With the passage of the Economic Growth, Regulatory Relief, and Consumer Protection Act earlier this year, Congress amended the Fair Credit Reporting Act (FCRA). The Act amends both consumer rights under FCRA and imposes important new disclosure requirements. By way of background for those unfamiliar, Section 609 of FCRA requires two consumer disclosures: (1) a model summary of rights to obtain and dispute information contained in consumer reports and to obtain credit scores—referred to as a “Summary of Consumer Rights”–and (2) a model summary of rights of identity theft victims—called the “Summary of Consumer Identity Theft Rights.”

The Summary of Consumer Rights outlines consumer rights under FCRA, including consumers’ rights to obtain a free consumer report, the right to dispute information in a consumer’s file, and related disclosures. A consumer reporting agency must provide these notices when it makes any written disclosure of information from a consumer’s file. Similarly, the Summary of Consumer Identity Theft Rights explains consumer rights when they seek to redress identity theft and fraud. For instance, consumers are entitled to place a fraud alert and prevent information from appearing in a consumer report. This notice is mandatory whenever a consumer reporting agency believes that the consumer is a victim of identity theft or fraud.

Fortunately, the CFPB has provided form disclosures to ensure compliance with the FCRA. Entities that use disclosures provided by the CFPB, or disclosures substantially similar, are in presumptive compliance with the statute. The passage of new legislation earlier this year, however, imposes new disclosure requirements.

The Economic Growth, Regulatory Relief, and Consumer Protection Act (often shortened to EGRRCPA), which was signed into law in May 2018, amends the Fair Credit Reporting Act and institutes several important changes. Perhaps most notably, the Act amends FCRA section 605 to require nationwide consumer reporting agencies to provide a national credit freeze free of charge to consumers. A credit freeze, which is designed to make it more difficult for criminals to use stolen information to open new accounts and credit cards fraudulently, prevents credit bureaus from providing credit information to lenders while in effect.

Not only are consumers now entitled to a free credit freeze, they are also entitled to notice of this newly conferred right. Whenever a consumer is entitled to receive a summary of rights required under FCRA, section 605A(i)(5) also requires that reporting agencies provide consumers with a notice informing them of their rights to obtain a security freeze. Similarly, the EGRRCPA amends FCRA to substantially extend the minimum time that nationwide consumer agencies must include an initial fraud alert on a consumer’s file from 90 days to one year.

Since the current form disclosures provided in Regulation V do not reflect these important changes, the CFPB has passed an interim rule to supplement those disclosures and provide language that complies with the amended section 605A.