15 U.S.C. § 1681b — Permissible purposes of consumer reports

(a) General rule. Subject to subsection (c), a consumer reporting agency may provide a consumer report only in the following situations: (1) The report is provided in response to an order from a court that has authority to issue the order, a subpoena connected with a Federal grand-jury proceeding, or a subpoena issued under 31 U.S.C. § 5318 or 18 U.S.C. § 3486. (2) The report is provided according to the consumer’s written instructions. (3) The report is provided to someone the agency has reason to believe intends to use it for one of these purposes: (A) a credit transaction involving the consumer, including extending credit or reviewing or collecting the consumer’s account; (B) employment; (C) underwriting insurance involving the consumer; (D) deciding whether the consumer qualifies for a license or other benefit from a governmental body that the law requires to consider an applicant’s financial responsibility or status; (E) as a potential investor or servicer, or as the current insurer, valuing an existing credit obligation or assessing its credit or prepayment risk; (F) another legitimate business need, either (i) for a business transaction started by the consumer or (ii) to review an account to decide whether the consumer still meets its terms; or (G) issuance of government-sponsored, individually billed travel charge cards by executive departments and agencies. (4) The report is provided in response to the head of a State or local child-support-enforcement agency, or an authorized State or local official, when the requester certifies that: (A) the report is needed to establish someone’s ability to make child-support payments, set the proper amount, or enforce a child-support order, award, agreement, or judgment; (B) the consumer’s parentage of the child involved has been established or acknowledged under the applicable State law, if that law requires it; and (C) the report will be kept confidential, used only for the purpose in (A), and not used in another civil, administrative, or criminal proceeding or for another purpose. (5) The report is provided to an agency administering a State plan under 42 U.S.C. § 654, for setting an initial or changed child-support award. (6) The report is provided to the Federal Deposit Insurance Corporation or the National Credit Union Administration while it prepares for, or exercises, its powers as conservator, receiver, or liquidating agent for an insured depository institution or insured credit union under the cited Federal laws or other applicable Federal or State law, or in connection with resolving or liquidating such an institution that has failed or is failing. (b) Employment reports. (1) Certification by the user. An agency may provide a report for employment only if: (A) the person obtaining it certifies that (i) the person complied with paragraph (2) and will comply with paragraph (3) if that paragraph becomes applicable, and (ii) the information will not be used in violation of applicable Federal or State equal-employment-opportunity law or regulation; and (B) the agency provides with the report, or previously provided, the consumer-rights summary prescribed by the Bureau under 15 U.S.C. § 1681g(c)(3). (2) Disclosure to the consumer. (A) Unless (B) applies, a person may obtain, or cause someone to obtain, a report for employment only if, before obtaining it: (i) the person gives the consumer a clear and conspicuous written disclosure, in a document containing only that disclosure, that a report may be obtained for employment; and (ii) the consumer gives written authorization. The authorization may be on that same document. (B) If the consumer applies by mail, telephone, computer, or similar means, the person must, before obtaining the report: (i) give the consumer oral, written, or electronic notice that a report may be obtained for employment and a summary of the consumer’s rights under 15 U.S.C. § 1681m(a)(3); and (ii) obtain the consumer’s oral, written, or electronic consent. (C) (B) applies only when: (i) the position is one for which the Secretary of Transportation may set qualifications and maximum service hours under 49 U.S.C. § 31502, or is subject to safety regulation by a State transportation agency; and (ii) at that time the only interaction about the application has been by mail, telephone, computer, or similar means. (3) Before adverse action. (A) Unless (B) applies, before taking adverse action based wholly or partly on an employment report, the person planning the action must give the consumer a copy of the report and a written description of the consumer’s rights under this subchapter, in the form prescribed by the Bureau under 15 U.S.C. § 1681g(c)(3). (B) If a consumer covered by (C) applied by mail, telephone, computer, or similar means and the person takes adverse action based wholly or partly on the report, the person must, within 3 business days, give an oral, written, or electronic notice instead of the notices required by (A) and 15 U.S.C. § 1681m(a). The notice must say: (I) adverse action was taken wholly or partly because of a report from a consumer reporting agency; (II) the agency’s name, address, and telephone number, including its toll-free number if it keeps nationwide files; (III) the agency did not make the decision and cannot give the specific reasons; and (IV) the consumer may, with proper identification, request a free copy of a report and dispute the report’s accuracy or completeness with the agency. If the consumer asks the person who obtained the report for a copy, the person must, within 3 business days after receiving the request and proper identification, send or provide a copy of the report and the Bureau-prescribed rights summary. (C) (B) applies only when the position and the application-contact facts are those described in paragraph (2)(C). (4) Exception for national-security investigations. (A) If a United States Government agency or department obtains and uses a report for employment, paragraph (3) does not apply to adverse action based partly on the report if the agency or department head makes a written finding that the report is relevant to a national-security investigation within the agency’s jurisdiction and that following paragraph (3) could: (I) endanger someone’s life or physical safety; (II) cause flight from prosecution; (III) destroy or tamper with relevant evidence; (IV) intimidate a relevant potential witness; (V) compromise classified information; or (VI) otherwise seriously jeopardize or unduly delay the investigation or another official proceeding. (B) When that investigation ends, or when the exception is no longer needed, the official must give the consumer: (i) a copy of the report, with necessary redactions of classified information; (ii) notice of adverse action based partly on the report; and (iii) a reasonably specific description of the investigation’s nature. (C) The agency or department head may delegate these powers to an agency or department official who has personnel-security duties and is in the Senior Executive Service or an equivalent civilian or military rank. (D) For this paragraph, “classified information” means information protected from unauthorized disclosure under Executive Order 12958 or a successor order. “National security investigation” means an official Government inquiry into whether a consumer may receive or keep access to classified information, or whether classified information was lost or compromised. This section does not otherwise define those terms. (c) Reports for credit or insurance transactions not started by the consumer. (1) An agency may provide a report under subsection (a)(3)(A) or (C) for such a transaction only if (A) the consumer authorizes it, or (B) all of these conditions are met: (i) the transaction is a firm offer of credit or insurance; (ii) the agency complied with subsection (e); (iii) the consumer has not elected under subsection (e) to be excluded from the agency’s lists; and (iv) the report does not show that the consumer is under 21. If it does show that, the consumer must consent to the report being provided. (2) Under paragraph (1)(B), the recipient may receive only: (A) the consumer’s name and address; (B) a nonunique identifier used only to verify identity; and (C) other information that does not identify the consumer’s relationship or experience with a particular creditor or other entity. (3) Except as provided in 15 U.S.C. § 1681g(a)(5), the agency may not provide anyone a record of inquiries connected with such a transaction. (d) Reserved. (e) Consumer election to be left off lists. (1) A consumer may tell an agency, as paragraph (2) provides, that the consumer does not consent to any use of a report for a credit or insurance transaction not started by the consumer. The agency must then leave the consumer’s name and address off lists provided under (c)(1)(B). (2) The consumer must notify the agency either (A) through the system maintained under paragraph (5), or (B) by sending the agency’s signed election form. (3) When notification is made through the system, the agency must tell the consumer that the election lasts only 5 years unless the consumer sends the signed form. If the consumer asks for the form while notifying the agency, the agency must provide it within 5 business days. (4) The election takes effect for that agency 5 business days after notice. A system-only election lasts 5 years, subject to (C); an election made with the signed form lasts until the consumer ends it under (C). The election ends when the consumer notifies the agency through the system that it is no longer effective, and it also applies to each affiliate. (5) Each agency that provides reports under (c)(1)(B) must: (A)(i) maintain a notification system, including a toll-free number, allowing consumers with files at the agency to make this election with appropriate identification; and (ii) within 365 days after September 30, 1996, and at least annually afterward, publish in a generally circulated publication in its service area that file information may be used for these transactions and the address and toll-free number for making the election. (B) An agency’s system and publication for itself and its affiliates count as compliance by each affiliate. (6) Nationwide agencies must jointly maintain the notification system with the other nationwide agencies. (f) Prohibited use or obtaining. No person may use or obtain a report unless (1) it is obtained for a purpose for which this section authorizes it to be provided, and (2) a prospective user certifies that purpose, generally or specifically, as required by 15 U.S.C. § 1681e. (g) Protection of medical information. (1) An agency may not provide for employment, or in connection with a credit or insurance transaction, a report containing medical information about a consumer, other than medical contact information handled as required by § 1681c(a)(6), unless: (A) for insurance, the consumer affirmatively consents; (B) for employment or credit, the information is relevant to process or carry out the transaction and the consumer gives specific written consent clearly and conspicuously describing the use; or (C) the information concerns only transactions, accounts, or balances arising from medical services, products, or devices and, other than account status or amounts, is restricted or coded so it does not identify or provide enough information to infer the provider or nature of the service, product, or device. (2) Except as paragraph (3)(C) or paragraph (5)(A) regulations allow, a creditor may not obtain or use medical information about a consumer to decide credit eligibility or continued eligibility. (3) Section 1681a(d)(3) does not treat information or a communication as a consumer report when disclosed: (A) in connection with insurance or annuity business, including the cited model regulation as in effect January 1, 2003; (B) for a purpose allowed without authorization under the cited HHS standards for individually identifiable health information, under § 1179 of that Act, or under § 6802(e); or (C) as the Bureau or applicable State insurance authority determines by regulation or order necessary and appropriate for an insurance or annuity provider. (4) A recipient may not disclose medical information to another person except as needed for the original purpose or as allowed by statute, regulation, or order. (5) After notice and opportunity for comment, the Bureau may issue regulations allowing transactions under paragraph (2) that are necessary and appropriate for legitimate operational, transactional, risk, consumer, and other needs, including administrative verification, consistent with restricting inappropriate use. (6) This subsection does not alter, affect, or supersede another Federal law concerning medical confidentiality.