine how many, if any, of these nationwide specialty consumer reporting agencies are small entities. In the March 19, 2004, NPR, the Commission asked several questions related to the existence, number and nature of small business entities covered by the proposed rule, as well as the economic impact of the proposed rule on such entities. The Commission received no comments responsive to these questions. Based on its own experience and knowledge of industry practices and members, however, the Commission believes that the number of such agencies that are small entities, if any, is likely to be insubstantial. While the economic impact of the final rule on a particular small entity could be significant, overall the final rule will not have a significant economic impact on a substantial number of small entities. This document serves as notice to the Small Business Administration of the agency’s certification of no effect. Nonetheless, the Commission has determined to publish a Final Regulatory Flexibility Analysis with this final rule. Therefore, the Commission has prepared the following analysis:

A. Need for and objectives of the rule.

The Fair and Accurate Credit Transactions Act of 2003, Pub. L. 108-159, 117 Stat. 1952 (FACT Act or the Act), directs the Commission to adopt a rule, no later than June 4, 2004, to require the establishment of: (1) a centralized source through which consumers may request a free annual file disclosure from each nationwide consumer reporting agency; (2) a standardized form for consumer use in making such requests; and (3) a streamlined process for consumers to request free annual file disclosures from nationwide specialty consumer reporting agencies. In this action, the Commission promulgates a final rule to fulfill the statutory mandate. The rule is authorized by and based upon § 211(a) and (d) of the FACT Act.

B. Significant issues raised by public comment.

The Commission received no public comments on the specific impact, if any, of the rule on small entities. As explained above, the Commission has estimated that there are few or no small entities that will be affected by the final rule. In that regard, the rule generally applies only to entities that would not be considered “small entities” for purposes of the Regulatory Flexibility Act.^[77]

The Commission has considered that § 610.3 of the rule, which establishes requirements for a streamlined process for consumers to request free annual file disclosures from nationwide specialty consumer reporting agencies, could apply to small entities, if any of them meets the definition of such a reporting agency. See final rule § 610.1(b)(10); FCRA § 603(w), 15 U.S.C. 1681a(w). Several commenters questioned certain aspects of the streamlined process provisions set forth in § 610.3, although none directly commented on the potential impact of those requirements on small entities, if any. In this Statement of Basis and Purpose, the Commission has explained its consideration of and response to those comments. The Commission has made certain changes in the final rule that should further minimize its impact on all nationwide specialty consumer reporting agencies, which would include those, if any, that may be small entities. These changes, which address limitations on liability during periods of high request volume, are explained above in the discussion of the revisions made to § 610.3 of the rule.

C. Small entities to which the rule will apply.

The rule will apply to two types of consumer reporting agencies: (1) nationwide consumer reporting agencies, and (2) nationwide specialty consumer reporting agencies. The Commission has concluded that none of the three identified nationwide consumer reporting agencies is a small entity. In the NPR, the Commission estimated that the number of nationwide specialty consumer reporting agencies that are small entities is either very small or none. In addition, the Commission invited comment and information on this issue. No comments addressed this issue, and no information with respect to small entities that might be affected by the rule was provided. Based on the lack of response to its request for comments, the Commission believes that its previous estimate is likely to be accurate.

D. Projected reporting, recordkeeping and other compliance requirements.

Under the rule, nationwide specialty consumer reporting agencies,^[78] which would be the only class of entities that could include small entities, if any, will be required to do the following: (1) provide consumers with free annual file disclosures; (2) establish a streamlined process, including a toll-free telephone number, for accepting and processing such consumer requests; (3) provide consumers with clear instructions on how to obtain free annual file disclosures; and (4) make additional disclosures to consumers during situations when adverse circumstances or extraordinary request volume affect the ability of the agency to accept consumer requests. The types of professional skills that will be necessary to fulfill these compliance requirements were described in the Commission’s Paperwork Reduction Act analysis, 69 FR at 13201-03.

E. Steps taken to minimize significant economic impact of the rule on small entities.

The Commission invited comment and information with regard to (1) the existence of small business entities for which the proposed rule would have a significant economic impact; and (2) suggested alternative methods of compliance that, consistent with the statutory requirements, would reduce the economic impact of the rule on such small entities.

The Commission received no information or suggestions in response to these questions. As explained above, however, the Commission has made certain changes to the final rule to minimize its impact on all entities that are subject to the rule, including small entities, if any, that may be subject to the rule.

VI. Paperwork Reduction Act.

In accordance with the Paperwork Reduction Act, as amended, 44 U.S.C. 3501 et seq., the Commission submitted the proposed Rule to the Office of Management and Budget (“OMB”) for review. The OMB has approved the Rule’s information collection requirements through April 30, 2007, and has assigned OMB control number 3084-0128.

VII. Final Rule.

List of Subjects

16 CFR Part 610

• Fair Credit Reporting Act
• Consumer reports
• Consumer reporting agencies
• Credit
• Trade practices

16 CFR Part 698

• Fair Credit Reporting Act
• Consumer reports
• Consumer reporting agencies
• Credit
• Trade practices

Accordingly, for the reasons set forth above, the FTC amends chapter I, title 16, Code of Federal Regulations, as follows:

1. Revise the heading of subchapter F of this chapter to read as follows:

SUBCHAPTER F-FAIR CREDIT REPORTING ACT

2. Add new part 610 to read as follows:

PART 610-FREE ANNUAL FILE DISCLOSURES

610.1

Definitions and rule of construction.

610.2

Centralized source for requesting annual file disclosures from nationwide consumer reporting agencies.

610.3

Streamlined process for requesting annual file disclosures from nationwide specialty consumer reporting agencies.

Authority: Pub. L. 108-159, sections 211 (a) and (d).

§ 610.1

Definitions and rule of construction.

(a) The definitions and rule of construction set forth in this section apply throughout this part.

(b) Definitions.

(1) Annual file disclosure means a file disclosure that is provided to a consumer, upon consumer request and without charge, once in any 12-month period, in compliance with section 612(a) of the Fair Credit Reporting Act, 15 U.S.C. 1681j(a).

(2) Associated consumer reporting agency means a consumer reporting agency that owns or maintains consumer files housed within systems operated by one or more nationwide consumer reporting agencies.

(3) Consumer means an individual.

(4) Consumer report has the meaning provided in section 603(d) of the Fair Credit Reporting Act, 15 U.S.C. 1681a(d).

(5) Consumer reporting agency has the meaning provided in section 603(f) of the Fair Credit Reporting Act, 15 U.S.C. 1681a(f).

(6) Extraordinary request volume, except as provided in sections 610.2(i) and 610.3(g) of this part, occurs when the number of consumers requesting or attempting to request file disclosures during any 24-hour period is more than 175% of the rolling 90-day daily average of consumers requesting or attempting to request file disclosures. For example, if over the previous 90 days an average of 100 consumers per day requested or attempted to request file disclosures, then extraordinary request volume would be any volume greater than 175% of 100, i.e., 176 or more requests in a single 24-hour period.

(7) File disclosure means a disclosure by a consumer reporting agency pursuant to section 609 of the Fair Credit Reporting Act, 15 U.S.C. 1681g.

(8) High request volume, except as provided in sections 610.2(i) and 610.3(g) of this part, occurs when the number of consumers requesting or attempting to request file disclosures during any 24-hour period is more than 125% of the rolling 90-day daily average of consumers requesting or attempting to request file disclosures. For example, if over the previous 90 days an average of 100 consumers per day requested or attempted to request file disclosures, then high request volume would be any volume greater than 125% of 100, i.e., 126 or more requests in a single 24-hour period.

(9) Nationwide consumer reporting agency means a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis as defined in section 603(p) of the Fair Credit Reporting Act, 15 U.S.C. 1681a(p).

(10) Nationwide specialty consumer reporting agency has the meaning provided in section 603(w) of the Fair Credit Reporting Act, 15 U.S.C. 1681a(w).

(11) Request method means the method by which a consumer chooses to communicate a request for an annual file disclosure.

(c) Rule of construction. The examples in this part are illustrative and not exclusive. Compliance with an example, to the extent applicable, constitutes compliance with this part.

§ 610.2

Centralized source for requesting annual file disclosures from nationwide consumer reporting agencies.

(a) Purpose. The purpose of the centralized source is to enable consumers to make a single request to obtain annual file disclosures from all nationwide consumer reporting agencies, as required under section 612(a) of the Fair Credit Reporting Act, 15 U.S.C. 1681j(a).

(b) Establishment and operation. All nationwide consumer reporting agencies shall jointly design, fund, implement, maintain, and operate a centralized source for the purpose described in paragraph (a) of this section. The centralized source required by this part shall:

(1) Enable consumers to request annual file disclosures by any of the following request methods, at the consumer’s option:

(i) A single, dedicated Internet website;

(ii) A single, dedicated toll-free telephone number; and

(iii) Mail directed to a single address;

(2) Be designed, funded, implemented, maintained, and operated in a manner that:

(i) Has adequate capacity to accept requests from the reasonably anticipated volume of consumers contacting the centralized source through each request method, as determined in accordance with paragraph (c) of this section;

(ii) Collects only as much personally identifiable information as is reasonably necessary to properly identify the consumer as required under the Fair Credit Reporting Act, section 610(a)(1), 15 U.S.C. 1681h(a)(1), and other applicable laws and regulations, and to process the transaction(s) requested by the consumer;

(iii) Provides information through the centralized source website and telephone number regarding how to make a request by all request methods required under section 610.2(b)(1) of this part; and

(iv) Provides clear and easily understandable information and instructions to consumers, including, but not necessarily limited to:

(A) Providing information on the progress of the consumer’s request while the consumer is engaged in the process of requesting a file disclosure;

(B) For a website request method, providing access to a “help” or “frequently asked questions” screen, which includes specific information that consumers might reasonably need to request file disclosures, the answers to questions that consumers might reasonably ask, and instructions whereby a consumer may file a complaint with the centralized source and with the Federal Trade Commission;

(C) In the event that a consumer requesting a file disclosure through the centralized source cannot be properly identified in accordance with the Fair Credit Reporting Act, section 610(a)(1), 15 U.S.C. 1681h(a)(1), and other applicable laws and regulations, providing a statement that the consumer’s identity cannot be verified; and directions on how to complete the request, including what additional information or documentation will be required to complete the request, and how to submit such information; and

(D) A statement indicating that the consumer has reached the website or telephone number operated by the national credit reporting agencies for ordering free annual credit reports, as required by federal law; and

(3) Make available to consumers a standardized form established jointly by the nationwide consumer reporting agencies, which consumers may use to make a request for an annual file disclosure, either by mail or on the Internet website required under section 610.2(b)(1) of this part, from the centralized source required by this part. The form provided at 16 CFR Part 698, Appendix D, may be used to comply with this section.

(c) Requirement to anticipate. The nationwide consumer reporting agencies shall implement reasonable procedures to anticipate, and to respond to, the volume of consumers who will contact the centralized source through each request method, to request, or attempt to request, a file disclosure, including developing and implementing contingency plans to address circumstances that are reasonably likely to occur and that may materially and adversely impact the operation of the nationwide consumer reporting agency, a centralized source request method, or the centralized source.

(1) The contingency plans required by this section shall include reasonable measures to minimize the impact of such circumstances on the operation of the centralized source and on consumers contacting, or attempting to contact, the centralized source.

(i) Such reasonable measures to minimize impact shall include, but are not necessarily limited to:

(A) To the extent reasonably practicable under the circumstances, providing information to consumers on how to use another available request method;

(B) To the extent reasonably practicable under the circumstances, communicating, to a consumer who attempts but is unable to make a request, the fact that a condition exists that has precluded the centralized source from accepting all requests, and the period of time after which the centralized source is reasonably anticipated to be able to accept the consumer’s request for an annual file disclosure; and

(C) Taking all reasonable steps to restore the centralized source to normal operating status as quickly as reasonably practicable under the circumstances.

(ii) Reasonable measures to minimize impact may also include, as appropriate, collecting request information but declining to accept the request for processing until a reasonable later time, provided that the consumer is clearly and prominently informed, to the extent reasonably practicable under the circumstances, of when the request will be accepted for processing.

(2) A nationwide consumer reporting agency shall not be deemed in violation of section 610.2(b)(2)(i) of this part if a centralized source request method is unavailable to accept requests for a reasonable period of time for purposes of conducting maintenance on the request method, provided that the other required request methods remain available during such time.

(d) Disclosures required. If a nationwide consumer reporting agency has the ability to provide a consumer report to a third party relating to a consumer, regardless of whether the consumer report is owned by that nationwide consumer reporting agency or by an associated consumer reporting agency, that nationwide consumer reporting agency shall, upon proper identification in compliance with section 610(a)(1) of the Fair Credit Reporting Act, 15 U.S.C. 1681h(a)(1), provide an annual file disclosure to such consumer if the consumer makes a request through the centralized source.

(e) High Request volume and extraordinary request volume.

(1) High request volume. Provided that a nationwide consumer reporting agency has implemented reasonable procedures developed in accordance with paragraph (c) of this section, entitled “requirement to anticipate,” the nationwide consumer reporting agency shall not be deemed in violation of paragraph (b)(2)(i) of this section for any period of time in which a centralized source request method, the centralized source, or the nationwide consumer reporting agency experiences high request volume, if the nationwide consumer reporting agency:

(i) Collects all consumer request information and delays accepting the request for processing until a reasonable later time; and

(ii) Clearly and prominently informs the consumer of when the request will be accepted for processing.

(2) Extraordinary request volume. Provided that the nationwide consumer reporting agency has implemented reasonable procedures developed in compliance with paragraph (c) of this section, entitled “requirement to anticipate,” the nationwide consumer reporting agency shall not be deemed in violation of paragraph (b)(2)(i) of this section for any period of time during which a particular centralized source request method, the centralized source, or the nationwide consumer reporting agency experiences extraordinary request volume.

(f) Information use and disclosure. Any personally identifiable information collected from consumers as a result of a request for annual file disclosure, or other disclosure required by the Fair Credit Reporting Act, made through the centralized source, may be used or disclosed by the centralized source or a nationwide consumer reporting agency only:

(1) To provide the annual file disclosure or other disclosure required under the FCRA requested by the consumer;

(2) To process a transaction requested by the consumer at the same time as a request for annual file disclosure or other disclosure;

(3) To comply with applicable legal requirements, including those imposed by the Fair Credit Reporting Act and this part; and

(4) To update personally identifiable information already maintained by the nationwide consumer reporting agency for the purpose of providing consumer reports, provided that the nationwide consumer reporting agency uses and discloses the updated personally identifiable information subject to the same restrictions that would apply, under any applicable provision of law or regulation, to the information updated or replaced.

(g) Communications provided by centralized source.

(1) Any communications or instructions, including any advertising or marketing, provided through the centralized source shall not interfere with, detract from, contradict, or otherwise undermine the purpose of the centralized source stated in paragraph (a) of this section.

(2) Examples of interfering, detracting, inconsistent, and/or undermining communications include:

(i) A website that contains pop-up advertisements or other offers or promotions that hinder the consumer’s ability to complete an online request for an annual file disclosure;

(ii) Centralized source materials that represent, expressly or by implication, that a consumer must purchase a paid product in order to receive or to understand the annual file disclosure;

(iii) Centralized source materials that represent, expressly or by implication, that annual file disclosures are not free, or that obtaining an annual file disclosure will have a negative impact on the consumer’s credit standing; and

(iv) Centralized source materials that falsely represent, expressly or by implication, that a product or service offered ancillary to receipt of a file disclosure, such as a credit score or credit monitoring service, is free, or fail to clearly and prominently disclose that consumers must cancel a service, advertised as free for an initial period of time, to avoid being charged, if such is the case.

(h) Effective date. Sections 610.1 and 610.2 shall become effective on December 1, 2004.

(i) Transition.

(1) Regional rollout. The centralized source required by this part shall be made available to consumers in a cumulative manner, as follows:

(i) For consumers residing in Alaska, Arizona, California, Colorado, Hawaii, Idaho, Montana, New Mexico, Nevada, Oregon, Utah, Washington, and Wyoming, the centralized source shall become available on or before December 1, 2004;

(ii) For consumers residing in Illinois, Indiana, Iowa, Kansas, Michigan, Minnesota, Missouri, Nebraska, North Dakota, Ohio, South Dakota, and Wisconsin, the centralized source shall become available on or before March 1, 2005;

(iii) For consumers residing in Alabama, Arkansas, Florida, Georgia, Kentucky, Louisiana, Mississippi, Oklahoma, South Carolina, Tennessee, and Texas, the centralized source shall become available on or before June 1, 2005; and

(iv) For all other consumers, including consumers residing in Connecticut, Delaware, District of Columbia, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, New York, North Carolina, Pennsylvania, Rhode Island, Vermont, Virginia, West Virginia, and all United States territories and possessions, the centralized source shall become available on or before September 1, 2005.

(2) High request volume during transition.

(i) During the period of December 1, 2004 through December 7, 2004, high request volume shall mean the following:

(A) For an individual request method: High request volume occurs when the number of consumers contacting or attempting to contact the centralized source through the request method in any 24-hour period is more than 115% of the daily total number of consumers that were reasonably anticipated to contact the centralized source, in compliance with paragraph (c) of this section, through that request method.

(B) For the centralized source as a whole: High request volume occurs when the number of consumers contacting or attempting to contact the centralized source in any 24-hour period is more than 115% of the daily total number of consumers that were reasonably anticipated to contact the centralized source, in compliance with paragraph (c) of this section, through any request method.

(C) For a nationwide consumer reporting agency: High request volume occurs when the number of consumers contacting or attempting to contact the nationwide consumer reporting agency to request file disclosures in any 24-hour period is more than 115% of the daily total number of consumers that were reasonably anticipated to contact that nationwide consumer reporting agency to request file disclosures, in compliance with paragraph (c) of this section.

(ii) During the period of December 8, 2004 through August 31, 2005, high request volume shall mean the following:

(A) For an individual request method: High request volume occurs when the number of consumers contacting or attempting to contact the centralized source through the request method in any 24-hour period is more than 115 % of the rolling 7-day daily average number of consumers who contacted or attempted to contact the centralized source to request file disclosures through that request method.

(B) For the centralized source as a whole: High request volume occurs when the number of consumers contacting or attempting to contact the centralized source in any 24-hour period is more than 115% of the rolling 7-day daily average number of consumers who contacted or attempted to contact the centralized source to request file disclosures through any request method.

(C) For a nationwide consumer reporting agency: High request volume occurs when the number of consumers contacting or attempting to contact the nationwide consumer reporting agency to request file disclosures in any 24-hour period is more than 115% of the rolling 7-day daily average of consumers who requested any type of file disclosure from that nationwide consumer reporting agency.

(3) Extraordinary request volume during transition.

(i) During the period of December 1, 2004 through December 7, 2004, extraordinary request volume shall mean the following:

(A) For an individual request method: Extraordinary request volume occurs when the number of consumers contacting or attempting to contact the centralized source through the request method in any 24-hour period is more than 175% of the daily total number of consumers that were reasonably anticipated to contact the centralized source, in compliance with paragraph (c) of this section, through that request method.

(B) For the centralized source as a whole: Extraordinary request volume occurs when the number of consumers contacting or attempting to contact the centralized source in any 24-hour period is more than 175% of the daily total number of consumers that were reasonably anticipated to contact the centralized source, in compliance with paragraph (c) of this section, through any request method.

(C) For a nationwide consumer reporting agency: Extraordinary request volume occurs when the number of consumers contacting or attempting to contact the nationwide consumer reporting agency to request file disclosures in any 24-hour period is more than 175% of the daily total number of consumers that were reasonably anticipated to contact that nationwide consumer reporting agency to request their file disclosures, in compliance with paragraph (c) of this section.

(ii) During the period of December 8, 2004 through August 31, 2005, extraordinary request volume shall mean the following:

(A) For an individual request method: Extraordinary request volume occurs when the number of consumers contacting or attempting to contact the centralized source through the request method in a 24-hour period is more than 175% of the rolling 7-day daily average number of consumers who contacted or attempted to contact the centralized source to request file disclosures through that request method.

(B) For the centralized source as a whole: Extraordinary request volume occurs when the number of consumers contacting or attempting to contact the centralized source in a 24-hour period is more than 175% of the rolling 7-day daily average number of consumers who contacted or attempted to contact the centralized source to request file disclosures through any request method.

(C) For a nationwide consumer reporting agency: Extraordinary request volume occurs when the number of consumers contacting or attempting to contact the nationwide consumer reporting agency to request file disclosures in a 24-hour period is more than 175% of the rolling 7-day daily average of consumers who requested any type of file disclosure from that nationwide consumer reporting agency.

§ 610.3

Streamlined process for requesting annual file disclosures from nationwide specialty consumer reporting agencies.

(a) Streamlined process requirements. Any nationwide specialty consumer reporting agency shall have a streamlined process for accepting and processing consumer requests for annual file disclosures. The streamlined process required by this part shall:

(1) Enable consumers to request annual file disclosures by a toll-free telephone number that:

(i) Provides clear and prominent instructions for requesting disclosures by any additional available request methods, that do not interfere with, detract from, contradict, or otherwise undermine the ability of consumers to obtain annual file disclosures through the streamlined process required by this part;

(ii) Is published, in conjunction with all other published numbers for the nationwide specialty consumer reporting agency, in any telephone directory in which any telephone number for the nationwide specialty consumer reporting agency is published; and

(iii) Is clearly and prominently posted on any website owned or maintained by the nationwide specialty consumer reporting agency that is related to consumer reporting, along with instructions for requesting disclosures by any additional available request methods; and

(2) Be designed, funded, implemented, maintained, and operated in a manner that:

(i) Has adequate capacity to accept requests from the reasonably anticipated volume of consumers contacting the nationwide specialty consumer reporting agency through the streamlined process, as determined in compliance with paragraph (b) of this section;

(ii) Collects only as much personal information as is reasonably necessary to properly identify the consumer as required under the Fair Credit Reporting Act, section 610(a)(1), 15 U.S.C. 1681h(a)(1), and other applicable laws and regulations; and

(iii) Provides clear and easily understandable information and instructions to consumers, including but not necessarily limited to:

(A) Providing information on the status of the consumer’s request while the consumer is in the process of making a request;

(B) For a website request method, providing access to a “help” or “frequently asked questions” screen, which includes more specific information that consumers might reasonably need to order their file disclosure, the answers to questions that consumers might reasonably ask, and instructions whereby a consumer may file a complaint with the nationwide specialty consumer reporting agency and with the Federal Trade Commission; and

(C) In the event that a consumer requesting a file disclosure cannot be properly identified in accordance with the Fair Credit Reporting Act, section 610(a)(1), 15 U.S.C. 1681h(a)(1), and other applicable laws and regulations, providing a statement that the consumer’s identity cannot be verified; and directions on how to complete the request, including what additional information or documentation will be required to complete the request, and how to submit such information.

(b) Requirement to anticipate. A nationwide specialty consumer reporting agency shall implement reasonable procedures to anticipate, and respond to, the volume of consumers who will contact the nationwide specialty consumer reporting agency through the streamlined process to request, or attempt to request, file disclosures, including developing and implementing contingency plans to address circumstances that are reasonably likely to occur and that may materially and adversely impact the operation of the nationwide specialty consumer reporting agency, a request method, or the streamlined process.

(1) The contingency plans required by this section shall include reasonable measures to minimize the impact of such circumstances on the operation of the streamlined process and on consumers contacting, or attempting to contact, the nationwide specialty consumer reporting agency through the streamlined process.

(i) Such reasonable measures to minimize impact shall include, but are not necessarily limited to:

(A) To the extent reasonably practicable under the circumstances, providing information to consumers on how to use another available request method;

(B) To the extent reasonably practicable under the circumstances, communicating, to a consumer who attempts but is unable to make a request, the fact that a condition exists that has precluded the nationwide specialty consumer reporting agency from accepting all requests, and the period of time after which the agency is reasonably anticipated to be able to accept the consumer’s request for an annual file disclosure; and

(C) Taking all reasonable steps to restore the streamlined process to normal operating status as quickly as reasonably practicable under the circumstances.

(ii) Measures to minimize impact may also include, as appropriate, collecting request information but declining to accept the request for processing until a reasonable later time, provided that the consumer is clearly and prominently informed, to the extent reasonably practicable under the circumstances, of when the request will be accepted for processing.

(2) A nationwide specialty consumer reporting agency shall not be deemed in violation of section 610.3(a)(2)(i) if the toll-free telephone number required by this part is unavailable to accept requests for a reasonable period of time for purposes of conducting maintenance on the request method, provided that the nationwide specialty consumer reporting agency makes other request methods available to consumers during such time.

(c) High request volume and extraordinary request volume.

(1) High request volume. Provided that the nationwide specialty consumer reporting agency has implemented reasonable procedures developed in accordance with paragraph (b) of this section, entitled “requirement to anticipate,” a nationwide specialty consumer reporting agency shall not be deemed in violation of paragraph (a)(2)(i) of this section for any period of time during which a streamlined process request method or the nationwide specialty consumer reporting agency experiences high request volume, if the nationwide specialty consumer reporting agency:

(i) Collects all consumer request information and delays accepting the request for processing until a reasonable later time; and

(ii) Clearly and prominently informs the consumer of when the request will be accepted for processing.

(2) Extraordinary request volume. Provided that the nationwide specialty consumer reporting agency has implemented reasonable procedures developed in accordance with paragraph (b) of this section, entitled “requirement to anticipate,” a nationwide specialty consumer reporting agency shall not be deemed in violation of paragraph (a)(2)(i) of this section for any period of time during which a streamlined process request method or the nationwide specialty consumer reporting agency experiences extraordinary request volume.

(d) Information use and disclosure. Any personally identifiable information collected from consumers as a result of a request for annual file disclosure, or other disclosure required by the Fair Credit Reporting Act, made through the streamlined process, may be used or disclosed by the nationwide specialty consumer reporting agency only:

(1) To provide the annual file disclosure or other disclosure required under the FCRA requested by the consumer;

(2) To process a transaction requested by the consumer at the same time as a request for annual file disclosure or other disclosure;

(3) To comply with applicable legal requirements, including those imposed by the Fair Credit Reporting Act and this part; and

(4) To update personally identifiable information already maintained by the nationwide specialty consumer reporting agency for the purpose of providing consumer reports, provided that the nationwide specialty consumer reporting agency uses and discloses the updated personally identifiable information subject to the same restrictions that would apply, under any applicable provision of law or regulation, to the information updated or replaced.

(e) Requirement to accept or redirect requests. If a consumer requests an annual file disclosure through a method other than the streamlined process established by the nationwide specialty consumer reporting agency in compliance with this part, a nationwide specialty consumer reporting agency shall:

(1) Accept the consumer’s request; or

(2) Instruct the consumer how to make the request using the streamlined process required by this part.

(f) Effective date. This section shall become effective on December 1, 2004.

(g) High request volume and extraordinary request volume during initial transition.

(1) During the period of December 1, 2004 through February 28, 2005, high request volume shall mean the following:

(i) For an individual request method: High request volume occurs when the number of consumers contacting or attempting to contact the nationwide specialty consumer reporting agency through a streamlined process request method in any 24-hour period is more than 115% of the daily total number of consumers who were reasonably anticipated to contact that request method, in compliance with paragraph (b) of this section.

(ii) For a nationwide specialty consumer reporting agency: High request volume occurs when the number of consumers contacting or attempting to contact the nationwide specialty consumer reporting agency to request file disclosures in any 24-hour period is more than 115% of the number of consumers who were reasonably anticipated to contact the nationwide specialty consumer reporting agency to request their file disclosures, in compliance with paragraph (b) of this section.

(2) Extraordinary request volume. During the period of December 1, 2004 through February 28, 2005, extraordinary request volume shall mean the following:

(i) For an individual request method: Extraordinary request volume occurs when the number of consumers contacting or attempting to contact the nationwide specialty consumer reporting agency through a streamlined process request method in any 24-hour period is more than 175% of the daily total number of consumers who were reasonably predicted to contact that request method, in compliance with paragraph (b) of this section.

(ii) For a nationwide specialty consumer reporting agency: Extraordinary request volume occurs when the number of consumers contacting or attempting to contact the nationwide specialty consumer reporting agency to request file disclosures in any 24-hour period is more than 175% of the number of consumers who were reasonably anticipated to contact the nationwide specialty consumer reporting agency to request their file disclosures, in compliance with paragraph (b) of this section.

3. Add new Part 698 with the following heading and authority citation:

PART 698 - SUMMARIES, NOTICES, AND FORMS

698.1

Authority and purpose.

698.2

Legal effect.

Appendix A-C to Part 698—[Reserved]

Appendix D to Part 698—Standardized Form for Requesting Free File Disclosure.

Authority: 15 U.S.C. 1681g and 1681s; Pub. L. 108-159, sections 151, 153, 211(c) and (d), 213, and 311.

§ 698.1

Authority and purpose

(a) Authority. This part is issued by the Commission pursuant to the provisions of the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.), as most recently amended by the Fair and Accurate Credit Transactions Act of 2003, Public Law 108-159, 117 Stat. 1952 (Dec. 4, 2003).

(b) Purpose. The purpose of this part is to comply with sections 607(d), 609(c), and 612(a) of the Fair Credit Reporting Act, as amended, and section 211 of the Fair and Accurate Credit Transactions Act of 2003.

§ 698.2

Legal effect

These summaries, forms and notices prescribed by the FTC do not constitute a trade regulation rule. They carry out the directives in the statute that the FTC prescribe these documents, which will constitute compliance with the part of any section of the FCRA requiring that such summaries, notices, or forms be used by or supplied to any person.

Appendix D to Part 698—Standardized form for requesting annual file disclosures.

By direction of the Commission.

Donald S. Clark,

Secretary.

Footnotes

1.  Section 609 of the FCRA requires disclosure of “[a]ll information in the consumer’s file at the time of the request.” 15 U.S.C. 1681g(a)(1). The FACT Act refers to the requirement to make “all disclosures pursuant to [FCRA] section 609 once during any 12-month period” without charge as providing free “consumer reports.” FACT Act 211(d). To avoid confusion, the rule refers to disclosures made pursuant to FCRA § 609 as “file disclosures” and to the free annual disclosures required under the FACT Act as “annual file disclosures.”

2.  The notice of proposed rulemaking (hereinafter, the NPR) and proposed rule were published in the Federal Register on March 19, 2004. 69 FR 13192.

3.  The public comments relating to this rulemaking may be viewed at www.ftc.gov/​os/​comments/​factafcr. The Commission considered all comments timely filed, i.e.-those received on or before the close of the comment period on April 16, 2004. As a matter of discretion, the Commission also considered comments that were filed after the close of the comment period. The total number of comments stated here includes more than 2,000 consumer comments collected through U.S. Public Interest Research Group, which are posted, in batch form, at U.S. Public Interest Research Group #EREG000604. Citations to comments filed in this proceeding are made to the name of the organization (if any) or the last name of the commenter, and the comment number of record. Comment number may appear as all numeric characters-e.g., #000031 (indicating a comment received by paper or electronic mail), or as numeric characters preceded by “EREG”-e.g., “EREG000031” (indicating a comment received through www.regulations.gov).

4.  These include AARP, Asociac íon Campesino Lazaro Cardenas Inc., CEIBA, Consumer Federation of America, Consumers Union, Del Norte Neighborhood Development Corporation, Electronic Privacy Information Center, Housing and Economic Development Asociac íon De Puertorriquenos, Latino Leadership, Inc., Midland Community Development Corporation, National Association of Consumer Advocates, National Consumer Law Center, National Consumers League, National Council of La Raza, NEWSED C.D.C., Privacy Rights Clearinghouse, Privacy Times, Self-Help Enterprises, Spanish Action League, Spanish Coalition for Housing, Tejano Center for Community Concerns, U.S. Public Interest Research Group (US-PIRG), and Watts/Century Latino Organization.

5.  In addition to Consumer Data Industry Association (CDIA)-the trade association that represents the nationwide consumer reporting agencies and a variety of other consumer reporting agencies-the Commission received comment on the proposed rule on behalf of a number of trade organizations representing a variety of industries and concerns. These include ACA International (representing debt collection agencies and other accounts receivable professionals), America’s Community Bankers, National Association of Realtors, Credit Union National Association (CUNA), Consumer Credit Counselors of Los Angeles, National Association of Mortgage Brokers, Mortgage Bankers Association, and Coalition to Implement the FACT Act (representing trade associations and companies that furnish, use, collect, and disclose consumer information).

6.  The Commission is aware of three entities that meet the FCRA § 603(p) definition of nationwide consumer reporting agency. These entities are Equifax Information Services LLC, Experian Information Solutions, Inc., and Trans Union LLC.

7.  These include ChoicePoint, Inc., Computer Sciences Corporation (CSC), Evergreen Credit Reporting Inc., and MIB Group, Inc. (MIB).

8.  These include Aegon Direct Marketing Services, Inc., Cendant Corporation, Chartered Marketing Services, Deluxe Corporation, Fair Isaac and Company, Inc., Intersections Inc., ReferencePro, and Schwartz & Ballen LLP.

9.  For example, Evergreen Credit Reporting Inc. See Comment, Evergreen Credit Reporting Inc. # 000031.

10.  For example, Fair, Isaac and Company, Inc. See Comment, Fair, Isaac and Company, Inc. #000011.

11.  Senator Charles E. Schumer (D-NY). See Comment, U.S. Senate #000022.

12.  These Representatives included Julia Carson, Joseph Crowley, Harold E. Ford, Jr., Barney Frank, Luis V. Gutierrez, Barbara Lee, Stephen Lynch, Brad Sherman, and Maxine Waters. See Comment, U.S. House of Representatives #000134.

13.  These Senators included Robert F. Bennett, Elizabeth Dole, Tim Johnson, and Thomas R. Carper. Comment, United States Senate #000137.

14.  These Representatives included Spencer Bachus, Judy Biggert, Rahm Emanuel, Jeb Hensarling, Ruben Hinojosa, Darlene Hooley, Steve Israel, Sue W. Kelly, Steven LaTourette, Dennis Moore, Robert W. Ney, Michael G. Oxley, Edward R. Royce, and David Scott. See Comment, U.S. House of Representatives #000136.

15.  The Commission notes that some commenters identify themselves as “nationwide specialty consumer reporting agencies.” Others, however, decline to use this term, although their services focus on one or more of the five categories of nationwide specialty consumer reporting agencies. By referring to both types of commenters as “nationwide specialty consumer reporting agencies” here, the Commission is not making a legal determination or factual finding that such entities meet the statutory definition of that term.

16.  Comment, Electronic Privacy Information Center #EREG000594.

17.  That is to say, associated consumer reporting agencies generally are not under common ownership or control with a nationwide consumer reporting agency. See FACT Act § 2 (4).

18.  The associated consumer reporting agency may also have the right to sell consumer information owned by the nationwide consumer reporting agency.

19.  Section 609 of the FCRA, 15 U.S.C. 1681g, requires every consumer reporting agency, upon request of the consumer, to disclose to the consumer, among other things, “all information in the consumer’s file at the time of the request.”

20.  It should be noted that the FCRA, as amended by the FACT Act, requires consumer reporting agencies to provide a free file disclosure to consumers under a number of different circumstances. In addition, under FCRA § 612(f), 15 U.S.C. 1681j(f), a consumer reporting agency must provide file disclosures to consumers for a fee, upon request. The requirement for nationwide consumer reporting agencies to provide annual file disclosures supplements, but does not replace, these other provisions. In other words, a consumer is entitled to obtain a free annual file disclosure through the centralized source, once in any 12-month period, even if that consumer has obtained other free or paid file disclosures in that time period. See FCRA § 612, 15 U.S.C. 1681j.

21.  FCRA § 609(a), 15 U.S.C. 1681g(a).

22.  Comment, Choicepoint #000039.

23.  These entities are Equifax Information Services LLC, Experian Information Solutions, Inc., and Trans Union LLC.

24.  Some commenters offer a similar argument in relation to the determination of what entities are nationwide specialty consumer reporting agencies. These commenters suggest that the Commission publish a list of such entities. For the reasons explained here, the Commission does not believe such a list would be appropriate.

25.  FCRA § 610(a)(2), 15 U.S.C. 1681h(a)(2), requires that file disclosures be made in writing, except as provided in subsection (b). Section 610(b), 15 U.S.C. 1681h(b), in turn, provides that disclosures may be made in forms other than in writing if such disclosures are (1) available from the consumer reporting agency and (2) specified by the consumer. Under § 610(b)(2), 15 U.S.C. 1681h(b)(2), consumers may specify that file disclosures may be made in person (under specified conditions), by telephone (upon written request), by electronic means (if available from the consumer reporting agency) or any other reasonable means that is available from the agency. Thus, under FCRA § 610(b), it is clear that consumers may specify any means of delivery for their file disclosures that are available from the consumer reporting agency.

26.  Similarly, some consumers suggest that the final rule should require that annual file disclosures be delivered within a specified period of time. The Commission notes that the FACT Act itself sets forth the appropriate timing for delivery of annual file disclosures. Under FACT Act § 211(a)(2), codified at FCRA § 612(a)(2), 15 U.S.C. 1681j(a)(2), “a consumer reporting agency shall provide [an annual file disclosure] not later than 15 days after the date on which the request is received . . ..” In light of this clear statutory mandate, the final rule does not further specify the timing for delivery of annual file disclosures.

27.  The Commission did, however, receive numerous comments on its companion provision, § 610.2(c), which requires reasonable procedures to anticipate and respond to the volume of consumer requests. See discussion under § 610.2(c) of this notice, infra.

28.  Comment, CDIA #000018

29.  For example, the nationwide consumer reporting agencies may want to collect information and statistics on the number of consumers that use the centralized source website and toll-free telephone number, so they can efficiently allocate resources.

30.  Throughout their comments, CDIA and the nationwide consumer reporting agencies repeatedly object to the use of “reasonable” standards in the proposed rule-such as may be found in proposed rule §§ 610.2(b)(2)(i) (“reasonably anticipated volume”); 610.2(b)(2(ii) (collect only as much information as is “reasonably necessary”); 610.2(b)(2)(iv)(B) (provide information that consumers might “reasonably need”); 610.2(c) (implement “reasonable procedures”); 610.2(c)(2)(i)(B) (time when centralized source may be “reasonably anticipated” to be able to accept requests); and 610.2(c)(2)(i)(C) (take all “reasonable steps” and defer requests until a “reasonable later time”). In general, the stated objection to such provisions is that the use of a “reasonable” standard is inappropriately vague, creates uncertainty and increases the risk of private litigation. The Commission notes, however, that, since its inception more than 30 years ago, the provisions of the FCRA itself have been based upon the concept of “reasonableness.” Indeed, Congress declared that the very purpose of the FCRA is “to require that consumer reporting agencies adopt reasonable procedures.” FCRA § 602(b), 15 U.S.C. 1681(b). Further, FCRA § 607(b) requires all consumer reporting agencies to “follow reasonable procedures to assure maximum possible accuracy” in consumer reports. 15 U.S.C. 1681e(b). Far from abandoning this approach, the FCRA, as amended by the FACT Act, uses the words “reasonable” or “reasonably” more than 70 times. Further, the “reasonable” standard is particularly appropriate when technology and the industry are continually changing. A more prescriptive standard might provide certainty today, but it would likely be overtaken and rendered anachronistic by advances in technology within a very short time. Accordingly, the Commission believes use of a “reasonable” standard in the final rule is appropriate and consistent with the regulatory scheme long established by the FCRA.

31.  The Commission has been active in both consumer outreach and enforcement initiatives relevant to Spanish-speaking consumers. See, e.g., www.ftc.gov/​opa/​2004/​04/​hispanicsweep2.htm. To date, the Commission has translated nearly 70 consumer publications into Spanish and posted them to the FTC’s En Espanol Web site at www.ftc.gov/​spanish.

32.  Section 609(d) of the FCRA as amended by the FACT Act, 15 U.S.C. 1681g(d), requires the Commission in consultation with other agencies to prepare and make available a summary of the rights of identity theft victims. Section 609(c) of the FCRA as amended by the FACT Act, 15 U.S.C. 1681g(c), requires the Commission to prepare and make available a Summary of Rights to Obtain and Dispute Information in Consumer Reports and to Obtain Credit Scores, which summary is required to be included with each written disclosure provided to the consumer by a consumer reporting agency, including free annual file disclosures. Pursuant to § 609(a)(6) of the FCRA, 15 U.S.C. 1681g(a)(6), as amended by § 212 of the FACT Act, consumers who request a file disclosure but not the credit score must be informed of the right to request and obtain a credit score.

33. The Commission did, however, receive comments on the content of the model standardized form contained in the proposed rule. These comments, and the final rule modifications to the model form, are discussed under the section of this notice entitled “Part 698 Appendix D,” infra.

34.  See, U.S. v. Equifax Credit Information Services, Inc., 1:00-CV-0087 (N.D. GA 2000), http://www.ftc.gov/​os/​2000/​01/​equifaxconsent.htm,, U.S. v. Experian Information Solutions, Inc., 3-00CV0056-L (N.D. TX 2000), http://www.ftc.gov/​os/​2000/​01/​experianconsent.htm,, U.S. v. Trans Union LLC, Civil Action No. 00C0235 (N.D. IL 2000), http://www.ftc.gov/​os/​2000/​01/​transunionconsent.htm.

35.  Comment, CDIA #000018. While the Commission acknowledged in the NPR that accurately anticipating the initial volume for the centralized source would be difficult, it did not state, and does not believe, that it is “impossible.” See 69 FR at 13198. This is especially true because the proposed and final rules require only reasonable procedures to anticipate volume.

36.  See, e.g., Comment, Experian Information Solutions, Inc. #000040.

37.  Loretta Nott and Angie Welborn, “A Consumer’s Access to Free Credit Report: A Legal and Economic Analysis,” Congressional Research Service, Library of Congress, July 21, 2003, p. 11.

38.  Trans Union declares that “we believe that there is sufficient data regarding experience with state free file disclosure requirements that would enable the Commission to develop a clear and reasonable standard for central source capacity at its inception.” Comment, Trans Union #000035. CDIA states that it “believes the initial capacity should be based on experiential data.” Comment, CDIA #000018. CDIA goes on to explain:“CDIA believes that the consumer request volume will be the highest in the first year that the centralized source is in operation. . . . As discussed above, . . . data indicates that consumer requests for all their file disclosures will be based on 231% of the current total number of requests for file disclosures received by the nationwide consumer reporting agencies in states that do not currently require free file disclosures. Thus, the approximate percentage attributable to the new federal free file disclosure right should be 131% of the current file disclosure request rate in those states. The total volume based upon those percentages should be adjusted to reflect the fact that 43 of the 51 jurisdictions do not currently require free file disclosures. The initial capacity of the centralized source and of each nationwide consumer reporting agency should be determined by applying the appropriate formula (i.e., based upon 231% or 131%) to the daily average of all consumer requests for file disclosures received by the nationwide consumer reporting agencies . . . .” These comments demonstrate that it is possible to examine existing data, draw conclusions based upon that examination, and develop reasonable procedures based upon those conclusions.

39.  Comment, CDIA #000018.

40.  Comment, Equifax Information Services, LLC #000028. See also, Comment, Experian Information Solutions, Inc. #000040; Comment, U.S. House of Representatives Committee on Financial Services #000136; and Comment, U.S. Senate #000137.

41.  “The centralized system shall allow consumers to obtain free reports from all three [nationwide consumer reporting] agencies using a single request.” S. Rep. No.108-166, at 17 (2003) (emphasis supplied).

42.  See discussion under section IV of this notice, infra.

43.  Except as provided in §§ 610.2(i) and 610.3(g), high request volume occurs when the number of consumers requesting or attempting to request file disclosures during any 24-hour period is more than 125% of the daily rolling 90-day average. Final rule § 610.1(b)(8).

44.  The Commission notes that while the nationwide consumer reporting agency and nationwide specialty consumer reporting agency commenters agree that the extraordinary request volume threshold contained in the proposed rule is too high, they are not similarly uniform in their opinion as to what the appropriate threshold should be. The nationwide consumer reporting agencies, as well as an associated consumer reporting agency, suggest the proper threshold is 125% of average volume. One nationwide specialty consumer reporting agency commenter suggests 110% of average volume.

45.  Comment, CDIA #000018.

46.  Comment, Trans Union #000035.

47.  The commenters who argue that extraordinary request volume relief should not be available at a level likely to be triggered by a single event cite to the possibility of a large-scale security breach or incidence of identity theft. The Commission notes that while the consumers impacted by such events may choose at that point in time to seek their annual file disclosures through the centralized source, that is not the only means by which they might obtain a file disclosure under those circumstances. Under the FCRA, an individual who “has reason to believe that the file on the consumer at the agency contains inaccurate information due to fraud” is entitled to a free file disclosure during any 12-month period. FCRA § 612(c)(3), 15 U.S.C. 1681j(c)(3). In addition, a consumer who asserts a good faith suspicion that he or she is or is about to become a victim of fraud or identity theft is entitled to a free file disclosure. FACT Act § 112, codified at FCRA § 605A, 15 U.S.C. 1681c-1. The Commission notes that these free file disclosures are available to consumers in such circumstances, in addition to — not in place of — the annual free file disclosure to be provided through the centralized source. FACT Act § 211(a), codified at FCRA § 612(a), 15 U.S.C. 1681j(a).

48.  See FCRA § 611(a), 15 U.S.C. 1681i(a).

49.  The Commission notes that the FACT Act has expanded consumers’ rights to obtain a free file disclosure in a number of ways. See, e.g., FACT Act § 112.

50.  For the same reasons, high request volume also is calculated based upon volume of all types of file disclosures.

51.  The final rule definition of extraordinary request volume found in § 610.1 (b)(6) also makes clear that this definition will prevail, except during the transition periods defined in §§ 610.2 (i) and 610.3 (g). As noted, the term is defined differently in those sections, for the duration of the transition periods described.

52.  What constitutes a “reasonable period of time” to postpone accepting requests will likely depend on a number of factors, including the length and magnitude of the surge. For example, if high request volume lasts only one day, it may not be reasonable to postpone accepting the request for annual file disclosures for three weeks. In addition, the rule does not specify how the nationwide consumer reporting agencies should process requests placed in a queue versus new requests after high request volume ceases. The nationwide consumer reporting agencies are in the best position to manage their resources to process these requests. However, because the nationwide consumer reporting agencies may only postpone accepting requests for a “reasonable period of time,” they must efficiently process requests placed in a queue, and it would be logical to process requests in a chronological order from the time they were received.

53.  Comment, CDIA #000045.

54.  Comment, Equifax Information Services LLC #000028.

55.  See FCRA § 611(a), 15 U.S.C. 1681i(a).

56.  Proposed rule § 610.2(b)(2)(ii) did address collection of information by the centralized source, but not use or disclosure of the information collected. This provision has been altered slightly in the final rule. See discussion under § 610.2(b) of this notice, supra.

57.  Comment, Consumer Federation of America et al. #000019.

58.  Comment, Intersections Inc. #000034.

59.  These commenters assert the same arguments that some advanced to support banning the marketing and advertising of non-statutorily mandated products on the centralized source. The Commission’s response to this argument is discussed under § 610.2(g) of this notice.

60.  See FCRA § 604, 15 U.S.C. 1681b.

61.  Comment, ACA International #000043.

62.  16 C.F.R. Part 314 was promulgated by the Commission pursuant to the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. 6801 et seq.

63.  According to the 2000 U.S. Census, these states account for 22.1% of total U.S. population.

64.  Some commenters suggested that even if the rule allows a transition period to phase in the availability of the centralized source, consumers who approach an individual nationwide consumer reporting agency directly should be entitled to receive their free annual file disclosures without waiting. The FACT Act amended FCRA § 612(a) to require the nationwide consumer reporting agencies to make free annual file disclosures upon request of the consumer. This right was limited, however, to requests that are made using the centralized source. FCRA § 612(a)(1)(B), 15 U.S.C. 1681j(a)(1)(B).

65.  The regional divisions do not divide metropolitan statistical areas.

66.  Colorado, Maine, Maryland, Massachusetts, New Jersey, Georgia, and Vermont. The frequency of the availability of free file disclosures in these states is not preempted by the FACT Act. FACT Act § 212(e)(4).

67.  Some commenters raised questions regarding the timing of eligibility of consumers serving in military active duty. Consumers serving in military active duty will become eligible during the transition based on their addresses of record with creditors. The FACT Act provides additional rights to consumers on military active duty and their families. See, FACT Act § 112.

68.  See discussion of initial capacity, under § 610.2(c) supra.

69.  As explained under § 610.1(b)(10) of this notice, supra, a “nationwide specialty consumer reporting agency” means “a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis relating to (1) medical records or payments; (2) residential or tenant history; (3) check writing history; (4) employment history; or (5) insurance claims.” FCRA § 603 (w), 15 U.S.C. 1681a (w).

70.  In promulgating its regulations applicable to nationwide specialty consumer reporting agencies, the Commission considered: 1) the significant demands that may be placed on consumer reporting agencies in providing annual file disclosures; 2) appropriate means to ensure that consumer reporting agencies can satisfactorily meet those demands, including the efficacy of a system of staggering the availability to consumers of such file disclosures; and 3) the ease by which consumers should be able to contact consumer reporting agencies with respect to access to such file disclosures. FACT Act, § 211(a)(2).

71.  One nationwide specialty consumer reporting agency suggests that the FTC further define: the term “nationwide specialty consumer reporting agency;” the meaning of the enumerated types of information that trigger § 603(w) status; the phrase “compiled and maintained;” and the information required to be disclosed in the “annual file disclosure.” See discussion under § 610.1(b) of this notice, supra.

72.  One commenter mistakenly suggests that the proposed rule contains no definition of “extraordinary request volume” applicable to nationwide specialty consumer reporting agencies beyond the transition period described in proposed rule § 610.3(g). As final rule § 610.1(a) explains, the definitions contained in section 610.1(b) apply throughout this part, including in both § 610.2 and § 610.3 of the final rule.

73.  The consumer reporting agency recommends that “extraordinary request volume” be set at 110% of the rolling 90-day daily average, and CDIA suggests that “extraordinary request volume” should be more than 125% of the rolling 90-day daily average.

74.  One nationwide specialty consumer reporting agency requests that the rule include a general limitation on liability for private causes of actions under proposed rule § 610.3(e), as well as other rule provisions, in order to limit the circumstances under which a nationwide specialty consumer reporting agency is at risk of private actions, including class actions. The FCRA, as amended by the FACT Act, however, provides a specific scheme of enforcement and liability for violations of the FCRA. Where Congress intended to limit private rights of action, it did so. See FCRA § 615(h)(8). Accordingly, the Commission declines to include additional limitations in the final rule.

75.  In making this determination, the Commission is required by the Act to consider the number of consumer reports sold by such entities, the overall scope of operations of such entities, the costs to such entities of providing annual file disclosures to consumers, and the competitive viability of such entities if they are required to provide free annual file disclosures.

76.  In addition, the Commission’s NPR solicited information about two other types of consumer reporting agencies. As discussed in section IV, supra, the FACT Act directed the Commission to determine whether to promulgate a rule covering “a consumer reporting agency that compiles and maintains files on consumers on substantially a nationwide basis.” The Commission, at this time, is not adopting a rule provision relevant to such agencies, if in fact any such entities exist. In addition, the Commission sought information about associated consumer reporting agencies, i.e., those consumer reporting agencies that own or maintain consumer files within the systems of nationwide consumer reporting agencies. The final rule, however, does not directly cover such agencies. The rule obligates nationwide consumer reporting agencies that house within their systems consumer files owned by associated consumer reporting agencies to provide annual file disclosures to those affected consumers.

77.  For example,§ 610.2 of the rule addresses the establishment and operation of the centralized source through which consumers may request a free annual file disclosure from each nationwide consumer reporting agency, none of which is a small entity. Similarly, Appendix D to Part 698 sets forth a model standardized form for consumer use in making such requests from the centralized source. The impact, if any, of this form is on individuals, i.e., natural persons, who also are not small entities under the Regulatory Flexibility Act.

78.  Nationwide consumer reporting agencies will have similar, but more extensive, obligations under the rule. As stated above, however, the Commission has concluded that there are no nationwide consumer reporting agencies that are small entities.