Users are individuals, businesses, agencies, or institutions that request consumer credit files from credit reporting agencies to determine creditworthiness, among other things. Under the FCRA, they can utilize credit report information to determine creditworthiness or in consideration of employment and certain types of insurance. (Life insurance underwriting policies can consider credit history, whereas medical insurance may not.) Of course, sometimes furnishers are users of reports, and vice versa. Existing creditors will often use reports to extend additional credit, to assist in their collection efforts, or to engage in risk-based pricing (i.e., set interest rates based on credit history). Credit reports may be used as follows:

o to determine eligibility for credit or insurance that will be used primarily for personal, family, or household purposes

o for employment purposes

o for other permissible purposes, which are specified as follows:

– to review or collect current accounts

– to establish eligibility for government licenses or other benefits

– to evaluate credit and repayment risks of existing credit obligations

– to respond to a legitimate business need for the information in connection with a transaction initiated by a consumer. (Those with whom you are doing business have the right to pull your credit file, period. Providing them with your SSN equals your implicit approval of the inquiry. It’s just that simple. In all cases, they can pull one or more bureau files to assess your creditworthiness.)

– to set or modify government-mandated child support payment levels

– in response to a court order

– on written instruction from the consumer

Users have a duty to safeguard credit report information, and failure to do so constitutes a breach of the FCRA. Users may provide a copy of the report to the consumer, though this isn’t required.

Civil penalties exist under the FCRA for impermissible purposes (anything that falls outside of the permissible purposes listed above), up to $1,000 per occurrence for knowing noncompliance. Some states have additional laws, such as the California statute that provides damages up to $2,500 for pulling a report for an impermissible purpose. Criminal penalties also exist for knowingly and willfully obtaining a report under false pretenses.