March 2, 1998
John A. Buchman, Esq.
Holland & Knight
2100 Pennsylvania Ave., N.W.
Suite 400
Washington, D.C. 20037
Re: Section 604 of the Fair Credit Reporting Act
Dear Mr. Buchman:
This responds to your letter of June 11, 1997, on behalf of a client. You ask for the staff's opinion as to whether your client would have a permissible purpose, under Section 604 of the Fair Credit Reporting Act ("FCRA"), to procure, from a consumer reporting agency ("CRA"), a list of the credit cards held by individuals who join a "wallet protection" program offered by the company.
You describe the program offered by your client as one in which, for an annual fee, consumers receive a number of benefits if their credit cards or other cards are stolen or lost. The most significant of these is notification to the card issuers. Your client will seek customers for the program by direct mail and telephone solicitations. (The mailings include a postcard that consumers may return, and a toll-free number they may call, if they are interested in the program.) In both methods of solicitation, your client will ask each applicant to authorize it to obtain a list of the applicant's credit cards from a CRA. Obtaining the list from a CRA will, according to your letter, facilitate the marketing of the program since consumers will not have to take the time to check and list all their cards and the issuers.
Your letter raises three issues: (1) the status under the FCRA of the type of information (a list of credit cards and their issuers) that your client would like to obtain from a CRA; (2) the "permissible purpose," if any, that your client will have to obtain lists of applicants' credit cards without written authorization; and (3) the applicability of Section 604(c) to a solicitation program such as the one your client proposes. For the reasons set forth below, we conclude that your client must obtain written permission from each applicant before obtaining the information that it seeks.
The first issue that you raise concerns the status of the credit card information that your client seeks. Your client proposes to obtain only a list of credit card numbers and the issuers of the cards from the consumer reporting agency. You question whether a list of credit cards with nothing more is a "consumer report."
Section 603(d)(1) of the FCRA defines a "consumer report" to include information that is "used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility" for the purposes listed in Section 603 and Section 604. The purposes for which information may be obtained under Section 603 and Section 604 include credit, insurance, and employment-related purposes, and business transactions initiated by the consumer. In addition, Section 604 permits a business to obtain a consumer report at any time when the consumer provides written permission.
When in the files of a credit bureau, information about the identity and number of the credit cards that a consumer has is, at the very least, information collected in whole or in part for the purposes set forth in Section 604. Moreover, we believe that the number and type of credit cards held by a consumer may be a factor in deciding whether or not to grant credit. According-ly, the information your client seeks constitutes "consumer report" information that can only be obtained if your client has a "permissible purpose" under Section 604.
The next issue is whether your client has a "permissible purpose" under the FCRA to obtain a list of consumer credit cards in connection with its program. Based on a review of the FCRA and its legislative history, we conclude that the only circumstance in which your client may obtain consumer report information is with the written permission of the consumer.(1) We do not believe that there is any other permissible purpose under the law given the facts that you describe. The two situations where a "permissible purpose" might be available in a transaction such as the one you outline in your letter are: (1) the underwriting of insurance (since your client's program arguably includes, among other things, a traditional insurance component) (Section 604(a)(3)(C)); and (2) the "legitimate business need" in connection with a business transaction initiated by a consumer (Section 604(a)(3)(F)(i)). However, we believe that these "permissible purposes" are not available in the specific fact situation that you have outlined.
As to the "underwriting" of insurance purpose, it is clear from your letter that the information your client seeks will not be used in underwriting decisions. Rather, your client needs this information for marketing purposes -- i.e., to make it easier to sell its credit card protection program by eliminating the need for consumers to fill out forms listing their cards. Since this activity does not involve underwriting decisions, your client cannot avail itself of the "insurance" permissible purpose set forth in Section 604(a)(3)(C).
We also believe that your client does not have a "legitimate business need" for the infor-mation in connection with a business transaction initiated by a consumer. It is clear from the language of Section 603(d)(1) of the FCRA that, except as otherwise set forth in Section 604, consumer reports relate to eligibility for employment, insurance, credit, or another permitted pur-pose. Since Section 604 does not specifically permit the use of consumer reports in the context of business transactions initiated by consumers for any other purpose, we conclude that the only permissible purpose for which a credit report may be obtained in connection with a new business transaction is to determine the consumer's "eligibility" -- i.e., whether the business wishes to undertake a transaction with the consumer. In this regard, we note that the legislative history indicates that Congress intended the "permissible purposes" provisions of the FCRA to cover primarily "eligibility" issues (see, e.g., 116 Cong. Rec. 36,572 (statement of Rep. Sullivan)).
In your letter, you indicate that the information your client seeks will not be used to deter-mine the eligibility of consumers for a business transaction. Rather, the information is sought to make the transaction with the consumer go smoothly in order to enhance the marketability of the program. Since the information your client would obtain is tangential to the transaction with the consumer and is sought for marketing purposes, we do not believe that the information may be obtained without the permission of each affected consumer.
The final issue raised in your letter concerns the applicability of Section 604(c)(1)(A) to the fact situation you describe. Section 604(c)(1)(A) permits a consumer reporting agency to provide consumer reports based on the permission of the consumer "in connection with credit or insurance transactions that are not initiated by the consumer." Section 604(c) is one of a number of related provisions of the FCRA -- the others are Sections 603(l), 604(e), and 615(d) -- that regulate the use of consumer report information in the marketing process known as "prescreen-ing." In prescreening, a marketer sends offers of credit or insurance to individuals who have been selected to receive the offer as a result of screening usually done by a consumer reporting agency to identify individuals who meet specific criteria set by the marketer.
Section 604(c)(1)(A) does not apply to your client's situation. Like the rest of Section 604(c), this provision is limited in application to prescreening. We believe that this is clear when Section 604(c) and the various other provisions of the FCRA that apply to prescreening are read together. In addition, the legislative history of the FCRA supports our statutory analysis. For example, the Senate Committee on Banking report that accompanied S. 650 -- the immediate Senate predecessor bill to the final amendments -- explicitly states that the operative phrase in Section 604(c) ("credit or insurance transaction that is not initiated by the consumer") is the phrase used throughout the bill to "describe prescreening transactions" (S. Rep. No. 104-186, 104th Cong., 1st Sess., at 33 (1995)). Since your client does not intend to use the information it obtains to prescreen consumers for offers of credit or insurance, Section 604(c)(1)(A) does not provide a basis for obtaining consumer report information.
In sum, it is the staff's opinion that your client does not have a permissible purpose to obtain the information that it seeks from a CRA unless written permission is obtained pursuant to Section 604(a)(2) of the FCRA.
The views set forth in this informal opinion letter are those of the staff, and are not binding on the Commission.
Sincerely yours,
William Haynes
Attorney
Division of Credit Practices
1. Where you client solicits by mail, this may easily be accomplished by requesting that consumers provide authorization when they respond to the offer. In the case of telephone soli-citations, authorization will have to be obtained by sending each consumer an authorization form.