June 30, 2000
Denise A. Darcy, Esq.
Asst. General Counsel
TRANS UNION
555 West Adams Street
Chicago, Illinois 60661
Dear Ms. Darcy:
This responds to your letter dated concerning whether the Fair Credit Reporting Act ("FCRA") allows Trans Union or another consumer reporting agency ("CRA"), for security purposes, to "truncate, scramble or mask the account number and social security number" when making file disclosures to consumers. You report that such a procedure has been recommended to you by a consumer who was recently the victim of account takeover fraud by a perpetrator who fraudulently procured the individual's Trans Union file by impersonating the consumer. You state: "While some creditors truncate or scramble the data before they supply it to us, not all do; therefore, many of the account numbers on our file are complete and accurate, and that is what we disclose to the consumer."
Section 609(a)(1) of the FCRA states that CRAs, including major credit bureaus such as Trans Union, "shall, upon request (by a consumer), clearly and accurately disclose to the consumer . . . All information in the consumer's file at the time of the request" (emphasis added). If the "information in the consumer's file at the time of the request" includes account and social security numbers, the provision thus normally requires that the CRA "clearly and accurately" include such items in its disclosure to consumers. However, because the trigger for a file disclosure is a "request" by a consumer, a CRA may allow consumers (such as the individual in your letter) to choose truncation or other security measures in their own file disclosure. In other words, although Section 609 provides consumers with a right to all information in the file, a CRA may provide a method for the consumer to ask for less than all information and then comply with that "request" when it makes the disclosure.
In sum, it is our view that a CRA that always scrambles or truncates account (or social security) numbers does not technically comply with Section 609 because it does not provide "accurate" (and perhaps not "clear") disclosure of "all information" in the file. However, if a consumer's "request" for a file disclosure is framed so as to allow some items in the file to be abbreviated or revised in that fashion, a CRA making such a disclosure would comply with Section 609.
The opinions set forth in this informal staff letter are not binding on the Commission.
Sincerely yours,
Clarke W. Brinckerhoff