Under current federal law, the Fair Credit Reporting Act (FCRA) imposes
requirements and restrictions on certain uses of consumer information. Under the
FCRA, the definition of a "consumer report" includes any written, oral, or other
communication of information by a consumer reporting agency bearing on a
consumer's creditworthiness, credit standing, credit capacity, character, general
reputation, personal characteristics, or mode of living that is used or expected to be
used or collected in whole or in part for the purpose of serving as a factor in
establishing the consumer's eligibility for credit to be used primarily for personal,
family, or household purposes. A "consumer reporting agency" is any person,
including a business entity, that, for monetary fees, dues, or on a cooperative
nonprofit basis, regularly engages in whole or in part in the practice of assembling
or evaluating consumer credit information or other information on consumers for the
purpose of furnishing consumer reports to third-parties.

Under the FCRA, a consumer reporting agency may furnish a consumer report
only under specified circumstances. Among these circumstances, a consumer
reporting agency may furnish information to a person that it has reason to believe
intends to use the information in connection with a credit transaction involving the
consumer on whom the information is to be furnished and involving the extension
of credit to, or review or collection of an account of, the consumer. Absent
authorization by the consumer, a consumer reporting agency may furnish a

---

consumer report relating to a consumer in connection with a credit transaction that
is not initiated by the consumer (a "prescreened consumer report") only if all of the
following apply: (1) the transaction consists of a firm offer of credit; (2) the consumer
reporting agency has complied with its obligations relating to maintaining a system
allowing consumers to elect not to be the subject of prescreened consumer reports;
and (3) the consumer has not elected to be excluded from the consumer reporting
agency's prescreened consumer reports. A prescreened consumer report is limited
to the name and address of the consumer, an identifier that is not unique to the
consumer, and other information pertaining to the consumer that does not identify
the relationship or experience of the consumer with respect to a particular creditor
or other entity. The consumer reporting agency may also furnish a record of inquiries
in connection with credit transactions not initiated by the consumer for the previous
one-year period.

Under the FCRA, if a person uses a prescreened consumer report in connection
with a credit transaction not initiated by the consumer, the person must provide,
with each written solicitation made to the consumer, a clear and conspicuous
statement containing certain information, including that the person's prescreened
consumer report was used in connection with the transaction, that the person
received the offer of credit because the consumer satisfied certain criteria under
which the consumer was selected for the offer, and that the consumer has a right not
to be the subject of prescreened consumer reports and how to make this election. The
user of the prescreened consumer report must also maintain on file certain
information relating to the offer of credit made. In addition, each consumer reporting
agency must maintain reasonable procedures designed to limit the furnishing of
consumer reports to authorized purposes under the FCRA. These procedures must
require that prospective users of the information identify themselves, certify the
purposes for which the information is sought, and certify that the information will
be used for no other purpose. Each consumer reporting agency must make a
reasonable effort to verify the identity of a new prospective user and the uses certified
by this prospective user prior to furnishing the user a consumer report. No consumer
reporting agency may furnish a consumer report to any person if it has reasonable
grounds for believing that the consumer report will not be used for an authorized
purpose. A person may not use or obtain a consumer report for any purpose other
than an authorized purpose, as certified to the consumer reporting agency by the
prospective user.

This bill imposes certain state law restrictions on the dissemination and use of
trigger lead information, which restrictions vary depending on whether or not the
trigger lead is a consumer report under the FCRA. The bill defines "trigger lead" as
information relating to a consumer that is furnished by a consumer reporting agency
or personal financial data provider to a nonaffiliated third-party if all of the
following apply: (1) the consumer has applied to a lender, other than the third-party
to whom the information is furnished, for an extension of credit and the lender has
provided the consumer's credit application, or information derived from or related
to the consumer's credit application, to a consumer reporting agency or personal
financial data provider for purposes of obtaining a consumer report or otherwise

---

evaluating or rating the consumer's creditworthiness; (2) the information furnished
to the third-party includes the consumer's name and address or telephone number,
or other information that allows the third-party to identify the consumer; (3) the
information furnished to the third-party contains, with respect to the extension of
credit for which the consumer has applied, any identification of the amount of credit
for which the consumer has applied or any other information that is related to the
terms and conditions of credit for which the consumer has applied and that is not
generally available to the public; and (4) the consumer has not authorized the
consumer reporting agency or personal financial data provider to provide the
information to the third-party and has not initiated any credit transaction with the
third-party. The bill incorporates various federal law definitions from the FCRA.
The bill also defines "personal financial data provider" as any person, other than a
consumer reporting agency, that regularly engages in whole or in part in the practice
of assembling and furnishing to third-parties, for a fee or payment of dues, the
identity of particular consumers and financial information relating to such
consumers that is not generally available to the public, including information
derived from any application by these consumers for an extension of credit or other
nonpublic personal information, as defined under the federal Gramm-Leach-Bliley
Act, relating to these consumers.

Under the bill, if any trigger lead is not a prescreened consumer report under
federal law, a person, which includes a business entity, may not furnish the trigger
lead to a nonaffiliated third-party unless the person reasonably believes that the
third-party will not use the trigger lead to solicit any consumer identified in the
trigger lead. Any person that furnishes such a trigger lead to a nonaffiliated
third-party must establish and maintain procedures to reasonably ensure that the
trigger lead will not be used to solicit any consumer identified in the trigger lead.
A person that obtains such a trigger lead may not use the trigger lead to solicit any
consumer identified in the trigger lead.

Under the bill, if any trigger lead is a prescreened consumer report under
federal law, a person that obtains a trigger lead and uses the trigger lead to solicit
any consumer identified in the trigger lead may not utilize unfair or deceptive
practices in soliciting the consumer. Unfair or deceptive practices include all of the
following: (1) failure to state in the initial phase of the solicitation that the person
soliciting is not the lender, and is not affiliated with the lender, to which the
consumer has applied for an extension of credit; (2) failure in the initial solicitation
to comply with any applicable requirement under the FCRA relating to prescreened
consumer reports; (3) knowingly or negligently utilizing information regarding
consumers who have elected to be excluded from being the subject of prescreened
consumer reports or who have registered under the federal or state do-not-call list
programs; (4) soliciting consumers with offers of certain rates, terms, and costs, with
intent to subsequently raise the rates or change the terms to the consumers'
detriment; and (5) making false or misleading statements in connection with a credit
transaction that is not initiated by the consumer.

Any person who violates any prohibition or requirement under the bill may be
required to forfeit not less than $100 nor more than $1,000 for each violation. The

---

Department of Agriculture, Trade and Consumer Protection (DATCP) must
investigate violations of the prohibitions or requirements under the bill, and DATCP,
the attorney general, or any district attorney may bring an action for these
violations. In addition, any person aggrieved by a violation may bring a civil action
for twice the amount of actual damages caused by the violation or $500, whichever
is greater.