S1327-118

1. Short title This Act may be cited as the Consumer Credit Control Act of 2023.

2. Permissible purposes of reports The Fair Credit Reporting Act (15 U.S.C. 1681 et seq.) is amended— in section 604 (15 U.S.C. 1681b)— by striking subsections (c) through (e) and inserting the following: A consumer reporting agency may furnish a consumer report for the following purposes only if the consumer reporting agency obtains affirmative informed consent of the consumer to furnish the consumer report and the consumer reporting agency verifies the identity of the consumer by reviewing the proper identification required under section 610: An extension of credit pursuant to subsection (a)(3)(A). The underwriting of insurance pursuant to subsection (a)(3)(C). After the consumer reporting agency obtains affirmative informed consent of the consumer and verifies the identity of the consumer under paragraph (1), the consumer reporting agency may continue to furnish consumer reports solely for the purposes of reviewing or collecting on an account described in subparagraphs (A) and (C) of subsection (a)(3). A consumer reporting agency may furnish a consumer report to a person in connection with any credit or insurance transaction under subparagraph (A) or (C) of subsection (a)(3) that is not initiated by the consumer only if— the consumer reporting agency obtains affirmative informed consent of the consumer to furnish the consumer report and the consumer reporting agency verifies the identity of the consumer by reviewing the proper identification required under section 610; and the transaction consists of a firm offer of credit or insurance. The consumer may elect to— have the consumer’s name and addresses included in lists of names and addresses provided by the consumer reporting agency pursuant to subparagraphs (A) and (C) of subsection (a)(3) in connection with any credit or insurance transaction that is not initiated by the consumer only if— the consumer reporting agency obtains affirmative informed consent of the consumer to furnish the consumer report and the consumer reporting agency verifies the identity of the consumer by reviewing the proper identification required under section 610; and the transaction consists of a firm offer of credit or insurance; and revoke at any time the election pursuant to clause (i) to have the consumer's name and address included in lists provided by a consumer reporting agency. Except as provided in section 609(a)(5), a consumer reporting agency shall not furnish to any person a record of inquiries in connection with a credit or insurance transaction that is not initiated by a consumer. A person may not procure a consumer report for any purpose pursuant to subparagraphs (D), (F), and (G) of subsection (a)(3) unless— a simple and easy to understand, as defined in section 1022.54(b) of title 12, Code of Federal Regulations, as in effect on the date of enactment of the Consumer Credit Control Act of 2023, disclosure has been made to the consumer at any time before the report is procured or caused to be procured, that consists solely of the disclosure and the opportunity to provide the consent described in clause (ii), that a consumer report may be obtained for such purposes; and the person has obtained affirmative informed consent of the consumer for the procurement of the consumer report by that person. The consent described in subparagraph (A)(ii) shall be provided on the disclosure described under subparagraph (A)(i). Not later than 270 days after the date of enactment of the Consumer Credit Control Act of 2023, the Director of the Bureau shall promulgate regulations that— implement this subsection; establish a model form for the disclosure document pursuant to paragraph (4); permit consumers to provide affirmative informed consent required by paragraph (1) for a specific time period for multiple users for the specified purpose during that time period; require a consumer reporting agency— to provide to each consumer a secure, convenient, accessible, and cost-free method, including by toll-free telephone or secure electronic means, by which a consumer may— provide or revoke any affirmative informed consent pursuant to this subsection; and make or revoke any election pursuant to paragraph (3)(B); to implement any provision or revocation of affirmative informed consent pursuant to this subsection not later than 1 business day after the date on which a consumer provides or revokes affirmative informed consent; and to implement any election or revocation of any election pursuant to paragraph (3)(B) not later than 1 business day after the date on which a consumer makes or revokes an election; and define what constitutes affirmed informative consent in the manner that provides the greatest protection to consumers. The method described in paragraph (5)(D) shall not be used to— collect any information on a consumer that is not necessary for the purpose of the consumer to allow or disallow the furnishing of consumer reports; or advertise any product or service. In the offering of a method described in paragraph (5)(D), a consumer reporting agency shall not require a consumer to waive any rights nor indemnify the consumer reporting agency from any liabilities arising from the offering of such method. Not later than 270 days after the date of enactment of the Consumer Credit Control Act of 2023, the Director of the Bureau shall, after consultation with the Federal Deposit Insurance Corporation, the National Credit Union Administration, the Consumer Advisory Board, and other Federal and State regulators as the Director of the Bureau determines are appropriate, submit to the Committee on Banking, Housing, and Urban Affairs of the Senate and the Committee on Financial Services of the House of Representatives recommendations on how to provide consumers greater transparency and personal control over their consumer reports furnished for permissible purposes under subsections (a)(3)(E) and (a)(6). The Director of the Bureau shall submit to the Committee on Banking, Housing, and Urban Affairs of the Senate and the Committee on Financial Services of the House of Representatives an annual report that includes— recommendations on how this subsection may be improved; a description of efforts to educate consumers of their rights under this subsection; a description of enforcement actions taken to demonstrate compliance with this subsection; recommendations on how to improve oversight of consumer reporting agencies and users of consumer reports; and any other recommendations concerning how consumers may be provided greater transparency and control over their personal information. The Comptroller General of the United States shall conduct a study on what additional protections or restrictions may be needed to ensure that the information collected in consumer files is secure and does not adversely impact consumers. Not later than 1 year after the date of enactment of the Consumer Credit Control Act of 2023, the Comptroller General of the United States shall submit to the Committee on Banking, Housing, and Urban Affairs of the Senate and the Committee on Financial Services of the House of Representatives a report on the results of the study under clause (i), which shall include— to the greatest extent possible, the presentation of unambiguous conclusions and specific recommendations for further legislative changes needed to ensure that the information collected in consumer files is secure and does not adversely impact consumers; and if no recommendations for further legislative changes are presented, a detailed explanation of why no such changes are recommended. by redesignating subsections (f) and (g) as subsections (d) and (e), respectively; and by adding at the end the following: No consumer reporting agency may charge a consumer any fee for any activity pursuant to or as a result of this section. in section 607(a) (15 U.S.C. 1681e(a))— in the third sentence, by striking make a reasonable effort and inserting use commercially reasonable efforts; and by inserting Every consumer reporting agency shall use commercially reasonable efforts to avoid unauthorized access to consumer reports and information in the file of a consumer maintained by the consumer reporting agency, including complying with any appropriate standards established under section 501(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801(b)). after the end of the third sentence; in section 609 (15 U.S.C. 1681g), by striking subsection (b) and inserting the following: The Director of the Bureau shall promulgate regulations to clarify that any disclosure required by subsection (a) shall be made to the consumer when a consumer makes a request, irrespective of whether the information required to be disclosed is held by the parent, subsidiary, or affiliate of a consumer reporting agency. in section 610(a)(1) (15 U.S.C. 1681h(a)(1))— by inserting , implementing the provision or revocation of any affirmative informed consent, or implementing any election or revocation of any election after disclosures; and by striking section 609 and inserting sections 604 and 609. The Fair Credit Reporting Act (15 U.S.C. 1681 et seq.) is amended— in section 603(d)(3) (15 U.S.C. 1681a(d)(3)), in the matter preceding subparagraph (A), by striking 604(g)(3) and inserting 604(e)(3); in section 605A (15 U.S.C. 1681c–1)— by striking subsections (i) and (j); and by redesignating subsection (k) as subsection (i); in section 615(d) (15 U.S.C. 1681m(d))— in paragraph (1)— in the matter preceding subparagraph (A), by striking 604(c)(1)(B) and inserting 604(c)(3)(A)(ii); and in subparagraph (E), by striking 604(e) and inserting 604(c)(5)(D); and in paragraph (2)(A), by striking 604(e) and inserting 604(c)(5)(D); and in section 625(b)(1) (15 U.S.C. 1681t(b)(1))— in subparagraph (A), by striking subsection (c) or (e) of section 604 and inserting 604(c)(3); in subparagraph (I), by adding or at the end; by striking subparagraph (J); and by redesignating subparagraph (K) as subparagraph (J). The amendments made by subsections (a) and (b) shall apply to a consumer report, as defined in section 603 of the Fair Credit Reporting Act (15 U.S.C. 1681a), furnished after the earlier of— the date on which the regulations promulgated by the Director of the Bureau of Consumer Financial Protection under subsection (c)(5) of section 604 of the Fair Credit Reporting Act (15 U.S.C. 1681b), as amended by subsection (a) of this section, require compliance; and the date that is 18 months after the date of enactment of this Act. (c)Conditions for furnishing certain consumer reports(1)In generalA consumer reporting agency may furnish a consumer report for the following purposes only if the consumer reporting agency obtains affirmative informed consent of the consumer to furnish the consumer report and the consumer reporting agency verifies the identity of the consumer by reviewing the proper identification required under section 610:(A)An extension of credit pursuant to subsection (a)(3)(A).(B)The underwriting of insurance pursuant to subsection (a)(3)(C).(2)Additional reports; electionAfter the consumer reporting agency obtains affirmative informed consent of the consumer and verifies the identity of the consumer under paragraph (1), the consumer reporting agency may continue to furnish consumer reports solely for the purposes of reviewing or collecting on an account described in subparagraphs (A) and (C) of subsection (a)(3).(3)Furnishing reports in connection with credit or insurance transactions that are not initiated by consumer(A)In generalA consumer reporting agency may furnish a consumer report to a person in connection with any credit or insurance transaction under subparagraph (A) or (C) of subsection (a)(3) that is not initiated by the consumer only if—(i)the consumer reporting agency obtains affirmative informed consent of the consumer to furnish the consumer report and the consumer reporting agency verifies the identity of the consumer by reviewing the proper identification required under section 610; and(ii)the transaction consists of a firm offer of credit or insurance.(B)ElectionThe consumer may elect to—(i)have the consumer’s name and addresses included in lists of names and addresses provided by the consumer reporting agency pursuant to subparagraphs (A) and (C) of subsection (a)(3) in connection with any credit or insurance transaction that is not initiated by the consumer only if—(I)the consumer reporting agency obtains affirmative informed consent of the consumer to furnish the consumer report and the consumer reporting agency verifies the identity of the consumer by reviewing the proper identification required under section 610; and(II)the transaction consists of a firm offer of credit or insurance; and(ii)revoke at any time the election pursuant to clause (i) to have the consumer's name and address included in lists provided by a consumer reporting agency.(C)Information regarding inquiriesExcept as provided in section 609(a)(5), a consumer reporting agency shall not furnish to any person a record of inquiries in connection with a credit or insurance transaction that is not initiated by a consumer.(4)Disclosures(A)In generalA person may not procure a consumer report for any purpose pursuant to subparagraphs (D), (F), and (G) of subsection (a)(3) unless—(i)a simple and easy to understand, as defined in section 1022.54(b) of title 12, Code of Federal Regulations, as in effect on the date of enactment of the Consumer Credit Control Act of 2023, disclosure has been made to the consumer at any time before the report is procured or caused to be procured, that consists solely of the disclosure and the opportunity to provide the consent described in clause (ii), that a consumer report may be obtained for such purposes; and(ii)the person has obtained affirmative informed consent of the consumer for the procurement of the consumer report by that person.(B)AuthorizationsThe consent described in subparagraph (A)(ii) shall be provided on the disclosure described under subparagraph (A)(i).(5)RulemakingNot later than 270 days after the date of enactment of the Consumer Credit Control Act of 2023, the Director of the Bureau shall promulgate regulations that—(A)implement this subsection;(B)establish a model form for the disclosure document pursuant to paragraph (4);(C)permit consumers to provide affirmative informed consent required by paragraph (1) for a specific time period for multiple users for the specified purpose during that time period;(D)require a consumer reporting agency—(i)to provide to each consumer a secure, convenient, accessible, and cost-free method, including by toll-free telephone or secure electronic means, by which a consumer may—(I)provide or revoke any affirmative informed consent pursuant to this subsection; and(II)make or revoke any election pursuant to paragraph (3)(B);(ii)to implement any provision or revocation of affirmative informed consent pursuant to this subsection not later than 1 business day after the date on which a consumer provides or revokes affirmative informed consent; and(iii)to implement any election or revocation of any election pursuant to paragraph (3)(B) not later than 1 business day after the date on which a consumer makes or revokes an election; and(E)define what constitutes affirmed informative consent in the manner that provides the greatest protection to consumers.(6)Prohibitions(A)In generalThe method described in paragraph (5)(D) shall not be used to—(i)collect any information on a consumer that is not necessary for the purpose of the consumer to allow or disallow the furnishing of consumer reports; or(ii)advertise any product or service.(B)No waiverIn the offering of a method described in paragraph (5)(D), a consumer reporting agency shall not require a consumer to waive any rights nor indemnify the consumer reporting agency from any liabilities arising from the offering of such method.(7)Reports(A)CFPB(i)RecommendationNot later than 270 days after the date of enactment of the Consumer Credit Control Act of 2023, the Director of the Bureau shall, after consultation with the Federal Deposit Insurance Corporation, the National Credit Union Administration, the Consumer Advisory Board, and other Federal and State regulators as the Director of the Bureau determines are appropriate, submit to the Committee on Banking, Housing, and Urban Affairs of the Senate and the Committee on Financial Services of the House of Representatives recommendations on how to provide consumers greater transparency and personal control over their consumer reports furnished for permissible purposes under subsections (a)(3)(E) and (a)(6).(ii)ReportThe Director of the Bureau shall submit to the Committee on Banking, Housing, and Urban Affairs of the Senate and the Committee on Financial Services of the House of Representatives an annual report that includes—(I)recommendations on how this subsection may be improved;(II)a description of efforts to educate consumers of their rights under this subsection;(III)a description of enforcement actions taken to demonstrate compliance with this subsection;(IV)recommendations on how to improve oversight of consumer reporting agencies and users of consumer reports; and(V)any other recommendations concerning how consumers may be provided greater transparency and control over their personal information.(B)GAO(i)StudyThe Comptroller General of the United States shall conduct a study on what additional protections or restrictions may be needed to ensure that the information collected in consumer files is secure and does not adversely impact consumers.(ii)ReportNot later than 1 year after the date of enactment of the Consumer Credit Control Act of 2023, the Comptroller General of the United States shall submit to the Committee on Banking, Housing, and Urban Affairs of the Senate and the Committee on Financial Services of the House of Representatives a report on the results of the study under clause (i), which shall include—(I)to the greatest extent possible, the presentation of unambiguous conclusions and specific recommendations for further legislative changes needed to ensure that the information collected in consumer files is secure and does not adversely impact consumers; and(II)if no recommendations for further legislative changes are presented, a detailed explanation of why no such changes are recommended.; (f)No feesNo consumer reporting agency may charge a consumer any fee for any activity pursuant to or as a result of this section.; (b)Scope of disclosureThe Director of the Bureau shall promulgate regulations to clarify that any disclosure required by subsection (a) shall be made to the consumer when a consumer makes a request, irrespective of whether the information required to be disclosed is held by the parent, subsidiary, or affiliate of a consumer reporting agency.; and