Just the facts on FACTA: a new law reauthorizing pre-emptions in the Fair Credit Reporting Act makes changes, including some about information sharing.

Recent changes made by Congress to the Fair Credit Reporting Act mean that insurance company executives who may have thought they understood the act need to take a second look at their compliance procedures. In the process of permanently reauthorizing the pre-emptions in FCRA, Congress passed a new law--the Fair and Accurate Credit Transactions Act of 2003--that includes amendments that have both a direct and indirect impact on insurers.

FACTA and FCRA have similar acronyms, but in reality, FACTA's sole existence is to outline those special changes made to FCRA.

Sharing Among Affiliates

One of the most significant sections in FACTA requires insurers to give a policyholder an opportunity to "opt-out" or forbid the exchange of information before the insurer can share information contained in consumer reports with affiliate companies. To understand the full meaning of this section and apply the change correctly, insurers must refer to FCRA for the definition of "consumer reports." FCRA definitions have not changed.

The FCRA definition of a consumer report is "a communication of any information by a consumer reporting agency." FCRA defines a consumer reporting agency as "any person which for monetary fees, dues or on cooperative nonprofit basis regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information for the purpose of furnishing consumer reports to third parties."

In other words, a "consumer report" can come only from a person who regularly accumulates this information for third parties for profit. This is a very narrow definition. If a disclosure of information does not fall into this narrow definition, it is not and cannot be a consumer report according to the definition.

To apply the definition, consider the example of an insurance group that writes several lines of insurance, such as auto, homeowners and life insurance, with individual companies handling each line of insurance. Information not received from a consumer report compiled by a consumer reporting agency, such as the loss history of an auto policyholder from the auto company, can be shared from one company to another without the need to send an opt-out to the policyholder. This information can be shared because it is obtained from company records, not purchased from a consumer reporting agency that is paid for the information.

On June 10, the Federal Trade Commission issued a proposed rule for comment regarding the affiliate marketing provision. In that proposed rule they attempt to clarify, the information that cannot be shared with an affiliate for marketing purposes by defining it as "eligibility information." Eligibility information they define as "any information the communication of which would be a consumer report if the exclusions from the definition of 'consumer report' in section 603(d)(2)(A) of the Act did not apply." It is key to note that even in this proposed rule they are affirming that only "consumer report" information cannot be used by an affiliate without first sending a notice with an opt-out option. As already discussed, consumer report information is only that information that comes from a consumer reporting agency

Insurers also need to keep in mind that FACTA did not change the adversary-action notice requirements, which say that when an insurer takes adversary action based upon credit information, it must send a notice advising its customer of the action. Neither did FACTA change the authorization for consumer reporting agencies to disclose consumer reports to insurance companies for underwriting purposes.

Supreme Authority

Another item insurers must recognize is that states may not override the authority of the FCRA. One of the pre-emptions (section 625) that was permanently reauthorized prohibits states from enacting any law or rule that would bar a company or persons affiliated by common ownership or corporate rule from sharing information. A case in point is a new California rule that ignores the FCRA pre-emption.

When the California Privacy Information Act passed last year, the Legislature included a provision that prohibits (corporate) affiliates from sharing consumer information without first giving the consumer the ability to opt-out. This provision is clearly pre-empted by FCRA. Last summer, in Bank of America vs. Daly City, the federal district court ruled that this provision in the local privacy ordinances, which had been patterned after the legislation, was illegal and pre-empted by the FCRA. Still, the California Legislature included this affiliate prohibition provision in its legislation and Gov. Gray Davis signed the legislation into law. When the California Department of Insurance issued its proposed regulation, it, too, included this pre-empted provision.

Currently the American Bankers Association has filed a suit against agencies that would enforce the California law. The litigation is ongoing. No decision has been made yet, but clearly there will be challenges to this statute.

What's Still to Come?

There might be other changes to come. Congress included a provision in FACTA that requires the FTC and the Federal Reserve to study the use of credit in consultation with the Fair Housing Office of the Department of Housing and Urban Development and report the results of their study to the legislature. These governmental agencies are beginning to formulate what will be included in this study. They have splintered the study with the FTC taking the insurance portion and the Federal Reserve taking the lead with respect to other uses of credit scores.

The industry hits met with the FTC and has supplied background information to the agency regarding how insurance companies use credit and documenting its predictive correlation. The FTC is envisioning a study that will examine the impact of the use of credit scores on the availability and affordability of insurance and other financial products and services. Obviously the results of this study will have a huge effect on how the use of credit scores is viewed in the future, and what will be the permissible uses.

Looking at the big picture of FCRA and FACIA, another question emerges. The FTC is expected to finalize the affiliate sharing rule within the next two months. The Property Casualty Insurers Association of America believes that the FTC does not have the authority to regulate insurance. The states have the job of regulating insurance, and in prior cases the FTC has admitted this in its own "Do Not Call" rules.

For now, insurance companies need to heed the affiliate sharing provisions in both FCRA and FACTA--and be careful in applying them to their own unique situation.

Key Point

* Congress has reauthorized preemptions in the Fair Credit Reporting Act, with some changes, by enacting the Fair and Accurate Credit Transactions Act of 2003.

* To apply changes in sharing of consumer information among affiliate companies correctly, insurers must refer to the FCRA for definitions.

* States may not override the authority of the FCRA.

* FACTA requires the Federal Trade Commission and the Federal Reserve to study the use of credit scores in consultation with the Fair Housing Office of the Department of Housing and Urban Development and report the results of their study to Congress.

Kathleen Jensen is industry and regulatory counsel for the Property Casually Insurers Association of America.