By Jane Black Consider it an early Christmas present. On Dec. 4, President George W. Bush signed into law the Fair & Accurate Credit Transaction (FACT) Act of 2003, an updated and improved version of the 1970 Fair Credit Reporting Act, which regulates the ugly world of credit reports, credit scores, and sensitive personal data.
The old version wasn't exactly fair to consumers. Vague rules and minimal enforcement, combined with the Internet's rise, spawned 10 million victims of ID theft in the U.S. in 2002 alone. The cost: An astounding $53 billion -- and that doesn't include the 300 million hours people spent trying to correct damaged credit records (see BW Online, 8/14/03, "Why Your ID Is Such Easy Pickings").
"MORE TOOLS." The FACT Act offers consumers a new set of weapons in their battle against ID theft. But they'll have to stay on guard. "Consumers are still the front line of their own defense against both credit-bureau mistakes and identity theft," warns Edward Mierzwinski, program director at consumer-advocacy outfit U.S. Public Interest Research Group (U.S. PIRG). "But at least now they have a lot more tools to prevent ID theft and clean up after it."
The 171-page bill contains a host of complicated provisions that will go into effect no later than a year from now. Here are a few that will help you to protect your private information:
FACT gives every consumer the right to one free credit report per year from all three credit bureaus. Victims of ID theft are eligible to two free reports in the year the fraud occurs. Until now, only seven states -- Colorado, Georgia, Maine, Maryland, Massachusetts, New Jersey, and Vermont -- had similar laws. Citizens of other states had to fork over $9 to $12 to each bureau to see a copy of their report.
Even better, consumers will no longer have to call around to each bureau to obtain a copy of their report. Instead, FACT mandates a one-stop shop (and toll-free number to be announced at a later date).
Free access to your personal information is essential. After all, the credit bureaus collect and make a profit on your history by selling it to mortgage lenders, credit-card issuers, and insurance companies. It's only fair that you should be able to see -- and make corrections -- to your personal information. The provision is a major step forward in ensuring consumers' knowledge and control over their financial information.
Consumers also gain access to their credit scores -- and an explanation of what they mean -- for a reasonable fee to be set by the Federal Trade Commission (FTC). A credit score is a number calculated to give lenders an indication of whether a consumer is a good credit risk.
Until recently, however, credit scores have remained a black box. Fair Isaac (FIC), the outfit that calculates them, asserts that its formula is proprietary (see BW, 4/ 4/02, "How Fair Is Fair Isaac?"). Giving consumers too much information about how scores are calculated would allow them to manipulate their ratings, Fair Isaac argues. But in 2001, it caved to intense pressure and began offering consumers access to their scores online at myfico.com for $12.95.
Having access to credit scores may be even more valuable than being able to see your credit report, says U.S. PIRG's Mierzwinski, because that's what most lenders ask for when making a decision about whether or how much credit to offer. Examining their score will help consumers understand and improve their ratings in the months before they apply for a mortgage or a big loan.
FACT will also mandate that consumers be informed when negative information is added to their credit reports -- a home run for consumers, according to Chris Hoofnagle, legal counsel at the Washington (D.C.)-based Electronic Privacy Information Center. Here's why: Say you faithfully pay your credit-card bills and mortgage payments and then, suddenly, suspiciously default on a huge loan.
This is often a key tip-off that a thief has got hold of your identity. And until now, consumers often didn't discover problems until months or years later when they tried to apply for a mortgage or loan themselves. Now the credit bureaus will have to let you know right away.
Finally, FACT gives teeth to the so-called fraud alerts that aim to limit the damage by informing lenders that your ID has been hijacked. Until now, the basic alert, which lasted 90 days, and the extended alert, which could last up to seven years, were added only to your full credit report. The problem is, almost no one -- except a mortgage broker who still uses manual underwriting -- asked for the full credit report when making a lending decision. The fraud alerts gave consumers a false sense of security while crimes continued to be perpetrated in their names.
Under the new law, the fraud alert must be included on the full report, summary report, and credit-score report. Those who don't comply will be penalized either by federal agencies such as the FTC or be vulnerable to private legal action.
FACT'S HIGH COST. Of course, the law is far from perfect. Privacy advocates lost their biggest fight over the issue of federal preemption -- FACT overrides any stronger, state privacy laws on the books (see BW Online, 6/12/03, "Give States the Right to Protect Privacy"). That's a shame. Several states, led by California, are on the cutting edge of financial-privacy law (see BW Online, 7/11/02, "Will Voters Opt for Opting In?").
Indeed, many of the best provisions, such as the right to reasonably priced credit scores, come from the states. "Unfortunately, the protections in FACT came at a very high cost in the form of weakening states' abilities to be nimble and respond to new problems before becoming epidemics," says Shelley Curran, a policy analyst in the San Francisco office of Consumer's Union. "While Congress did take some steps forward in identity theft, it failed to give consumers real control over their financial information."
Still, states have room for activism. The preemption clause applies only to provisions expressly covered in the new law. And state laws can be written in many ways to strengthen the federal statute.
REASONABLE COMPROMISE. For example, one FACT provision requires that businesses actively assist ID-theft victims in cleaning up their credit record. That might mean providing them with store records of past purchases, some of which may not have been kosher. But consumers now must provide a police report to "prove" they've been a victim -- and police don't often file reports on stolen credit cards. States such as California have already passed laws requiring police to file reports, which will give consumers more power under the new federal law.
Yes, it could have been stronger. But all laws are compromises. And with the FACT Act, for once, it won't be consumers who are asked to make all of them. Black covers privacy issues for BusinessWeek Online in her twice-monthly Privacy Matters column