Military Credit Monitoring, 31180-31192 [2019-13598]

Download as PDF 31180 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations based on the amount of glass that becomes hazardous in high inertial loads. The glass items in groups one, two, and three are restricted to applications where the potential for injury is either highly localized, such as flightinstrument faces, or the location is such that injury due to failure of the glass is unlikely, for example mirrors in lavatories, because these installations necessitate the use of glass. These glass items typically are addressed in a method-of-compliance issue paper for each project based on existing part 25 regulations, or in established policy. These issue papers identify specific tests that could include abuse loading and ball-impact testing. In addition, these items are subject to the inertia loads contained in § 25.561, and maximum positive-differential pressure for items like video monitors to meet § 25.789. The items in group four are much larger and heavier than previously approved, and raise additional safety concerns. These large, heavy glass panels, primarily installed as architectural features, were not envisioned in the regulations. The unique aspects of glass, with the potential to become highly injurious or lethal objects during emergency landing, minor crash conditions, or in flight, warrant a unique approach to certification that addresses the characteristics of glass that prevented its use in the past. These special conditions were developed to ensure that airplanes with large glass features in passenger cabins provide the same level of safety as airplanes using traditional, lightweight materials. The FAA reiterates this intention in the text of the special conditions by qualifying their use for group four glass items. These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. khammond on DSKBBV9HB2PROD with RULES Applicability As discussed above, these special conditions are applicable to Dassault Model Falcon 2000EX airplanes. Should Dassault apply at a later date for a change to the type certificate to include another model incorporating the same novel or unusual design feature, these special conditions would apply to that model as well. Conclusion This action affects only certain novel or unusual design features on one model VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 series of airplane. It is not a rule of general applicability. List of Subjects in 14 CFR Part 25 Aircraft, Aviation safety, Reporting and recordkeeping requirements. Authority Citation The authority citation for these special conditions is as follows: Authority: 49 U.S.C. 106(f), 106(g), 40113, 44701, 44702, 44704. The Special Conditions Accordingly, pursuant to the authority delegated to me by the Administrator, the following special conditions are issued as part of the type certification basis for the Dassault Model Falcon 2000EX airplane. For large glass items (a single item, or a collective group of glass items, that weigh 4 kg or more in mass) installed in passenger-occupied rooms or areas during taxi, takeoff, and landing, or installed in rooms or areas that occupants must enter or pass through to access any emergency exit, the glass installations on the Dassault Model Falcon 2000EX airplane must meet the following conditions: 1. Material Fragmentation—The applicant must use tempered or otherwise treated glass to ensure that, when fractured, the glass breaks into small pieces with relatively dull edges. The glass component installation must retain glass fragments to minimize the danger from flying glass shards or pieces. The applicant must demonstrate this characteristic by impact and puncture testing, and testing to failure. The applicant may conduct this test with or without any glass coating that may be utilized in the design. 2. Strength—In addition to meeting the load requirements for all flight and landing loads, including any of the applicable emergency-landing conditions in subparts C & D of 14 CFR part 25, the glass components that are located such that they are not protected from contact with cabin occupants must not fail due to abusive loading, such as impact from occupants stumbling into, leaning against, sitting on, or performing other intentional or unintentional forceful contact with the glass component. The applicant must assess the effect of design details such as geometric discontinuities or surface finish, including but not limited to embossing and etching. 3. Retention—The glass component, as installed in the airplane, must not come free of its restraint or mounting system in the event of an emergency landing, considering both the directional loading and resulting ■ PO 00000 Frm 00010 Fmt 4700 Sfmt 4700 rebound conditions. The applicant must assess the effect of design details such as geometric discontinuities or surface finish, including but not limited to embossing and etching. 4. Instructions for Continued Airworthiness—The instructions for continued airworthiness must reflect the method used to fasten the panel to the cabin interior and must ensure the reliability of the methods used (e.g., life limit of adhesives, or clamp connection). The applicant must define any inspection methods and intervals based upon adhesion data from the manufacturer of the adhesive, or upon actual adhesion-test data, if necessary. Issued in Des Moines, Washington, on June 20, 2019. Christopher R. Parker, Acting Manager, Transport Standards Branch, Policy and Innovation Division, Aircraft Certification Service. [FR Doc. 2019–14007 Filed 6–28–19; 8:45 am] BILLING CODE 4910–13–P FEDERAL TRADE COMMISSION 16 CFR Part 609 RIN 3084–AB54 Military Credit Monitoring Federal Trade Commission. Final rule. AGENCY: ACTION: The Federal Trade Commission (‘‘FTC’’ or ‘‘Commission’’) is publishing a final rule to implement the credit monitoring provisions applicable to active duty military consumers in section 302 of the Economic Growth, Regulatory Relief, and Consumer Protection Act, which amends the Fair Credit Reporting Act (‘‘FCRA’’). That section requires nationwide consumer reporting agencies (‘‘NCRAs’’) to provide a free electronic credit monitoring service to active duty military consumers, subject to certain conditions. The final rule defines ‘‘electronic credit monitoring service,’’ ‘‘contact information,’’ ‘‘material additions or modifications to the file of a consumer,’’ and ‘‘appropriate proof of identity,’’ among other terms. It also contains requirements on how NCRAs must verify that an individual is an active duty military consumer. Further, the final rule contains restrictions on the use of personal information and on communications surrounding enrollment in the electronic credit monitoring service. DATES: The amendments are effective July 31, 2019. However, compliance is not required until October 31, 2019. SUMMARY: E:\FR\FM\01JYR1.SGM 01JYR1 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations Relevant portions of the record of this proceeding, including this document, are available at https:// www.ftc.gov. ADDRESSES: FOR FURTHER INFORMATION CONTACT: khammond on DSKBBV9HB2PROD with RULES Amanda Koulousias (202–326–3334), akoulousias@ftc.gov, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. SUPPLEMENTARY INFORMATION: I. Overview and Background The Economic Growth, Regulatory Relief, and Consumer Protection Act (‘‘the Act’’) was signed into law on May 24, 2018. Public Law 115–174. The Act, among other things, amends section 605A of the FCRA, 15 U.S.C. 1681c–1, to add a section 605A(k). Section 605A(k)(2) requires that NCRAs provide free electronic credit monitoring services to active duty military consumers. Section 605A(k)(3) of the FCRA requires the Commission to issue a regulation clarifying the meaning of certain terms used in section 605A(k)(2), including ‘‘electronic credit monitoring service’’ and ‘‘material additions or modifications to the file of a consumer.’’ In addition, section 605A(k)(3) requires that the Commission’s regulation clarify what constitutes appropriate proof that an individual is an active duty military consumer. On November 16, 2018 (83 FR 57693), the Commission published a notice of proposed rulemaking (‘‘NPRM’’). The proposed rule applied to NCRAs, as defined in section 603(p) of the Fair Credit Reporting Act, 15 U.S.C. 1681a(p). The proposed rule required the NCRAs to provide a free electronic credit monitoring service that notifies a consumer of material additions or modifications to the consumer’s file when the consumer provides (1) contact information, (2) appropriate proof that the consumer is an active duty military consumer, and (3) appropriate proof of identity. The proposed rule specified that the NCRA must provide notification to the consumer within 24 hours of the material addition or modification. The proposed rule also required that the notifications to consumers include a hyperlink to a summary of the consumer’s rights under the FCRA, as prescribed by the Bureau of Consumer Financial Protection under 15 U.S.C. 1681g(c). The proposed rule defined certain key terms, including ‘‘electronic credit monitoring service,’’ ‘‘electronic notification,’’ and ‘‘material additions or modifications.’’ The proposed rule also specified what constitutes appropriate VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 proof that the consumer is an active duty military consumer. Further, the proposed rule restricted NCRAs’ ability to use and disclose the information they collect from consumers in order to provide the required electronic credit monitoring service. Additionally, the proposed rule contained some limitations on communications surrounding enrollment in an electronic credit monitoring service. Finally, the proposed rule prohibited asking or requiring an active duty military consumer to agree to terms or conditions in connection with obtaining a free electronic credit monitoring service. In response to the NPRM, the Commission received 19 comments from industry representatives, military and consumer advocacy groups, government agencies, members of Congress, and individual members of the public.1 In addition to providing feedback on the proposed rule, commenters highlighted the importance of military consumers’ financial health for overall military readiness and national security. These commenters noted that ‘‘servicemembers in financial distress are often forced to leave the military due to loss of security clearance or for other reasons.’’ 2 Commenters also noted the rule’s importance in protecting military consumers from fraud.3 II. Section by Section Analysis a. Scope of Regulations in This Part, § 609.1 Proposed § 609.1 described the statutory authority for the proposed rule, section 605A(k)(2) of the FCRA, 15 U.S.C. 1681c–1(k)(2). The Commission received no comments on this section, and adopts it as proposed. b. Definitions, Section 609.2 i. Definition of Active Duty Military Consumer, § 609.2(a) The NPRM proposed defining ‘‘active duty military consumer’’ as a consumer in military service, as defined in the FCRA. Prior to enactment of the Act, 1 All comments can be found on the FTC’s website at: https://www.ftc.gov/policy/publiccomments/2018/11/initiative-784. 2 See Veterans Education Success et al. (comment 22) at 1 (the following veteran and military services organizations submitted a joint comment: Army Aviation Association of America; Association of Military Surgeons of the United States; Association of the United States Navy; Enlisted Association of the National Guard of the United States; Jewish War Veterans; National Guard Association of the United States; National Military Family Association; Tragedy Assistance Program for Survivors; Veterans Education Success; Vietnam Veterans of America). 3 Robert Palmersheim (comment 2). PO 00000 Frm 00011 Fmt 4700 Sfmt 4700 31181 section 603(q)(1) of the FCRA, 15 U.S.C. 1681a(q)(1), defined an ‘‘active duty military consumer’’ as a consumer in military service who—(A) is on active duty (as defined in section 101(d)(1) of title 10, United States Code) or is a reservist performing duty under a call or order to active duty under a provision of law referred to in section 101(a)(13) of title 10, United States Code; and (B) is assigned to service away from the usual duty station of the consumer. The Act added section 605A(k)(1) to the FCRA, 15 U.S.C. 1681c–1(k)(1), and specified that, in the credit monitoring subsection, the term ‘‘active duty military consumer’’ also includes a member of the National Guard, with the term ‘‘National Guard’’ having the meaning given the term in section 101(c) of title 10, United States Code. Thus, the proposed rule defined ‘‘active duty military consumer’’ as a ‘‘consumer in military service as defined in 15 U.S.C. 1681a(q)(1) and 1681c–1(k)(1).’’ 4 The Commission received several comments on this definition. DoD expressed concern that the proposed definition could result in military consumers receiving unequal access to the free credit monitoring services based on their individual military component, duty status, or location.5 For example, DoD stated that the requirement for the consumer to be ‘‘assigned to service away from the usual duty station’’ is severely limiting, as a military consumer is likely to spend most of her active duty career assigned to the ‘‘usual duty station.’’ DoD recommended that the Commission modify the definition in order to be consistent with the definition of active duty in the military compensation statute,6 which does not require that the military consumer be deployed away from her usual duty station. Military groups commented that the Commission should defer to DoD on this definition.7 Senators Carper and Coons commented that the rule should cover ‘‘the largest number of servicemembers as permitted by the 4 The Department of Defense (‘‘DoD’’) suggested referencing 15 U.S.C. 1681c–1(i)(1) rather than 15 U.S.C. 1681c-1(k)(1), stating that the former contains the provisions related to the National Guard. This appears to be based on a misreading of the statute, as 15 U.S.C. 1681c–1(k)(1) does in fact in contain the provisions related to the National Guard. See DoD—Defense Department (comment 12) at 2. 5 See DoD—Defense Department (comment 12) at 1–2. 6 37 U.S.C. 101(18). 7 See Veterans Education Success et al. (comment 22) at 2. This commenter noted that increased deployments and training require Guard and Reserve members to maintain their financial readiness because they can be called up at a moment’s notice. E:\FR\FM\01JYR1.SGM 01JYR1 31182 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations khammond on DSKBBV9HB2PROD with RULES law.’’ 8 Another commenter recommended that the rule cover retired military consumers.9 While the Commission recognizes and appreciates the policy rationale behind broadening the group of military consumers who are eligible to receive free credit monitoring, the statutory language limits the Commission’s discretion on this topic. In amending the FCRA, Congress recognized that the FCRA’s existing definition of ‘‘active duty military consumer’’ excluded members of the National Guard. Congress specified that, for purposes of the credit monitoring provisions, an ‘‘active duty military consumer,’’ includes a member of the National Guard.10 The fact that the Act addressed the exclusion of the National Guard, but not the definition’s requirement that the military consumer be ‘‘assigned to service away from the usual duty station,’’ suggests that Congress may have intended for that limitation to remain. To the extent that Congress intended to provide free credit monitoring more broadly, i.e., to all active duty military, regardless of their duty station, the Commission calls on Congress to address this issue through additional legislation. If Congress passes legislation to provide the Commission with statutory authority to promulgate a more expansive rule, the Commission will act expeditiously to do so. The Commission acknowledges that the proposed rule’s definition did not expressly address whether a National Guard member covered by the definition in 15 U.S.C. 1681c–1(k)(1) also needs to be assigned to service away from the usual duty station. The Commission recognizes that providing National Guard members with free credit monitoring at all times, while limiting the service for individuals serving in other military components, such as the Army or Air Force, to those assigned away from their usual duty station, would result in an inequitable distribution of benefits. However, when Congress amended the FCRA to add section 605A(k)(1), it did not expressly apply the duty station requirement to National Guard members. Thus, the statutory language is imprecise on this question. Therefore, notwithstanding this apparent inequity, the Commission has interpreted the Act as providing the benefit of free credit monitoring to 8 See Letter from Senator Thomas R. Carper and Senator Christopher A. Coons of the United States Senate Regarding the Military Credit Monitoring Rulemaking Proceeding and the Proposed Rule Set Forth in the Notice of Proposed Rulemaking (January 23, 2019) at 2. 9 Patrick Mabry (comment 9). 10 15 U.S.C. 1681c–1(k)(1). VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 members of the National Guard regardless of whether they are assigned away from their usual duty station. To ensure clarity on this issue, the Commission has determined to modify the definition of active duty military consumer as (1) a consumer in military service that meets the original FCRA definition of ‘‘active duty military consumer’’ (15 U.S.C. 1681a(q)(1)); or (2) a member of the National Guard (10 U.S.C. 101(c)). ii. Definition of Appropriate Proof of Identity, § 609.2(b) The NPRM proposed defining ‘‘appropriate proof of identity’’ as having the same meaning set forth in 12 CFR 1022.123. That section requires consumer reporting agencies (‘‘CRAs’’) to develop reasonable policies for determining a consumer’s identity for purposes of FCRA sections 605A (obtaining a fraud alert), 605B (requesting that information resulting from identity theft be blocked from one’s consumer report), and 609(a)(1) (requesting a file disclosure from a CRA). The definition is risk-based, meaning that a CRA’s policy with respect to appropriate proof of identity should be commensurate with the risk of harm to the consumer resulting from misidentification, and should not unreasonably restrict a consumer’s access to statutorily required services. The NPRM specifically sought comment on whether the rule should keep this cross-reference to 12 CFR 1022.123, stay silent on the definition, or develop a different approach. The Commission received one comment supporting the NPRM definition and two comments recommending changes. The Consumer Data Industry Association (‘‘CDIA’’) commented that referencing the existing standard would reduce the implementation burden for its NCRA members.11 Consumer and military groups recommended that the Commission tailor ‘‘appropriate proof of identity’’ to the unique circumstances of military consumers.12 These commenters noted that military consumers often move frequently, making it burdensome for them to 11 See CDIA (comment 23) at 10. National Consumer Law Center (‘‘NCLC’’) et al. (comment 20) at 5 (the following consumer groups submitted a joint comment: NCLC, Americans For Financial Reform Education Fund, Center for Digital Democracy, Consumer Action, Consumer Federation of America, Demos, National Association of Consumer Advocates, Public Citizen, US PIRG, Woodstock Institute, East Bay Community Law Center, Housing and Economic Rights Advocates, Tzedek DC, and the Legal Aid Society of Palm Beach County); Veterans Education Success et al. (comment 22) at 2. 12 See PO 00000 Frm 00012 Fmt 4700 Sfmt 4700 provide the 2-year address history that CRAs currently require for identity validation for file disclosures. These commenters also stated the NCRAs require less identifying information from consumers who are purchasing their credit report than they do from consumers who are seeking access to their free annual credit report. After carefully considering the comments received, the Commission has determined to retain the definition of ‘‘appropriate proof of identity’’ without modification. The existing definition requires the NCRAs to develop ‘‘reasonable requirements’’ that take into account the ‘‘identifiable risk of harm’’ that could result from misidentification.13 The Commission interprets the existing standard’s reasonableness requirement to obligate the NCRAs to consider the unique circumstances of military consumers in developing their requirements for proof of identity for the free electronic credit monitoring service. They must weigh any such considerations against the risk of harm from providing sensitive credit report information to the wrong consumer while not restricting access to the statutorily mandated services unreasonably. In response to the concern that NCRAs currently require less identifying information for paid services than for free services, the Commission notes that the fact that a consumer is requesting a free rather than a paid service should not by itself prompt a higher standard for proof of identity, unless the NCRA is using the payment method as an additional form of authentication or there are other identified aspects of the unpaid service that increase the fraud risk. iii. Definition of Electronic Credit Monitoring Service, § 609.2(g) The proposed rule defined ‘‘electronic credit monitoring service’’ as a service through which NCRAs provide, at a minimum, electronic notification of material additions or modifications to a consumer’s file. The Commission solicited comment as to whether this definition is adequate or if any modifications are necessary. Several commenters stated that the proposed definition is not adequate and that the Commission should expand it to include free electronic access to the consumer’s credit file following a notification of a material addition or modification.14 Commenters noted that 13 12 CFR 1022.123(a). e.g., NCLC et al. (comment 20) at 2–3; Veterans Education Success et al. (comment 22) at 1–2; Mass Mail Campaign (comment 13); Law Office of Phillip R. Goldberg (comment 19); Jeff Seymour (comment 18). 14 See, E:\FR\FM\01JYR1.SGM 01JYR1 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations without this free access, military consumers may be required to pay to examine their credit files following the receipt of a notification. One commenter stated that the information contained in the files of the three NCRAs is not always the same and recommended that the rule provide free access to the credit files at all three NCRAs following a notification.15 The commenters also noted that commercial credit monitoring products typically include access to credit reports. The Commission agrees with the commenters that free access to their credit files following a notification will allow the active duty military consumer to evaluate the addition or modification in the context of their entire credit report without being required to pay for that access in connection with a service that Congress intended them to receive for free. Indeed, current commercial credit monitoring services offered by the NCRAs advertise that they provide consumers with access to their credit files. However, the Commission declines to require an NCRA to pay the costs of obtaining a consumer’s credit files from the other two NCRAs for the purposes of providing the files to the consumer. Instead, consumers who are concerned about potential discrepancies in their files at the three NCRAs can request free credit monitoring services from all three of them. Given the comments received, the Commission modifies the definition of electronic credit monitoring service as follows: A service through which NCRAs provide, at a minimum, electronic notification of material additions or modifications to a consumer’s file and following a notification, access to all information in the consumer’s file at the NCRA at the time of the notification, in accordance with 15 U.S.C. 1681g(a).16 iv. Definition of Electronic Notification, § 609.2(h) khammond on DSKBBV9HB2PROD with RULES The proposed rule defined ‘‘electronic notification’’ as a notice provided to the consumer via a website; mobile application; email; or text message. The NPRM asked whether this definition is adequate or whether the rule should include additional methods. 15 Veterans Education Success et al. (comment 22) at 1–2. 16 15 U.S.C. 1681c–1(k)(2) states that the free electronic credit monitoring service shall ‘‘at a minimum’’ notify the consumer of material additions or modifications to the file, and 15 U.S.C. 1681c–1(k)(3) requires the Commission’s rule to define electronic credit monitoring service. Thus, the statute contemplates that the Commission can define electronic credit monitoring service to include other features. VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 The Commission received a number of comments on this definition. CDIA commented that it appreciates the flexibility the definition gives and noted that the proposed definition includes the methods of delivery currently in use in the marketplace.17 Consumer groups raised a concern that website notifications could result in the NCRAs not actively informing military consumers of material changes, instead requiring the consumer to regularly and proactively check their account on the website. They recommended that the Commission clarify that, when a notification is made via website, there should be some form of active ‘‘push’’ notification, whether via email, text, or mobile app notification, of the fact that there have been material additions or modifications.18 This would ensure a consumer is notified of changes, even if the consumer must then go to the website to determine what that actual change is. Blue Star Families recommended that the notification methods include encrypted messaging platforms such as WhatsApp or Signal, which military consumers may commonly use during training events or deployment.19 They also recommended that military consumers be able to designate an alternate point of contact when they don’t have access to notification platforms or the ability to take action based on an alert. The Commission has carefully considered the comments received. As to the use of encrypted messaging platforms, the Commission notes that the proposed definition already allows the NCRAs to provide notices via mobile applications; thus, no change to the rule is necessary to allow them to provide notices via these platforms. As to allowing an alternate point of contact, the Commission is concerned about the security implications of requiring NCRAs to transmit sensitive alerts about consumers’ credit information to multiple points of contact. Although the Commission declines to modify the proposed rule to require alternative points of contact, we understand the concerns that the military consumer may be unable to access notification platforms or take action based on alerts while deployed. Accordingly, the Commission encourages the NCRAs to explore options for addressing these issues. Finally, as to notification via website, the Commission agrees that military consumers should not have to proactively log onto to a website in 17 See CDIA (comment 23) at 5. NCLC et al. (comment 20) at 4–5. 19 See Blue Star Families (comment 24) at 1. 18 See PO 00000 Frm 00013 Fmt 4700 Sfmt 4700 31183 order to continually check whether a material addition or modification has been made to their files. Instead, there should be some form of active notification. Accordingly, the final rule deletes the reference to allowing notification by website. It continues to require electronic notification of material additions or modifications by mobile application, email, or text message, but clarifies that the notices can link to a website where the consumer can find additional information regarding the specifics of the addition or modification. v. Definition of Free, § 609.2(k) The proposed rule defined ‘‘free’’ as ‘‘provided at no cost to the consumer.’’ The Commission received one comment on this definition. Senators Carper and Coons recommended that the Commission define ‘‘free’’ to prohibit the secondary use of military consumers’ personal information; the disclosure of such information to third parties; the use of such information for marketing purposes; or the implication that the consumer should purchase identity theft insurance.20 The Commission agrees with the Senators that the rule should not allow secondary uses, disclosures to third parties, or the use of information for marketing purposes, but does not believe that a change to the definition of ‘‘free’’ is necessary. As discussed below, the rule already specifies that the NCRAs can use information collected to provide the military credit monitoring service only in four instances: To provide the service requested by the consumer; to process a transaction requested by the consumer at the same time he or she requests the service; to comply with applicable legal requirements; or to update information the NCRA already maintains for the purpose of providing consumer reports, with certain limitations. Thus, the rule would not permit the uses contemplated by the commenters. As to the suggestion that the definition of ‘‘free’’ prohibit the implication that the consumer should purchase identity theft insurance, the rule already requires NCRAs to delay all marketing until after the consumer has enrolled in the free electronic credit monitoring service. This requirement would include marketing of insurance products. Given the restrictions on information use, disclosure, and marketing in other sections of the rule, the Commission has determined to 20 See Letter from Senator Thomas R. Carper and Senator Christopher A. Coons of the United States Senate Regarding the Military Credit Monitoring Rulemaking Proceeding and the Proposed Rule Set Forth in the Notice of Proposed Rulemaking (January 23, 2019) at 2. E:\FR\FM\01JYR1.SGM 01JYR1 31184 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations khammond on DSKBBV9HB2PROD with RULES adopt the proposed rule’s definition of ‘‘free’’ without modification. vi. Definition of Material Additions or Modifications, § 609.2(l) The NPRM defined ‘‘material additions or modifications’’ as significant changes to a consumer’s file, including the establishment of new accounts; inquiries or requests for a consumer report, other than for prescreening or account review; changes to name, address, or phone number; changes to credit account limits; and negative information. The Commission requested comment on whether this definition was adequate or if the rule should add other elements. The Commission also requested comment on specific issues related to this definition, including whether changes to credit account limits should remain; whether the exceptions for prescreening and account review are appropriate; and whether NCRAs have the ability to differentiate between inquiries made for the purposes of account review and collection. The Commission received two comments recommending global changes to the definition of material additions or modifications. First, consumer groups recommended that the definition provide an exhaustive list of material changes and that the NCRAs be required to get Commission approval to provide notifications for any changes not on that list.21 They expressed concern that without such a limitation, the NCRAs may over-notify military consumers and cause unnecessary alarm. Second, CDIA recommended that the list of material changes be examples and that the Commission provide a safe harbor for the NCRAs to provide their commercial credit monitoring services to active duty military consumers for free.22 CDIA expressed concern that without a safe harbor, the rule will force the NCRAs to develop new products and services. CDIA noted that Congress chose to require only one portion of the consumer reporting market—the NCRAs—to provide their credit monitoring services to active duty military consumers for free. Therefore, CDIA stated that the Commission should seek to reduce the burdens and costs placed on the NCRAs. The Commission does not believe it is necessary for the rule to provide an exhaustive list of material additions or modifications because the Commission believes the risk of over-notification from allowing NCRAs to notify consumers of additional changes is low. The NCRAs do not have an incentive to increase their costs by providing excessive notifications to military consumers. The Commission also declines to grant the NCRAs a safe harbor for providing their commercial credit monitoring services to military consumers for free. The Act requires the Commission to promulgate a rule that defines ‘‘material additions or modifications to the file of a consumer.’’ In the absence of a minimum standard, NCRAs could create new tiers for commercial credit monitoring products and offer active duty military consumers free versions of a new product with only limited features. Congress could not have intended this result. At the same time, the Commission appreciates that providing a free electronic credit monitoring service to active duty military consumers will place costs and burdens on the NCRAs. Thus, as discussed below, the Commission has sought to align the requirements with the NCRAs’ existing commercial credit monitoring services as much as possible while ensuring that the service required by the rule provides appropriate consumer protections. In addition to receiving global comments on the definition of ‘‘material addition or modification,’’ the Commission received comments on several specific proposals. First, the proposed rule’s inclusion of changes to a consumer’s name, address, or phone number was the subject of several comments. One commenter expressed support for including these changes.23 Another commenter recommended that the rule also include a change to email address as a material addition or modification because the CRAs typically notify customers of their commercial credit monitoring services of changes via email.24 On the other hand, CDIA recommended that the Commission remove changes to consumers’ names, addresses and phone numbers from the definition because those changes are not uniformly part of the NCRAs’ commercial credit monitoring products.25 After considering these comments, the Commission has decided to retain the requirement to notify consumers of changes to their address. The Commission is concerned that failing to provide a notification about the appearance of a new address in a consumer’s file will potentially leave consumers without notice of a key indicator of fraud. For example, an 23 See 21 See NCLC et al. (comment 20) at 4. 22 See CDIA (comment 23) at 6–9. VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 NCLC et al. (comment 20) at 3. Anonymous Students (comment 8). 25 See CDIA (comment 23) at 8. 24 See PO 00000 Frm 00014 Fmt 4700 Sfmt 4700 identity thief may change the address listed on a consumer’s existing credit card account in order to reroute statements so that the consumer does not see fraudulent charges. At least one of the NCRAs currently provides alerts for address changes.26 Additionally, it appears that new addresses are monitored in all three of the NCRAs’ consumer files.27 Furthermore, in other sections of the FCRA, Congress has put in place requirements that suggest it believed that a change in address could be a sign of fraud.28 To lessen the chance of over-notification, the Commission has decided to modify the requirement to clarify that only a material change to an address requires notification. Thus, if the address 123 Main Street was already included in a consumer’s file, the NCRAs are not required to provide a notification if a creditor reports an address of 123 Main St.29 However, the Commission has decided to remove the requirement that the NCRAs provide notifications for changes to name and phone number. Unlike addresses, it is not clear whether changes to the names and phone numbers in consumers’ files are routinely monitored or included in commercial credit monitoring alerts. For similar reasons, the Commission declines to require notifications for changes to email address. Of course, nothing in the rule prohibits the NCRAs from providing such alerts if they choose to do so. Second, several commenters addressed the definition’s inclusion of changes to credit account limits. Some commenters recommended retaining notification for changes to credit account limits, noting that this information is useful to military consumers.30 CDIA recommended 26 See Equifax, What types of credit monitoring alerts should I expect to receive?, https:// help.equifax.com/s/article/What-types-of-creditmonitoring-alerts-should-I-expect-to-receive (last visited May 2, 2019). A number of commercial credit monitoring services provided by companies other than the NCRAs also advertise that they provide alerts for address changes in consumers’ files. See, e.g., LastPass, What triggers a credit monitoring alert, https://lastpass.com/support.php? cmd=showfaq&id=3926 (last visited May 2, 2019). 27 See myFICO, https://www.myfico.com/Include/ Store/Legal/FAQAlertMatrix (last visited May 2, 2019). 28 15 U.S.C. 1681c(h) (related to notice of discrepancy in address); 15 U.S.C. 1681m(e)(C) (related to regulations for card issuers regarding changes of address). 29 However, as discussed above, the rule’s list of material additions or modifications is nonexhaustive, thus the NCRAs may provide notifications of these types of changes if they choose. 30 See NCLC et al. (comment 20) at 4; Blue Star Families (comment 24) at 1. For example, NCLC E:\FR\FM\01JYR1.SGM 01JYR1 khammond on DSKBBV9HB2PROD with RULES Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations removing changes to credit account limits because NCRAs do not uniformly include notification of changes to account limits in commercial credit monitoring services, such changes are not indicative of identity theft or fraud, and the proposed rule gives no guidance on what level of change in account limits would be material.31 The Commission has decided to retain the category of ‘‘changes to credit account limits’’ in the list of material additions and modifications of which consumers must be notified. The Commission disagrees with the comment that changes to credit account limits are not indicative of identity theft or fraud. For example, an identity thief may call a credit card company and request that an account limit be raised so that she can make additional fraudulent charges. Indeed, in drafting the FCRA provision dealing with fraud alerts, Congress prohibited creditors from increasing the credit limit on an existing account that contains a fraud alert without verifying the requestor’s identity. This prohibition illustrates that Congress believed that such a change in account limits could be indicative of fraud. For these reasons, the Commission declines to remove changes to credit account limits from the list of material additions or modifications. The Commission does recognize that the proposed rule did not set a threshold for a material change and that a lack of such a threshold could create uncertainty in the marketplace. Thus, the Commission has determined that the rule will require notifications for changes to credit account limits of $100 or greater. These are the types of changes that are monitored in at least one of the NCRA’s consumer files.32 Third, the proposed rule included inquiries or requests for a consumer report as a material addition or modification, with an exception for inquiries for prescreening or account review. The NPRM noted that notifying consumers of pre-screening or account review inquiries could result in overnotification, making it difficult for consumers to determine when an inquiry indicates that they are potentially the victim of identity theft or other fraud. The proposed rule did not include an exception for inquiries for the purposes of account collection, but the NPRM asked whether NCRAs have the ability to differentiate between noted that credit card issuers are not always required to notify consumers about decreased account limits. 31 See CDIA (comment 23) at 8. 32 See myFICO, https://www.myfico.com/Include/ Store/Legal/FAQAlertMatrix (last visited May 2, 2019). VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 account collection and account review inquiries. CDIA’s comment indicated that NCRAs cannot distinguish between account review and collection.33 CDIA explained that the NCRAs only require companies to provide their permissible purpose for obtaining a consumer report, but that the permissible purpose for account review and account collection is the same. Thus, if the rule were to require notifications of inquiries made for account collection (as the proposed rule did), NCRAs would likely provide notifications of inquiries for account review, which could result in overnotification. Accordingly, CDIA recommended notification be limited to ‘‘inquiries or requests for a consumer report in connection with the establishment of a new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 103(i)),34 in the name of the consumer.’’ 35 CDIA noted that similar language is used elsewhere in the FCRA.36 Given that the NCRAs do not differentiate between inquiries for account review and account collection, the Commission agrees that inquiries for account collection should be excepted. The Commission notes that if a company establishes a new collection account, the NCRA would already have to send a notification because new accounts are included in the list of material additions or modifications. To ensure that there is no ambiguity about that requirement, the Commission has decided to modify § 609.2(l)(1) to provide that significant changes to a consumer’s file includes new accounts opened in the consumer’s name, including new collection accounts. With respect to § 609.2(l)(2), the Commission declines to adopt CDIA’s proposed language. The proposed language would only require notification for inquiries or requests for a consumer report in connection with a credit transaction. Thus, for example, military consumers would not receive a notification if an employer or insurer requested their report because someone applied for employment or insurance in their name, 33 See CDIA (comment 23) at 9. open-end credit plan is ‘‘a plan under which the creditor reasonably contemplates repeated transactions, which prescribes the terms of such transactions, and which provides for a finance charge which may be computed from time to time on the outstanding unpaid balance.’’ 15 U.S.C. 1602(j). A typical example of an open-end credit plan is a credit card. Thus, under the recommended language an inquiry triggered by a creditor conducting account review for an existing credit card account would not require notification. 35 See CDIA (comment 23) at 6–7. 36 See 15 U.S.C. 1681c–1(h). 34 An PO 00000 Frm 00015 Fmt 4700 Sfmt 4700 31185 which could be indicative of identity theft. Therefore, the Commission has determined to modify § 609.2(l)(2)(i) to provide that an inquiry made for a prescreened list obtained for the purpose of making a firm offer of credit or insurance as described in 15 U.S.C. 1681b(c)(1)(B) or for the purpose of reviewing or collecting an account of the consumer shall not be considered a material addition or modification. Finally, two commenters recommended adding a significant drop in credit score, such as 25 points or more, to the list of material additions or modifications. These commenters suggested that such a drop may indicate a significant change to the consumer’s file, possibly due to fraud.37 Military groups also noted that a large drop in credit score could signal a problem that leads to revocation of a military consumer’s security clearance. Although the Commission is sympathetic to these concerns, it declines to make this change. The rule already requires the NCRAs to provide a notification about events that would likely cause a significant drop in credit score, such as a delinquency. Beyond requiring notification of substantive events that would likely cause a significant drop in credit score, the Commission does not have information at this time to determine the feasibility and costs of this proposal. For example, it is not clear how often the NCRAs are calculating credit scores in the absence of a request from a consumer or creditor. Nor is it clear how much it would cost NCRAs to continuously monitor credit scores for the purpose of providing an alert when there is a significant drop. Thus, the Commission declines to include this change. vii. Definition of Negative Information, § 609.2(n) The NPRM defined ‘‘negative information’’ as having the meaning provided in 15 U.S.C. 1681s– 2(a)(7)(G)(i), which in turn defines ‘‘negative information’’ to mean ‘‘information concerning a customer’s delinquencies, late payments, insolvency, or any form of default,’’ in the context of furnishers providing information to the CRAs. The Commission received one comment on this definition. CDIA noted that the proposed definition does not provide enough specificity to the NCRAs as to 37 See NCLC et al. (comment 20) at 3 (NCLC suggested that a credit score drop might be caused by a drastic increase in the usage of a credit line, due to existing account fraud); Veterans Education Success et al. (comment 22) at 2–3. E:\FR\FM\01JYR1.SGM 01JYR1 31186 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations when notification is required.38 CDIA recommended that the Commission modify the definition as follows: Accounts furnished to the NCRAs as more than 30 days delinquent, accounts furnished to the NCRAs as being included in bankruptcy petition filings, and new public records (such as suits or judgments). The Commission believes that CDIA’s proposed language covers the negative information that the Commission intended for the proposed rule to require notification of and therefore has decided to modify the language to provide the NCRAs greater specificity. The Commission is also adding additional detail to provide a non-exhaustive list of what types of new public records may constitute negative information. Thus, the Commission has decided to modify the definition of ‘‘negative information’’ as follows: Accounts furnished to the NCRAs as more than 30 days delinquent, accounts furnished to the NCRAs as being included in bankruptcy petition filings, and new public records, including, but not limited to, bankruptcy filings, civil court judgments, foreclosures, liens, and convictions. viii. Definitions of Consumer, Consumer Report, Contact Information, Credit, File, Firm Offer of Credit, and Nationwide Consumer Reporting Agency The Commission received no comments on the proposed rule’s definitions of ‘‘consumer,’’ ‘‘consumer report,’’ ‘‘contact information,’’ ‘‘credit,’’ ‘‘file,’’ ‘‘firm offer of credit,’’ and ‘‘nationwide consumer reporting agency.’’ The Commission adopts these definitions without modification. c. Requirement To Provide Free Electronic Credit Monitoring Service, § 609.3 khammond on DSKBBV9HB2PROD with RULES Proposed § 609.3(a) required the NCRAs to provide a free electronic credit monitoring service to active duty military consumers.39 Proposed § 609.3(b) allowed the NCRAs to condition provision of the service upon the consumer providing appropriate proof of identity; contact information; and appropriate proof that the consumer is an active duty military consumer. Proposed § 609.3(c) provided the methods for verifying a consumer’s 38 See CDIA (comment 23) at 8–9. Commission received one comment stating that the FTC should seek rulemaking authority to provide free credit monitoring services to all U.S. residents and not just active duty military consumers. Electronic Privacy Information Center (comment 26) at 2–3. The Commission does not take a position on the merits of this proposal because it is outside the scope of this rulemaking. 39 The VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 status as an active duty military consumer. Proposed § 609.3(d) limited the ways that the NCRAs can use or disclose the information collected from consumers as a result of a request to obtain the service. Proposed § 609.3(e) placed limitations on the types of communications that may surround enrollment in the service. Proposed § 609.3(f) prohibited asking or requiring a consumer to agree to terms or conditions in connection with obtaining the service. i. Appropriate Proof of Active Duty Military Consumer Status, § 609.3(c) The proposed rule required NCRAs to verify a consumer’s status as an active duty military consumer through one of four methods: A copy of the consumer’s active duty orders; a copy of a certification of active duty status issued by the DoD; a method or service approved by the DoD; or a certification of active duty status approved by the NCRA. The Commission requested comment on whether these methods are adequate or if other methods should be included. The Commission also asked whether it is burdensome for consumers to provide appropriate proof, and if so, if there are ways to minimize the burden. The Commission received several comments on the methods for validating a consumer’s active duty military consumer status. CDIA recommended that the Commission work with DoD to come up with an automated system to conclusively determine whether a consumer is eligible for the service and that will also verify the time period for which the consumer is eligible for the service.40 Absent an automated system, CDIA stated that the Commission should clarify that the determination of active duty status is valid for two years and then must be renewed. Consumer groups similarly suggested that the NCRAs be allowed to use the DoD developed database that lenders use to comply with the Military Lending Act (‘‘MLA’’).41 With respect to the requests for an automated system run by the DoD, the Commission notes that if DoD were to develop such a system, it would be considered ‘‘a method or service approved by the DoD’’ and thus would not require any modification to the rule. The Commission will work with the DoD to explore whether a DoD-run system or database is viable.42 The 40 See CDIA (comment 23) at 11. NCLC et al. (comment 20) at 6. 42 With respect to the comment that NCRAs be allowed to use the MLA database, the Commission notes that DoD currently only allows the database 41 See PO 00000 Frm 00016 Fmt 4700 Sfmt 4700 Commission agrees that in the absence of an automated system, the rule should specify a period of time for which the determination of active duty status is valid. The Commission believes that the two-year time period suggested by CDIA is reasonable. Indeed, it is twice as long as the duration of an active duty military fraud alert.43 Therefore, the Commission is adding a provision to the final rule establishing that an NCRA’s verification of active duty military consumer status is valid for two years. After the expiration of the two-year period, the NCRA may require the consumer to provide proof that the consumer continues to be an active duty military consumer. Military groups recommended that the Commission remove the option for a certification approved by the NCRA because it may allow inadequate methods of proof.44 The Commission believes that it would benefit military consumers to allow the NCRAs to accept additional certifications of their choosing, such as having the consumer check a box certifying that they are an active duty military consumer. If the NCRA decides that the ease of such a method outweighs the risk that some consumers may misrepresent that they are eligible for the free service, any costs of such a determination would be borne by the NCRA. Various commenters recommended additional methods of validation. One commenter raised concerns about whether the current methods of proof would cover members of the National Guard when not on active duty orders.45 This commenter suggested that a current leave and earnings statement is a method of proof that would be available to the National Guard.46 Another commenter suggested that a letter from the consumer’s commanding officer should be appropriate proof.47 The Commission understands the desire to provide military consumers to be used for determining whether someone is eligible for MLA protections. In any event, the definition of a covered borrower under the MLA is more expansive than the rule’s definition of active duty military consumer. For example, the MLA regulations do not require that a military consumer be assigned to service away from their usual duty station. They also cover dependents. See 32 CFR 232.3(g). 43 12 CFR 1022.121. 44 See Veterans Education Success et al. (comment 22) at 2. 45 See NCLC et al. (comment 20) at 6–7. 46 See NCLC et al. (comment 20) at 6. See also Veterans Education Success et al. (comment 22) at 2; NCLC et al. 47 American Financial Services Association (comment 21) at 2. Another commenter suggested that the methods should include a letter other than active duty orders because the commenter stated that orders may include the consumer’s Social Security number. See Marlatt (comment 7). E:\FR\FM\01JYR1.SGM 01JYR1 khammond on DSKBBV9HB2PROD with RULES Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations and the NCRAs flexibility in the types of documentation that they can use to verify active duty military consumer status. In light of the fact that what constitutes appropriate proof for National Guard members will likely differ from that for active duty military more generally, the Commission has decided not to attempt to include a list of all suitable documents in the rule. Rather, to allow maximum flexibility, the Commission has decided to retain two of the methods from the proposed rule: (1) A method or service approved by the DoD; and (2) a certification of active duty status approved by the NCRA. The Commission notes that while it is removing the two additional methods that were in the proposed rule: (1) A copy of the consumer’s active duty orders; and (2) a copy of a certification of active duty status issued by the DoD—those documents, as well as the additional documents recommended by the commenters, can still be incorporated into a certification method approved by DoD or the NCRA. The Commission is also clarifying that the procedures that the NCRAs use to determine appropriate proof of active duty military consumer status must include methods that allow all eligible consumers to enroll. For example, an NCRA cannot decide that the only proof of status it will accept from a member of the National Guard is active duty orders, given that most members of the National Guard will not have active duty orders. To the extent that the NCRAs find it difficult to verify that individuals meet the definition of an ‘‘active duty military consumer,’’ particularly with respect to whether they are assigned to service away from their usual duty station, the Commission encourages the NCRAs to err on the side of providing the free service more broadly. To provide an incentive for the NCRAs to provide the free service to a broader set of military consumers and to reduce the likelihood that an eligible consumer is excluded from the free service, the Commission will deem an NCRA to be in compliance with this provision if it provides free electronic credit monitoring services to (1) consumers who self-certify active duty status, as defined in 10 U.S.C. 101(d); (2) consumers who self-certify that they are a reservist performing duty under a call or order to active duty under a provision of law referred to in 10 U.S.C. 101(a)(13); and (3) consumers who self-certify that they are a member of the National Guard, as defined in 10 U.S.C. 101(c). VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 ii. Information Use and Disclosure, § 609.3(d) The proposed rule limited the ways that the NCRAs can use or disclose the information collected from consumers as a result of a request to obtain the free electronic credit monitoring service. The proposed rule allowed NCRAs to use the information collected only: (1) To provide the free electronic credit monitoring service requested by the consumer; (2) to process a transaction requested by the consumer at the same time as a request for the service; (3) to comply with applicable legal requirements; or (4) to update information already maintained by the NCRA for the purpose of providing consumer reports, with certain limitations. The NPRM noted that these restrictions on use and disclosure are identical to the requirements placed on the NCRAs’ collection of personally identifiable information from consumers using the centralized source for annual credit reports.48 The Commission requested comment on whether the allowed uses and disclosures are appropriate and whether the rule should permit additional uses. Several commenters supported these restrictions and noted that they would prevent the use of the personal information collected from military consumers for marketing or other unanticipated uses.49 On the other hand, CDIA commented that the restrictions are unnecessary in light of the Commission’s authority under Section 5 of the FTC Act to address unfair or deceptive acts or practices.50 CDIA also argued that the restrictions are beyond the scope of the FTC’s statutory authority under the Act. The American Financial Services Association commented that the Commission should ensure that the restrictions do not prevent the information’s use for the purpose of studying the effect the MLA regulations are having on the availability of credit.51 The Commission does not agree that the agency’s Section 5 authority renders the proposed rule’s restrictions unnecessary. Under Section 5, the 48 12 CFR 1022.136(f). Electronic Privacy Information Center (comment 26) at 2; NCLC et al. (comment 20) at 7; Veterans Education Success et al. (comment 22) at 2. 50 See CDIA (comment 23) at 12. 51 American Financial Services Association (comment 21) at 1–2. This commenter also requested that the Commission encourage the DoD to grant consumer reporting agencies permission to pull data from the MLA database for purposes of such a study. The Commission does not have any role in administering the MLA database and defers to DoD as to appropriate uses of the information contained therein. 49 See PO 00000 Frm 00017 Fmt 4700 Sfmt 4700 31187 Commission would be limited to pursuing a law enforcement action in circumstances where an NCRA deceived a military consumer or used or disclosed the information in a manner that caused or was likely to cause substantial injury that was not reasonably avoidable by consumer themselves and not outweighed by countervailing benefits to consumers or to competition. However, even in circumstances not involving deception or substantial injury, the Commission does not believe that it would be appropriate to make an active duty military consumer’s access to the free electronic credit monitoring service contingent on the consumer’s willingness to allow a NCRA to use the consumer’s information for unrelated, secondary uses. The Commission believes that the use and disclosure restrictions are within its authority under the Act because they are necessary to ensure that the Act’s purpose of providing active duty military consumers with free electronic credit monitoring is not undermined by consumers’ concerns about secondary uses of their personal information.52 With respect to the specific request to allow the information to be used for the purpose of studying the effect MLA regulations have on the availability of credit, the Commission declines to grant an exception to allow military consumers’ personal information to be used for such a purpose, which is unrelated to their request for the free electronic credit monitoring. For these reasons, the Commission has decided to retain the proposed rule’s information use and disclosure restrictions without modification. iii. Communications Surrounding Enrollment in Electronic Credit Monitoring Service, § 609.3(e) Proposed § 609.3(e) placed limitations on the types of communications that may surround enrollment in the electronic credit monitoring service, similar to the restriction on advertising on the annual credit report website.53 Proposed § 609.3(e)(1) restricted any advertising or marketing for products or services, or any communications or instructions that advertise or market any products and services, to a consumer who has 52 Section 605A(k)(3) of the FCRA, 15 U.S.C. 1681c–1(k)(3), requires the Commission to promulgate regulations that ‘‘at a minimum’’ define electronic credit monitoring service and material additions or modifications to the file of a consumer and state what constitutes appropriate proof of active duty military status. Thus, the statute contemplates that the Commission’s regulations may go beyond defining those terms. 53 12 CFR 1022.136(g). E:\FR\FM\01JYR1.SGM 01JYR1 khammond on DSKBBV9HB2PROD with RULES 31188 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations indicated an interest in signing up for the free electronic credit monitoring service until after the consumer has enrolled in the service. Section 609.3(e)(2) of the proposed rule specified that any communications, instructions, or permitted advertising or marketing may not interfere with, detract from, contradict, or otherwise undermine the purpose of providing a free electronic credit monitoring service to active duty military consumers. Section 609.3(e)(3) of the proposed rule provided examples of conduct that would interfere with, detract from, contradict, or undermine the purpose of the rule. The Commission solicited comment on whether the limitations are necessary to ensure that active duty military consumers are able easily to obtain their free electronic credit monitoring service. The Commission also asked whether the limitations impose undue burdens on the NCRAs, and if so, whether there are ways to minimize the burdens. The Commission also asked whether there are more examples of prohibited conduct that should be included in the rule. Consumer groups stated that the limitations are necessary to allow military consumers to get the free credit monitoring easily without encountering distracting advertising.54 They further recommended that the Commission prohibit the NCRAs from representing or implying that the service is inferior to the NCRA’s commercial credit monitoring services. They also recommended that the Commission prohibit the NCRAs from offering identity theft insurance at any time in connection with the free credit monitoring because of concerns about the usefulness of such insurance. After carefully considering these suggestions, the Commission has decided not to add prohibitions beyond those already included in the proposed rule. Section 609.3(e)(3)’s prohibited communications are designed to ensure that active duty military consumers are not confused or deceived by communications related to a NCRA’s products and services. If a NCRA makes a deceptive representation to consumers about its commercial credit monitoring products or identity theft insurance, the Commission can pursue an enforcement action under Section 5 of the FTC Act. Some consumers may be interested in paying an additional fee in order to obtain services that may not be available within the free electronic credit monitoring service. Therefore, given 54 See NCLC et al. (comment 20) at 7; see also Veterans Education Success et al. (comment 22) at 2. VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 that the rule already prohibits marketing until after the consumer has enrolled in the free service, the Commission does not believe it is necessary to prohibit truthful advertising regarding the NCRA’s products and services after enrollment. CDIA stated that the restrictions are unnecessary and outside of the Commission’s statutory authority under the Act.55 CDIA also noted that unlike free annual credit reports, which the NCRAs offer through a centralized website, the NCRAs will offer the free electronic credit monitoring through their own commercial websites. CDIA argued that this makes it more difficult to determine when advertising is and is not permitted. CDIA criticized the proposed rule’s standard of delaying marketing ‘‘once a consumer has indicated that the consumer is interested in obtaining the service . . . such as by clicking on a link for services’’ as ambiguous. Therefore, if the Commission retains the marketing limitations, CDIA requested additional clarification on this point to make clear that marketing is prohibited only during the enrollment process. CDIA recommended the following language for § 609.3(e)(1): ‘‘once a consumer is in the process of accessing the ability to enroll in the service required under paragraph (a) of this section and only during the enrollment process. . . .’’ After considering the comments, the Commission has determined that retaining the restrictions on communications is necessary to further the Act’s purpose of providing active duty military consumers with a free electronic credit monitoring service. These restrictions help ensure that active duty military consumers are not thwarted by confusing advertisements or communications that dissuade them from enrolling in the free service. The Commission recognizes that the proposed rule’s limitation on advertising from the time the consumer ‘‘has indicated an interest in signing up for the free electronic credit monitoring service’’ may have been unclear. The Commission did not intend to ban advertising on all web pages of the NCRAs; rather, it sought to limit advertising on pages that are part of the product enrollment process. To provide greater clarity, the Commission has decided to modify § 609.3(e)(1) to provide that once a consumer is in the process of accessing the ability to enroll in the service required under paragraph (a) and only during the enrollment process, any advertising or marketing for products or services, or any 55 See PO 00000 CDIA (comment 23) at 13. Frm 00018 Fmt 4700 Sfmt 4700 communications or instructions that advertise or market any products and services, must be delayed until after the consumer has enrolled in that service. The Commission interprets this to mean that the NCRAs shall not advertise on the pages of the NCRA’s website or app dedicated to providing active duty military consumers with their rights under this regulation, until after the consumer has enrolled in the service. iv. Other Prohibited Practices, § 609.3(f) The proposed rule also prohibited asking or requiring an active duty military consumer to agree to terms or conditions in connection with obtaining a free electronic credit monitoring service. The Commission asked whether this prohibition is necessary; whether CRAs currently require customers of commercial credit monitoring services to agree to terms or conditions; and whether the prohibition imposes undue burdens on the NCRAs. Commenters that supported the inclusion of these prohibitions specifically pointed out that without them, the NCRAs could require military consumers to agree to mandatory arbitration clauses in order to receive free credit monitoring.56 However, CDIA commented that the prohibitions are unnecessary and outside of the FTC’s statutory authority under the Act.57 CDIA also expressed concern that the NCRAs would be in violation of these prohibitions if they sought to condition providing the service on the provision of appropriate proof of identity, contact information, and appropriate proof of active duty military status, as required by the proposed rule. CDIA further posited that seeking the consumer’s written instructions to comply with the FCRA’s permissible purpose requirements or consent to receive text notifications pursuant to the Telephone Consumer Protection Act could violate this provision. As the NPRM noted, this restriction is similar to the restriction for the annual credit report website.58 The Commission believes it is within its statutory authority to ensure that an active duty military consumer’s right to obtain a free electronic credit monitoring service is unfettered and without any restrictions or conditions, apart from providing appropriate proof of identity, contact information, and appropriate proof that the consumer is an active duty military consumer. The 56 See NCLC et al. (comment 20) at 8; see also Veterans Education Success et al. (comment 22) at 2. 57 See CDIA (comment 23) at 14–15. 58 12 CFR 1022.136(h). E:\FR\FM\01JYR1.SGM 01JYR1 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations khammond on DSKBBV9HB2PROD with RULES Commission believes that allowing the NCRAs to condition provision of the free electronic credit monitoring service on the consumer’s agreement to a variety of terms and conditions could dissuade military consumers from availing themselves of the service. However, the Commission recognizes that there may be certain instances in which legal requirements may require the NCRAs to receive consumers’ consent for certain aspects of the service. Thus, the Commission has decided to retain the prohibition with the following modification: A NCRA shall not ask or require an active duty military consumer to agree to terms or conditions in connection with obtaining a free electronic credit monitoring service, other than those terms or conditions required to comply with applicable legal requirements. d. Timing of Electronic Credit Monitoring Notices, § 609.4 The proposed rule required that the electronic notifications be provided within 24 hours of any material additions or modifications to a consumer’s file. The Commission requested comment on whether the proposed rule’s 24-hour timing was appropriate. The Commission received one comment on the timing requirements. CDIA commented that the timing requirement is outside of the Commission’s statutory authority and that it should be kept out of the final rule. It recommended that if the timing requirement remains, the Commission should instead require notifications within 48 hours to be consistent with the NCRA’s commercial credit monitoring services. CDIA also recommended that the Commission provide a safe harbor for NCRAs to provide notifications within the same timing that they use for their commercial credit monitoring services.59 The Commission believes it is necessary and within its statutory authority under the Act to specify the time within which electronic notifications must be made. If military consumers are not notified of the material additions or modifications to their files within a reasonable amount of time, the electronic credit monitoring service would not be as effective. For example, if a consumer is notified promptly about a new account that has been fraudulently opened in his or her name and appears on his or her consumer report, he or she may decide to place a fraud alert or security freeze on their file, which may help prevent 59 See CDIA (comment 23) at 15. VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 the opening of additional fraudulent accounts. The Commission declines to give the NCRAs a safe harbor for providing the notifications within the same timing that they use for their commercial credit monitoring products because that timing could change in the future, and the Commission believes it is necessary to set a baseline. However, the Commission has decided to modify the timing requirement to require notification within 48 hours of any material additions or modifications to a consumer’s file. This will align the requirement with the timing that CDIA states the NCRAs currently use for their commercial services, while still requiring that the NCRAs provide the notifications in a prompt manner upon making a change to the consumer’s file.60 e. Additional Information To Be Included in Electronic Credit Monitoring Notices, § 609.5 The proposed rule also required that the electronic notifications include a hyperlink to a summary of the consumer’s rights under the FCRA, as prescribed by the Bureau of Consumer Financial Protection.61 The Commission noted that it would be useful for consumers to be able to easily access information about their rights to, for example, obtain consumer reports and dispute information on their reports. The Commission requested comment on whether requiring this link would provide useful information to consumers and whether there is a different method of providing this information that would be more effective. Consumer groups commented that the Commission should also require the provision of the Summary of Rights of Identity Theft Victims outlined in 15 U.S.C. 1681g(d).62 While the Commission agrees that the Summary of Rights for Identity Theft Victims also provides useful information for consumers, the Commission does not believe it is appropriate to mandate its inclusion in the electronic notifications. The language of that document contemplates that it will be given to consumers when they have contacted a CRA about being the victim of identity theft, which likely will not be true for 60 The Commission notes that there is a lag between when many events, such as a late payment, occur and when a creditor reports them to the NCRA and the NCRA updates its files. Thus, the NCRAs can only provide notification once they are aware of these events, which means that even with prompt credit monitoring notifications, there is a delay between when an event occurs and when the consumer will receive an alert. 61 15 U.S.C. 1681g(c). 62 See NCLC et al. (comment 20) at 8–9. PO 00000 Frm 00019 Fmt 4700 Sfmt 4700 31189 many of the recipients of the electronic credit monitoring notices.63 NCLC also recommended that the Commission require a more prominent method of providing the summary of rights, such as including the document in the same email or web page, rather than just a hyperlink.64 NCLC also suggested that if the rule requires access to the credit report following a notification, the summary of rights could be appended to the report. On the other hand, CDIA commented that it had no objections to the general requirement, but expressed concern about including the hyperlink in text message or mobile application notifications, which may be space limited. CDIA recommended that the NCRAs have the flexibility to provide the link on any page within the electronic credit monitoring service to which the notification may direct the consumer. Given the space constraints in text messages and mobile applications, the Commission will modify the rule to allow the NCRAs to provide the link to the summary of rights on the first page of the website to which the electronic notification may direct the consumer. The Commission will also modify the rule to require that the summary of rights be included with the credit report that consumers can choose to access following the receipt of a notification, as required when a consumer requests a copy of their file under section 609 of the FCRA, 15 U.S.C. 1681g. f. Severability, § 609.6 Proposed § 609.6 stated that the provisions of the proposed rule are separate and severable from one another, so that if any provision was stayed or determined to be invalid, it was the Commission’s intention that the remaining provisions shall continue in effect. The Commission received no comments on this provision and adopts it without modification. g. Compliance Date The proposed rule did not address the date by which the NCRAs will be required to comply with the rule. CDIA commented that the rule needs to provide an appropriate amount of time for the NCRAs to implement the service 63 For example, it states at the beginning of the document, ‘‘[y]ou are receiving this information because you have notified a consumer reporting agency that you believe that you are a victim of identity theft.’’ The Bureau’s model document can be found at: https://files.consumerfinance.gov/f/ documents/bcfp_consumer-identity-theft-rightssummary_2018-09.docx. 64 See NCLC et al. (comment 20) at 9. E:\FR\FM\01JYR1.SGM 01JYR1 31190 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations required by the rule.65 CDIA stated that one year from the effective date would be necessary, but that the time could be reduced if the NCRAs are given a safe harbor for providing their existing credit monitoring services to active duty military consumers for free. The Commission recognizes that the NCRAs will need time following the publication of the final rule to implement the service. For example, they will likely need to create systems to accept proof of active duty military status. They may need to make engineering and product changes to generate alerts about certain changes to a credit file. However, the Commission also notes that Congress gave the Commission only one year from the enactment of the Act to promulgate these regulations, presumably to ensure that active duty military consumers receive the free credit monitoring sooner rather than later. For example, Senators Carper and Coons, who drafted the credit monitoring provision of the Act, requested that the Commission, ‘‘conclude the rulemaking process expeditiously so that servicemembers may begin benefiting from this service as soon as possible.’’ 66 Balancing these factors, the Commission has determined to set a compliance date of 3 months from the effective date of these regulations. However, to give the NCRAs additional time to set up their systems, while still allowing consumers to benefit from the new rights created by the Act, the Commission will allow the NCRAs to comply with §§ 609.3(a), 609.4, and 609.5 by offering their commercial credit monitoring service for free, for a period of up to one year from the effective date of the rule. khammond on DSKBBV9HB2PROD with RULES Paperwork Reduction Act The Paperwork Reduction Act (PRA), 44 U.S.C. chapter 35, requires federal agencies to seek and obtain OMB approval before undertaking a collection of information directed to ten or more persons.67 Under the PRA, a rule creates a ‘‘collection of information’’ when ten or more persons are asked to report, provide, disclose, or record information in response to ‘‘identical questions.’’ 68 As the notification requirements fall upon the three NCRAs, it does not meet the PRA threshold count of ten or more persons to constitute a ‘‘collection of information.’’ Further, the proof of identity the rule requires of those for whom the rulemaking is designed to benefit, consumers on active duty military status, falls within OMB’s general exception for disclosures that require persons to provide or display only facts necessary to identify themselves.69 Regulatory Flexibility Act The Regulatory Flexibility Act (RFA) 70 requires that the Commission conduct an initial and a final analysis of the anticipated economic impact of the rule on small entities. The purpose of a regulatory flexibility analysis is to ensure the agency considers the impacts on small entities and examines regulatory alternatives that could achieve the regulatory purpose while minimizing burdens on small entities. The RFA 71 provides that such an analysis is not required if the agency head certifies that the regulatory action will not have a significant economic impact on a substantial number of small entities. The Commission believes that the rule will not have a significant economic impact on small entities. The final rule applies to NCRAs. The Commission has not identified any NCRAs that are small entities.72 Therefore, the Commission certifies that the rule will not have a significant economic impact on a substantial number of small businesses. The final rule is similar to the rule proposed in the NPRM. In its Initial Regulatory Flexibility Analysis (IRFA), the Commission determined that the proposed rule would not have a significant impact on small entities because the NCRAs to which the proposed rule would apply were not small entities. Although the Commission certifies under the RFA that the rule will not have a significant impact on a substantial number of small entities, and hereby provides notice of that certification to the Small Business Administration, the Commission nonetheless has determined that publishing a final regulatory flexibility analysis (FRFA) is appropriate to ensure that the impact of the rule is fully 69 See 5 CFR 1320.3(h)(1). U.S.C. 601–612. 71 5 U.S.C. 605. 72 The size standard the Small Business Administration has identified by the North American Industry Classification System code for credit bureaus (code number 561450), i.e., CRAs, is $15 million. See 13 CFR 121.201. The rule only applies to NCRAs. There are currently only three NCRAs, Equifax, Experian, and TransUnion, and all exceed this size standard. 70 5 65 See CDIA (comment 23) at 16–17. from Senator Thomas R. Carper and Senator Christopher A. Coons of the United States Senate Regarding the Military Credit Monitoring Rulemaking Proceeding and the Proposed Rule Set Forth in the Notice of Proposed Rulemaking (January 23, 2019) at 2. 67 44 U.S.C. 3502(3)(A)(i). 68 See 44 U.S.C. 3502(3)(A). 66 Letter VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 PO 00000 Frm 00020 Fmt 4700 Sfmt 4700 addressed. Therefore, the Commission has prepared the following analysis: A. Need for and Objectives of the Final Rule The Economic Growth, Regulatory Relief, and Consumer Protection Act, Public Law 115–174, directs the Commission to promulgate regulations to implement section 302(d)(1) of the Act, which shall at a minimum: (1) Define ‘‘electronic credit monitoring service’’ and ‘‘material additions or modifications to the file of a consumer,’’ and (2) establish what constitutes appropriate proof that a consumer is an active duty military consumer. In this action, the Commission issues a rule that would fulfill the statutory mandate. The Act requires that the Commission promulgate this rule not later than one year after the date of enactment, or May 24, 2019. B. Significant Issues Raised in Public Comments The Commission did not receive any comments that addressed the burden on small entities. C. Small Entities To Which the Final Rule Will Apply The final rule will apply only to NCRAs. The Commission has not identified any NCRAs that are small entities. D. Projected Reporting, Recordkeeping, and Other Compliance Requirements, Including Classes of Covered Small Entities and Professional Skills Needed To Comply Under the final rule, NCRAs will have to provide free electronic credit monitoring services to active duty military consumers. There are no reporting or recordkeeping requirements, or types of professional skills necessary for preparation of any such report or record, under the rule. In any event, as noted earlier, the final rule applies only to NCRAs, and they are not small entities. E. Significant Alternatives to the Final Rule The Commission has not identified any particular alternative methods of compliance as necessary to reduce burdens on small entities, because the Commission does not believe any NCRAs subject to the final rule are small entities, as noted earlier. Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the Office of Information and Regulatory Affairs designated this rule as not a ‘‘major rule,’’ as defined by 5 U.S.C. 804(2). E:\FR\FM\01JYR1.SGM 01JYR1 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations List of Subjects in 16 CFR Part 609 Consumer reporting agencies, Consumer reports, Credit, Fair Credit Reporting Act, Trade practices. Accordingly, the Federal Trade Commission amends title 16, chapter I, subchapter F, of the Code of Federal Regulations as follows: ■ 1. Revise the heading of subchapter F to read as follows: SUBCHAPTER F—FAIR CREDIT REPORTING ACT 2. Add part 609 to subchapter F to read as follows: ■ PART 609—FREE ELECTRONIC CREDIT MONITORING FOR ACTIVE DUTY MILITARY Sec. 609.1 Scope of regulations in this part. 609.2 Definitions. 609.3 Requirement to provide free electronic credit monitoring service. 609.4 Timing of electronic credit monitoring notices. 609.5 Additional information to be included in electronic credit monitoring notices. 609.6 Severability. Authority: 15 U.S.C. 1681c–1(k). § 609.1 Scope of regulations in this part. This part implements Section 605A(k)(2) of the Fair Credit Reporting Act, 15 U.S.C. 1681c–1(k)(2), which requires consumer reporting agencies that compile and maintain files on consumers on a nationwide basis to provide a free electronic credit monitoring service to active duty military consumers that, at a minimum, notifies them of any material additions or modifications to their files. khammond on DSKBBV9HB2PROD with RULES § 609.2 Definitions. For purposes of this part, the following definitions apply: (a) Active duty military consumer means: (1) A consumer in military service as defined in 15 U.S.C. 1681a(q)(1); or (2) A member of the National Guard as defined in 10 U.S.C. 101(c). (b) Appropriate proof of identity has the meaning set forth in 12 CFR 1022.123. (c) Consumer has the meaning provided in 15 U.S.C. 1681a(c). (d) Consumer report has the meaning provided in 15 U.S.C. 1681a(d). (e) Contact information means information about a consumer, such as a consumer’s first and last name and email address, that is reasonably necessary to collect in order to provide the electronic credit monitoring service. (f) Credit has the meaning provided in 15 U.S.C. 1681a(r)(5). VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 (g) Electronic credit monitoring service means a service through which nationwide consumer reporting agencies provide, at a minimum, electronic notification of material additions or modifications to a consumer’s file and following a notification, access to all information in the consumer’s file at the nationwide consumer reporting agency at the time of the notification, in accordance with 15 U.S.C. 1681g(a). (h) Electronic notification means: (1) A notice provided to the consumer via: (i) Mobile application; (ii) Email; or (iii) Text message; (2) If the notice in paragraph (h)(1) of this section does not inform the consumer of the specific material addition or modification that has been made, such notice must link to a website that provides that information. (i) File has the meaning provided in 15 U.S.C. 1681a(g). (j) Firm offer of credit has the meaning provided in 15 U.S.C. 1681a(l). (k) Free means provided at no cost to the consumer. (l) Material additions or modifications means significant changes to a consumer’s file, including: (1) New accounts opened in the consumer’s name, including new collection accounts; (2) Inquiries or requests for a consumer report; (i) However, an inquiry made for a prescreened list obtained for the purpose of making a firm offer of credit or insurance as described in 15 U.S.C. 1681b(c)(1)(B) or for the purpose of reviewing or collecting an account of the consumer shall not be considered a material addition or modification. (ii) [Reserved] (3) Material changes to a consumer’s address; (4) Changes to credit account limits of $100 or greater; and (5) Negative information. (m) Nationwide consumer reporting agency has the meaning provided in 15 U.S.C. 1681a(p). (n) Negative information means accounts furnished to the nationwide consumer reporting agencies as more than 30 days delinquent, accounts furnished to the nationwide consumer reporting agencies as being included in bankruptcy petition filings, and new public records, including, but not limited to, bankruptcy filings, civil court judgments, foreclosures, liens, and convictions. § 609.3 Requirement to provide free electronic credit monitoring service. (a) General requirements. Nationwide consumer reporting agencies must PO 00000 Frm 00021 Fmt 4700 Sfmt 4700 31191 provide a free electronic credit monitoring service to active duty military consumers. (b) Determining whether a consumer must receive electronic credit monitoring service. Nationwide consumer reporting agencies may condition provision of the service required under paragraph (a) of this section upon the consumer providing: (1) Appropriate proof of identity; (2) Contact information; and (3) Appropriate proof that the consumer is an active duty military consumer. (c) Appropriate proof of active duty military consumer status. (1) A consumer’s status as an active duty military consumer can be verified through: (i) A method or service approved by the Department of Defense; or (ii) A certification of active duty military consumer status approved by the nationwide consumer reporting agency. (2) Provided, however, that the procedures a nationwide consumer reporting agency uses to determine appropriate proof of active duty military consumer status must include methods that allow all eligible consumers to enroll. A nationwide consumer reporting agency shall be deemed in compliance with paragraph (c) of this section if it provides free electronic credit monitoring services to: (i) Consumers who self-certify active duty status, as defined in 10 U.S.C. 101(d); (ii) Consumers who self-certify that they are a reservist performing duty under a call or order to active duty under a provision of law referred to in 10 U.S.C. 101(a)(13); and (iii) Consumers who self-certify that they are a member of the National Guard, as defined in 10 U.S.C. 101(c). (3) A nationwide consumer reporting agency’s verification of active duty military consumer status is valid for two years. After the expiration of the twoyear period, the nationwide consumer reporting agency may require the consumer to provide proof that the consumer continues to be an active duty military consumer in accordance with paragraphs (c)(1) and (2) of this section. (d) Information use and disclosure. Any information collected from consumers as a result of a request to obtain the service required under paragraph (a) of this section, may be used or disclosed by the nationwide consumer reporting agency only: (1) To provide the free electronic credit monitoring service requested by the consumer; E:\FR\FM\01JYR1.SGM 01JYR1 khammond on DSKBBV9HB2PROD with RULES 31192 Federal Register / Vol. 84, No. 126 / Monday, July 1, 2019 / Rules and Regulations (2) To process a transaction requested by the consumer at the same time as a request for the free electronic credit monitoring service; (3) To comply with applicable legal requirements; or (4) To update information already maintained by the nationwide consumer reporting agency for the purpose of providing consumer reports, provided that the nationwide consumer reporting agency uses and discloses the updated information subject to the same restrictions that would apply, under any applicable provision of law or regulation, to the information updated or replaced. (e) Communications surrounding enrollment in electronic credit monitoring service. (1) Once a consumer is in the process of accessing the ability to enroll in the service required under paragraph (a) of this section and only during the enrollment process, any advertising or marketing for products or services, or any communications or instructions that advertise or market any products and services, must be delayed until after the consumer has enrolled in that service. (2) Any communications, instructions, or permitted advertising or marketing shall not interfere with, detract from, contradict, or otherwise undermine the purpose of providing a free electronic credit monitoring service to active duty military consumers that notifies them of any material additions or modifications to their files. (3) Examples of interfering, detracting, inconsistent, and/or undermining communications include: (i) Materials that represent, expressly or by implication, that an active duty military consumer must purchase a paid product or service in order to receive the service required under paragraph (a) of this section; or (ii) Materials that falsely represent, expressly or by implication, that a product or service offered ancillary to receipt of the free electronic credit monitoring service, such as identity theft insurance, is free, or that fail to clearly and prominently disclose that consumers must cancel a service, advertised as free for an initial period of time, to avoid being charged, if such is the case. (f) Other prohibited practices. A nationwide consumer reporting agency shall not ask or require an active duty military consumer to agree to terms or conditions in connection with obtaining a free electronic credit monitoring service, other than those terms or conditions required to comply with applicable legal requirements. VerDate Sep<11>2014 15:54 Jun 28, 2019 Jkt 247001 § 609.4 Timing of electronic credit monitoring notices. The notice required in § 609.3(a) must be provided within 48 hours of any material additions or modifications to a consumer’s file. § 609.5 Additional information to be included in electronic credit monitoring notices. (a) The notice required in § 609.3(a), or the first page within the electronic credit monitoring service to which the notice may direct the consumer, shall include a hyperlink to a summary of the consumer’s rights under the Fair Credit Reporting Act, as prescribed by the Bureau of Consumer Financial Protection under 15 U.S.C. 1681g(c). (b) The nationwide consumer reporting agency shall provide to a consumer, with each file disclosure provided in § 609.3(a), the summary of the consumer’s rights under the Fair Credit Reporting Act, as prescribed by the Bureau of Consumer Financial Protection under 15 U.S.C. 1681g(c). § 609.6 Severability. The provisions of this part are separate and severable from one another. If any provision is stayed, or determined to be invalid, it is the Commission’s intention that the remaining provisions shall continue in effect. By direction of the Commission. April J. Tabor, Acting Secretary. [FR Doc. 2019–13598 Filed 6–28–19; 8:45 am] BILLING CODE 6750–01–P SECURITIES AND EXCHANGE COMMISSION 17 CFR Part 232 [Release Nos. 33–10645; 34–86070; 39– 2526, IC–33504] Adoption of Updated EDGAR Filer Manual Securities and Exchange Commission. ACTION: Final rule. AGENCY: The Securities and Exchange Commission (the ‘‘Commission’’) is adopting revisions to the Electronic Data Gathering, Analysis, and Retrieval System (‘‘EDGAR’’) Filer Manual (‘‘EDGAR Filer Manual’’ or ‘‘Filer Manual’’) and related rules. The EDGAR system was upgraded on June 10, 2019. DATES: Effective July 1, 2019. The incorporation by reference of the EDGAR Filer Manual is approved by the SUMMARY: PO 00000 Frm 00022 Fmt 4700 Sfmt 4700 Director of the Federal Register as of July 1, 2019. FOR FURTHER INFORMATION CONTACT: For questions concerning Form ID, contact EDGAR Filer Support at (202) 551–8900. In the Division of Economic and Risk Analysis, for questions concerning Inline XBRL, inclusion of HTML in EDGAR submissions, or retired taxonomies, contact Mike Willis at (202) 551–6627. In the Office of Municipal Securities, for questions regarding Forms MA, MA–A and MA/A, contact Ahmed A. Abonamah at (202) 551– 3887. In the Division of Trading and Markets, for questions concerning Form ATS–N, contact Michael R. Broderick at (202) 551–5058. In the Division of Investment Management, for questions concerning the rescission of Form N– SAR, contact Heather Fernandez at (202) 551–6708. SUPPLEMENTARY INFORMATION: We are adopting an updated EDGAR Filer Manual, Volumes I and II. The Filer Manual describes the technical formatting requirements for the preparation and submission of electronic filings through the EDGAR system.1 It also describes the requirements for filing using EDGARLink Online and the EDGAR Online Forms website. The revisions to the Filer Manual reflect changes within EDGAR Filer Manual, Volume I: ‘‘General Information,’’ (Version 33) and EDGAR Filer Manual, Volume II: ‘‘EDGAR Filing,’’ (Version 51) (June 2019). The updated Filer Manual is incorporated by reference into the Code of Federal Regulations. The Filer Manual contains all the technical specifications for filers to submit filings using the EDGAR system. Filers must comply with the applicable provisions of the Filer Manual in order to assure the timely acceptance and processing of filings made in electronic format.2 Filers should consult the Filer Manual in conjunction with our rules governing mandated electronic filings when preparing documents for electronic submission. The EDGAR System was updated in Release 19.2 and corresponding amendments to the Filer Manual are being made to reflect the changes described below. EDGAR Release 19.2 introduced changes to the EDGAR Filer 1 We originally adopted the Filer Manual on April 1, 1993, with an effective date of April 26, 1993. Release No. 33–6986 (April 1, 1993) [58 FR 18638]. We implemented the most recent update to the Filer Manual on March 12, 2018. See Release No. 33– 10615 (March 12, 2019) [84 FR 12073]. 2 See Rule 301 of Regulation S–T (17 CFR 232.301). E:\FR\FM\01JYR1.SGM 01JYR1

Agencies

FEDERAL TRADE COMMISSION

[Federal Register Volume 84, Number 126 (Monday, July 1, 2019)]
[Rules and Regulations]
[Pages 31180-31192]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-13598]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

16 CFR Part 609

RIN 3084-AB54


Military Credit Monitoring

AGENCY: Federal Trade Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Federal Trade Commission (``FTC'' or ``Commission'') is 
publishing a final rule to implement the credit monitoring provisions 
applicable to active duty military consumers in section 302 of the 
Economic Growth, Regulatory Relief, and Consumer Protection Act, which 
amends the Fair Credit Reporting Act (``FCRA''). That section requires 
nationwide consumer reporting agencies (``NCRAs'') to provide a free 
electronic credit monitoring service to active duty military consumers, 
subject to certain conditions. The final rule defines ``electronic 
credit monitoring service,'' ``contact information,'' ``material 
additions or modifications to the file of a consumer,'' and 
``appropriate proof of identity,'' among other terms. It also contains 
requirements on how NCRAs must verify that an individual is an active 
duty military consumer. Further, the final rule contains restrictions 
on the use of personal information and on communications surrounding 
enrollment in the electronic credit monitoring service.

DATES: The amendments are effective July 31, 2019. However, compliance 
is not required until October 31, 2019.

[[Page 31181]]


ADDRESSES: Relevant portions of the record of this proceeding, 
including this document, are available at https://www.ftc.gov.

FOR FURTHER INFORMATION CONTACT: Amanda Koulousias (202-326-3334), 
[email protected], Bureau of Consumer Protection, Federal Trade 
Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION: 

I. Overview and Background

    The Economic Growth, Regulatory Relief, and Consumer Protection Act 
(``the Act'') was signed into law on May 24, 2018. Public Law 115-174. 
The Act, among other things, amends section 605A of the FCRA, 15 U.S.C. 
1681c-1, to add a section 605A(k). Section 605A(k)(2) requires that 
NCRAs provide free electronic credit monitoring services to active duty 
military consumers.
    Section 605A(k)(3) of the FCRA requires the Commission to issue a 
regulation clarifying the meaning of certain terms used in section 
605A(k)(2), including ``electronic credit monitoring service'' and 
``material additions or modifications to the file of a consumer.'' In 
addition, section 605A(k)(3) requires that the Commission's regulation 
clarify what constitutes appropriate proof that an individual is an 
active duty military consumer.
    On November 16, 2018 (83 FR 57693), the Commission published a 
notice of proposed rulemaking (``NPRM''). The proposed rule applied to 
NCRAs, as defined in section 603(p) of the Fair Credit Reporting Act, 
15 U.S.C. 1681a(p). The proposed rule required the NCRAs to provide a 
free electronic credit monitoring service that notifies a consumer of 
material additions or modifications to the consumer's file when the 
consumer provides (1) contact information, (2) appropriate proof that 
the consumer is an active duty military consumer, and (3) appropriate 
proof of identity. The proposed rule specified that the NCRA must 
provide notification to the consumer within 24 hours of the material 
addition or modification. The proposed rule also required that the 
notifications to consumers include a hyperlink to a summary of the 
consumer's rights under the FCRA, as prescribed by the Bureau of 
Consumer Financial Protection under 15 U.S.C. 1681g(c).
    The proposed rule defined certain key terms, including ``electronic 
credit monitoring service,'' ``electronic notification,'' and 
``material additions or modifications.'' The proposed rule also 
specified what constitutes appropriate proof that the consumer is an 
active duty military consumer.
    Further, the proposed rule restricted NCRAs' ability to use and 
disclose the information they collect from consumers in order to 
provide the required electronic credit monitoring service. 
Additionally, the proposed rule contained some limitations on 
communications surrounding enrollment in an electronic credit 
monitoring service. Finally, the proposed rule prohibited asking or 
requiring an active duty military consumer to agree to terms or 
conditions in connection with obtaining a free electronic credit 
monitoring service.
    In response to the NPRM, the Commission received 19 comments from 
industry representatives, military and consumer advocacy groups, 
government agencies, members of Congress, and individual members of the 
public.\1\ In addition to providing feedback on the proposed rule, 
commenters highlighted the importance of military consumers' financial 
health for overall military readiness and national security. These 
commenters noted that ``servicemembers in financial distress are often 
forced to leave the military due to loss of security clearance or for 
other reasons.'' \2\ Commenters also noted the rule's importance in 
protecting military consumers from fraud.\3\
---------------------------------------------------------------------------

    \1\ All comments can be found on the FTC's website at: https://www.ftc.gov/policy/public-comments/2018/11/initiative-784.
    \2\ See Veterans Education Success et al. (comment 22) at 1 (the 
following veteran and military services organizations submitted a 
joint comment: Army Aviation Association of America; Association of 
Military Surgeons of the United States; Association of the United 
States Navy; Enlisted Association of the National Guard of the 
United States; Jewish War Veterans; National Guard Association of 
the United States; National Military Family Association; Tragedy 
Assistance Program for Survivors; Veterans Education Success; 
Vietnam Veterans of America).
    \3\ Robert Palmersheim (comment 2).
---------------------------------------------------------------------------

II. Section by Section Analysis

a. Scope of Regulations in This Part, Sec.  609.1

    Proposed Sec.  609.1 described the statutory authority for the 
proposed rule, section 605A(k)(2) of the FCRA, 15 U.S.C. 1681c-1(k)(2). 
The Commission received no comments on this section, and adopts it as 
proposed.

b. Definitions, Section 609.2

i. Definition of Active Duty Military Consumer, Sec.  609.2(a)
    The NPRM proposed defining ``active duty military consumer'' as a 
consumer in military service, as defined in the FCRA. Prior to 
enactment of the Act, section 603(q)(1) of the FCRA, 15 U.S.C. 
1681a(q)(1), defined an ``active duty military consumer'' as a consumer 
in military service who--(A) is on active duty (as defined in section 
101(d)(1) of title 10, United States Code) or is a reservist performing 
duty under a call or order to active duty under a provision of law 
referred to in section 101(a)(13) of title 10, United States Code; and 
(B) is assigned to service away from the usual duty station of the 
consumer. The Act added section 605A(k)(1) to the FCRA, 15 U.S.C. 
1681c-1(k)(1), and specified that, in the credit monitoring subsection, 
the term ``active duty military consumer'' also includes a member of 
the National Guard, with the term ``National Guard'' having the meaning 
given the term in section 101(c) of title 10, United States Code. Thus, 
the proposed rule defined ``active duty military consumer'' as a 
``consumer in military service as defined in 15 U.S.C. 1681a(q)(1) and 
1681c-1(k)(1).'' \4\
---------------------------------------------------------------------------

    \4\ The Department of Defense (``DoD'') suggested referencing 15 
U.S.C. 1681c-1(i)(1) rather than 15 U.S.C. 1681c-1(k)(1), stating 
that the former contains the provisions related to the National 
Guard. This appears to be based on a misreading of the statute, as 
15 U.S.C. 1681c-1(k)(1) does in fact in contain the provisions 
related to the National Guard. See DoD--Defense Department (comment 
12) at 2.
---------------------------------------------------------------------------

    The Commission received several comments on this definition. DoD 
expressed concern that the proposed definition could result in military 
consumers receiving unequal access to the free credit monitoring 
services based on their individual military component, duty status, or 
location.\5\ For example, DoD stated that the requirement for the 
consumer to be ``assigned to service away from the usual duty station'' 
is severely limiting, as a military consumer is likely to spend most of 
her active duty career assigned to the ``usual duty station.'' DoD 
recommended that the Commission modify the definition in order to be 
consistent with the definition of active duty in the military 
compensation statute,\6\ which does not require that the military 
consumer be deployed away from her usual duty station. Military groups 
commented that the Commission should defer to DoD on this 
definition.\7\ Senators Carper and Coons commented that the rule should 
cover ``the largest number of servicemembers as permitted by the

[[Page 31182]]

law.'' \8\ Another commenter recommended that the rule cover retired 
military consumers.\9\
---------------------------------------------------------------------------

    \5\ See DoD--Defense Department (comment 12) at 1-2.
    \6\ 37 U.S.C. 101(18).
    \7\ See Veterans Education Success et al. (comment 22) at 2. 
This commenter noted that increased deployments and training require 
Guard and Reserve members to maintain their financial readiness 
because they can be called up at a moment's notice.
    \8\ See Letter from Senator Thomas R. Carper and Senator 
Christopher A. Coons of the United States Senate Regarding the 
Military Credit Monitoring Rulemaking Proceeding and the Proposed 
Rule Set Forth in the Notice of Proposed Rulemaking (January 23, 
2019) at 2.
    \9\ Patrick Mabry (comment 9).
---------------------------------------------------------------------------

    While the Commission recognizes and appreciates the policy 
rationale behind broadening the group of military consumers who are 
eligible to receive free credit monitoring, the statutory language 
limits the Commission's discretion on this topic. In amending the FCRA, 
Congress recognized that the FCRA's existing definition of ``active 
duty military consumer'' excluded members of the National Guard. 
Congress specified that, for purposes of the credit monitoring 
provisions, an ``active duty military consumer,'' includes a member of 
the National Guard.\10\ The fact that the Act addressed the exclusion 
of the National Guard, but not the definition's requirement that the 
military consumer be ``assigned to service away from the usual duty 
station,'' suggests that Congress may have intended for that limitation 
to remain. To the extent that Congress intended to provide free credit 
monitoring more broadly, i.e., to all active duty military, regardless 
of their duty station, the Commission calls on Congress to address this 
issue through additional legislation. If Congress passes legislation to 
provide the Commission with statutory authority to promulgate a more 
expansive rule, the Commission will act expeditiously to do so.
---------------------------------------------------------------------------

    \10\ 15 U.S.C. 1681c-1(k)(1).
---------------------------------------------------------------------------

    The Commission acknowledges that the proposed rule's definition did 
not expressly address whether a National Guard member covered by the 
definition in 15 U.S.C. 1681c-1(k)(1) also needs to be assigned to 
service away from the usual duty station. The Commission recognizes 
that providing National Guard members with free credit monitoring at 
all times, while limiting the service for individuals serving in other 
military components, such as the Army or Air Force, to those assigned 
away from their usual duty station, would result in an inequitable 
distribution of benefits. However, when Congress amended the FCRA to 
add section 605A(k)(1), it did not expressly apply the duty station 
requirement to National Guard members. Thus, the statutory language is 
imprecise on this question. Therefore, notwithstanding this apparent 
inequity, the Commission has interpreted the Act as providing the 
benefit of free credit monitoring to members of the National Guard 
regardless of whether they are assigned away from their usual duty 
station. To ensure clarity on this issue, the Commission has determined 
to modify the definition of active duty military consumer as (1) a 
consumer in military service that meets the original FCRA definition of 
``active duty military consumer'' (15 U.S.C. 1681a(q)(1)); or (2) a 
member of the National Guard (10 U.S.C. 101(c)).
ii. Definition of Appropriate Proof of Identity, Sec.  609.2(b)
    The NPRM proposed defining ``appropriate proof of identity'' as 
having the same meaning set forth in 12 CFR 1022.123. That section 
requires consumer reporting agencies (``CRAs'') to develop reasonable 
policies for determining a consumer's identity for purposes of FCRA 
sections 605A (obtaining a fraud alert), 605B (requesting that 
information resulting from identity theft be blocked from one's 
consumer report), and 609(a)(1) (requesting a file disclosure from a 
CRA). The definition is risk-based, meaning that a CRA's policy with 
respect to appropriate proof of identity should be commensurate with 
the risk of harm to the consumer resulting from misidentification, and 
should not unreasonably restrict a consumer's access to statutorily 
required services. The NPRM specifically sought comment on whether the 
rule should keep this cross-reference to 12 CFR 1022.123, stay silent 
on the definition, or develop a different approach.
    The Commission received one comment supporting the NPRM definition 
and two comments recommending changes. The Consumer Data Industry 
Association (``CDIA'') commented that referencing the existing standard 
would reduce the implementation burden for its NCRA members.\11\ 
Consumer and military groups recommended that the Commission tailor 
``appropriate proof of identity'' to the unique circumstances of 
military consumers.\12\ These commenters noted that military consumers 
often move frequently, making it burdensome for them to provide the 2-
year address history that CRAs currently require for identity 
validation for file disclosures. These commenters also stated the NCRAs 
require less identifying information from consumers who are purchasing 
their credit report than they do from consumers who are seeking access 
to their free annual credit report.
---------------------------------------------------------------------------

    \11\ See CDIA (comment 23) at 10.
    \12\ See National Consumer Law Center (``NCLC'') et al. (comment 
20) at 5 (the following consumer groups submitted a joint comment: 
NCLC, Americans For Financial Reform Education Fund, Center for 
Digital Democracy, Consumer Action, Consumer Federation of America, 
Demos, National Association of Consumer Advocates, Public Citizen, 
US PIRG, Woodstock Institute, East Bay Community Law Center, Housing 
and Economic Rights Advocates, Tzedek DC, and the Legal Aid Society 
of Palm Beach County); Veterans Education Success et al. (comment 
22) at 2.
---------------------------------------------------------------------------

    After carefully considering the comments received, the Commission 
has determined to retain the definition of ``appropriate proof of 
identity'' without modification. The existing definition requires the 
NCRAs to develop ``reasonable requirements'' that take into account the 
``identifiable risk of harm'' that could result from 
misidentification.\13\ The Commission interprets the existing 
standard's reasonableness requirement to obligate the NCRAs to consider 
the unique circumstances of military consumers in developing their 
requirements for proof of identity for the free electronic credit 
monitoring service. They must weigh any such considerations against the 
risk of harm from providing sensitive credit report information to the 
wrong consumer while not restricting access to the statutorily mandated 
services unreasonably. In response to the concern that NCRAs currently 
require less identifying information for paid services than for free 
services, the Commission notes that the fact that a consumer is 
requesting a free rather than a paid service should not by itself 
prompt a higher standard for proof of identity, unless the NCRA is 
using the payment method as an additional form of authentication or 
there are other identified aspects of the unpaid service that increase 
the fraud risk.
---------------------------------------------------------------------------

    \13\ 12 CFR 1022.123(a).
---------------------------------------------------------------------------

iii. Definition of Electronic Credit Monitoring Service, Sec.  609.2(g)
    The proposed rule defined ``electronic credit monitoring service'' 
as a service through which NCRAs provide, at a minimum, electronic 
notification of material additions or modifications to a consumer's 
file. The Commission solicited comment as to whether this definition is 
adequate or if any modifications are necessary.
    Several commenters stated that the proposed definition is not 
adequate and that the Commission should expand it to include free 
electronic access to the consumer's credit file following a 
notification of a material addition or modification.\14\ Commenters 
noted that

[[Page 31183]]

without this free access, military consumers may be required to pay to 
examine their credit files following the receipt of a notification. One 
commenter stated that the information contained in the files of the 
three NCRAs is not always the same and recommended that the rule 
provide free access to the credit files at all three NCRAs following a 
notification.\15\ The commenters also noted that commercial credit 
monitoring products typically include access to credit reports.
---------------------------------------------------------------------------

    \14\ See, e.g., NCLC et al. (comment 20) at 2-3; Veterans 
Education Success et al. (comment 22) at 1-2; Mass Mail Campaign 
(comment 13); Law Office of Phillip R. Goldberg (comment 19); Jeff 
Seymour (comment 18).
    \15\ Veterans Education Success et al. (comment 22) at 1-2.
---------------------------------------------------------------------------

    The Commission agrees with the commenters that free access to their 
credit files following a notification will allow the active duty 
military consumer to evaluate the addition or modification in the 
context of their entire credit report without being required to pay for 
that access in connection with a service that Congress intended them to 
receive for free. Indeed, current commercial credit monitoring services 
offered by the NCRAs advertise that they provide consumers with access 
to their credit files. However, the Commission declines to require an 
NCRA to pay the costs of obtaining a consumer's credit files from the 
other two NCRAs for the purposes of providing the files to the 
consumer. Instead, consumers who are concerned about potential 
discrepancies in their files at the three NCRAs can request free credit 
monitoring services from all three of them.
    Given the comments received, the Commission modifies the definition 
of electronic credit monitoring service as follows: A service through 
which NCRAs provide, at a minimum, electronic notification of material 
additions or modifications to a consumer's file and following a 
notification, access to all information in the consumer's file at the 
NCRA at the time of the notification, in accordance with 15 U.S.C. 
1681g(a).\16\
---------------------------------------------------------------------------

    \16\ 15 U.S.C. 1681c-1(k)(2) states that the free electronic 
credit monitoring service shall ``at a minimum'' notify the consumer 
of material additions or modifications to the file, and 15 U.S.C. 
1681c-1(k)(3) requires the Commission's rule to define electronic 
credit monitoring service. Thus, the statute contemplates that the 
Commission can define electronic credit monitoring service to 
include other features.
---------------------------------------------------------------------------

iv. Definition of Electronic Notification, Sec.  609.2(h)
    The proposed rule defined ``electronic notification'' as a notice 
provided to the consumer via a website; mobile application; email; or 
text message. The NPRM asked whether this definition is adequate or 
whether the rule should include additional methods.
    The Commission received a number of comments on this definition. 
CDIA commented that it appreciates the flexibility the definition gives 
and noted that the proposed definition includes the methods of delivery 
currently in use in the marketplace.\17\ Consumer groups raised a 
concern that website notifications could result in the NCRAs not 
actively informing military consumers of material changes, instead 
requiring the consumer to regularly and proactively check their account 
on the website. They recommended that the Commission clarify that, when 
a notification is made via website, there should be some form of active 
``push'' notification, whether via email, text, or mobile app 
notification, of the fact that there have been material additions or 
modifications.\18\ This would ensure a consumer is notified of changes, 
even if the consumer must then go to the website to determine what that 
actual change is. Blue Star Families recommended that the notification 
methods include encrypted messaging platforms such as WhatsApp or 
Signal, which military consumers may commonly use during training 
events or deployment.\19\ They also recommended that military consumers 
be able to designate an alternate point of contact when they don't have 
access to notification platforms or the ability to take action based on 
an alert.
---------------------------------------------------------------------------

    \17\ See CDIA (comment 23) at 5.
    \18\ See NCLC et al. (comment 20) at 4-5.
    \19\ See Blue Star Families (comment 24) at 1.
---------------------------------------------------------------------------

    The Commission has carefully considered the comments received. As 
to the use of encrypted messaging platforms, the Commission notes that 
the proposed definition already allows the NCRAs to provide notices via 
mobile applications; thus, no change to the rule is necessary to allow 
them to provide notices via these platforms. As to allowing an 
alternate point of contact, the Commission is concerned about the 
security implications of requiring NCRAs to transmit sensitive alerts 
about consumers' credit information to multiple points of contact. 
Although the Commission declines to modify the proposed rule to require 
alternative points of contact, we understand the concerns that the 
military consumer may be unable to access notification platforms or 
take action based on alerts while deployed. Accordingly, the Commission 
encourages the NCRAs to explore options for addressing these issues.
    Finally, as to notification via website, the Commission agrees that 
military consumers should not have to proactively log onto to a website 
in order to continually check whether a material addition or 
modification has been made to their files. Instead, there should be 
some form of active notification. Accordingly, the final rule deletes 
the reference to allowing notification by website. It continues to 
require electronic notification of material additions or modifications 
by mobile application, email, or text message, but clarifies that the 
notices can link to a website where the consumer can find additional 
information regarding the specifics of the addition or modification.
v. Definition of Free, Sec.  609.2(k)
    The proposed rule defined ``free'' as ``provided at no cost to the 
consumer.'' The Commission received one comment on this definition. 
Senators Carper and Coons recommended that the Commission define 
``free'' to prohibit the secondary use of military consumers' personal 
information; the disclosure of such information to third parties; the 
use of such information for marketing purposes; or the implication that 
the consumer should purchase identity theft insurance.\20\ The 
Commission agrees with the Senators that the rule should not allow 
secondary uses, disclosures to third parties, or the use of information 
for marketing purposes, but does not believe that a change to the 
definition of ``free'' is necessary. As discussed below, the rule 
already specifies that the NCRAs can use information collected to 
provide the military credit monitoring service only in four instances: 
To provide the service requested by the consumer; to process a 
transaction requested by the consumer at the same time he or she 
requests the service; to comply with applicable legal requirements; or 
to update information the NCRA already maintains for the purpose of 
providing consumer reports, with certain limitations. Thus, the rule 
would not permit the uses contemplated by the commenters. As to the 
suggestion that the definition of ``free'' prohibit the implication 
that the consumer should purchase identity theft insurance, the rule 
already requires NCRAs to delay all marketing until after the consumer 
has enrolled in the free electronic credit monitoring service. This 
requirement would include marketing of insurance products. Given the 
restrictions on information use, disclosure, and marketing in other 
sections of the rule, the Commission has determined to

[[Page 31184]]

adopt the proposed rule's definition of ``free'' without modification.
---------------------------------------------------------------------------

    \20\ See Letter from Senator Thomas R. Carper and Senator 
Christopher A. Coons of the United States Senate Regarding the 
Military Credit Monitoring Rulemaking Proceeding and the Proposed 
Rule Set Forth in the Notice of Proposed Rulemaking (January 23, 
2019) at 2.
---------------------------------------------------------------------------

vi. Definition of Material Additions or Modifications, Sec.  609.2(l)
    The NPRM defined ``material additions or modifications'' as 
significant changes to a consumer's file, including the establishment 
of new accounts; inquiries or requests for a consumer report, other 
than for prescreening or account review; changes to name, address, or 
phone number; changes to credit account limits; and negative 
information. The Commission requested comment on whether this 
definition was adequate or if the rule should add other elements. The 
Commission also requested comment on specific issues related to this 
definition, including whether changes to credit account limits should 
remain; whether the exceptions for prescreening and account review are 
appropriate; and whether NCRAs have the ability to differentiate 
between inquiries made for the purposes of account review and 
collection.
    The Commission received two comments recommending global changes to 
the definition of material additions or modifications. First, consumer 
groups recommended that the definition provide an exhaustive list of 
material changes and that the NCRAs be required to get Commission 
approval to provide notifications for any changes not on that list.\21\ 
They expressed concern that without such a limitation, the NCRAs may 
over-notify military consumers and cause unnecessary alarm. Second, 
CDIA recommended that the list of material changes be examples and that 
the Commission provide a safe harbor for the NCRAs to provide their 
commercial credit monitoring services to active duty military consumers 
for free.\22\ CDIA expressed concern that without a safe harbor, the 
rule will force the NCRAs to develop new products and services. CDIA 
noted that Congress chose to require only one portion of the consumer 
reporting market--the NCRAs--to provide their credit monitoring 
services to active duty military consumers for free. Therefore, CDIA 
stated that the Commission should seek to reduce the burdens and costs 
placed on the NCRAs.
---------------------------------------------------------------------------

    \21\ See NCLC et al. (comment 20) at 4.
    \22\ See CDIA (comment 23) at 6-9.
---------------------------------------------------------------------------

    The Commission does not believe it is necessary for the rule to 
provide an exhaustive list of material additions or modifications 
because the Commission believes the risk of over-notification from 
allowing NCRAs to notify consumers of additional changes is low. The 
NCRAs do not have an incentive to increase their costs by providing 
excessive notifications to military consumers.
    The Commission also declines to grant the NCRAs a safe harbor for 
providing their commercial credit monitoring services to military 
consumers for free. The Act requires the Commission to promulgate a 
rule that defines ``material additions or modifications to the file of 
a consumer.'' In the absence of a minimum standard, NCRAs could create 
new tiers for commercial credit monitoring products and offer active 
duty military consumers free versions of a new product with only 
limited features. Congress could not have intended this result.
    At the same time, the Commission appreciates that providing a free 
electronic credit monitoring service to active duty military consumers 
will place costs and burdens on the NCRAs. Thus, as discussed below, 
the Commission has sought to align the requirements with the NCRAs' 
existing commercial credit monitoring services as much as possible 
while ensuring that the service required by the rule provides 
appropriate consumer protections.
    In addition to receiving global comments on the definition of 
``material addition or modification,'' the Commission received comments 
on several specific proposals. First, the proposed rule's inclusion of 
changes to a consumer's name, address, or phone number was the subject 
of several comments. One commenter expressed support for including 
these changes.\23\ Another commenter recommended that the rule also 
include a change to email address as a material addition or 
modification because the CRAs typically notify customers of their 
commercial credit monitoring services of changes via email.\24\ On the 
other hand, CDIA recommended that the Commission remove changes to 
consumers' names, addresses and phone numbers from the definition 
because those changes are not uniformly part of the NCRAs' commercial 
credit monitoring products.\25\
---------------------------------------------------------------------------

    \23\ See NCLC et al. (comment 20) at 3.
    \24\ See Anonymous Students (comment 8).
    \25\ See CDIA (comment 23) at 8.
---------------------------------------------------------------------------

    After considering these comments, the Commission has decided to 
retain the requirement to notify consumers of changes to their address. 
The Commission is concerned that failing to provide a notification 
about the appearance of a new address in a consumer's file will 
potentially leave consumers without notice of a key indicator of fraud. 
For example, an identity thief may change the address listed on a 
consumer's existing credit card account in order to reroute statements 
so that the consumer does not see fraudulent charges. At least one of 
the NCRAs currently provides alerts for address changes.\26\ 
Additionally, it appears that new addresses are monitored in all three 
of the NCRAs' consumer files.\27\ Furthermore, in other sections of the 
FCRA, Congress has put in place requirements that suggest it believed 
that a change in address could be a sign of fraud.\28\ To lessen the 
chance of over-notification, the Commission has decided to modify the 
requirement to clarify that only a material change to an address 
requires notification. Thus, if the address 123 Main Street was already 
included in a consumer's file, the NCRAs are not required to provide a 
notification if a creditor reports an address of 123 Main St.\29\
---------------------------------------------------------------------------

    \26\ See Equifax, What types of credit monitoring alerts should 
I expect to receive?, https://help.equifax.com/s/article/What-types-of-credit-monitoring-alerts-should-I-expect-to-receive (last visited 
May 2, 2019). A number of commercial credit monitoring services 
provided by companies other than the NCRAs also advertise that they 
provide alerts for address changes in consumers' files. See, e.g., 
LastPass, What triggers a credit monitoring alert, https://lastpass.com/support.php?cmd=showfaq&id=3926 (last visited May 2, 
2019).
    \27\ See myFICO, https://www.myfico.com/Include/Store/Legal/FAQAlertMatrix (last visited May 2, 2019).
    \28\ 15 U.S.C. 1681c(h) (related to notice of discrepancy in 
address); 15 U.S.C. 1681m(e)(C) (related to regulations for card 
issuers regarding changes of address).
    \29\ However, as discussed above, the rule's list of material 
additions or modifications is non-exhaustive, thus the NCRAs may 
provide notifications of these types of changes if they choose.
---------------------------------------------------------------------------

    However, the Commission has decided to remove the requirement that 
the NCRAs provide notifications for changes to name and phone number. 
Unlike addresses, it is not clear whether changes to the names and 
phone numbers in consumers' files are routinely monitored or included 
in commercial credit monitoring alerts. For similar reasons, the 
Commission declines to require notifications for changes to email 
address. Of course, nothing in the rule prohibits the NCRAs from 
providing such alerts if they choose to do so.
    Second, several commenters addressed the definition's inclusion of 
changes to credit account limits. Some commenters recommended retaining 
notification for changes to credit account limits, noting that this 
information is useful to military consumers.\30\ CDIA recommended

[[Page 31185]]

removing changes to credit account limits because NCRAs do not 
uniformly include notification of changes to account limits in 
commercial credit monitoring services, such changes are not indicative 
of identity theft or fraud, and the proposed rule gives no guidance on 
what level of change in account limits would be material.\31\
---------------------------------------------------------------------------

    \30\ See NCLC et al. (comment 20) at 4; Blue Star Families 
(comment 24) at 1. For example, NCLC noted that credit card issuers 
are not always required to notify consumers about decreased account 
limits.
    \31\ See CDIA (comment 23) at 8.
---------------------------------------------------------------------------

    The Commission has decided to retain the category of ``changes to 
credit account limits'' in the list of material additions and 
modifications of which consumers must be notified. The Commission 
disagrees with the comment that changes to credit account limits are 
not indicative of identity theft or fraud. For example, an identity 
thief may call a credit card company and request that an account limit 
be raised so that she can make additional fraudulent charges. Indeed, 
in drafting the FCRA provision dealing with fraud alerts, Congress 
prohibited creditors from increasing the credit limit on an existing 
account that contains a fraud alert without verifying the requestor's 
identity. This prohibition illustrates that Congress believed that such 
a change in account limits could be indicative of fraud. For these 
reasons, the Commission declines to remove changes to credit account 
limits from the list of material additions or modifications. The 
Commission does recognize that the proposed rule did not set a 
threshold for a material change and that a lack of such a threshold 
could create uncertainty in the marketplace. Thus, the Commission has 
determined that the rule will require notifications for changes to 
credit account limits of $100 or greater. These are the types of 
changes that are monitored in at least one of the NCRA's consumer 
files.\32\
---------------------------------------------------------------------------

    \32\ See myFICO, https://www.myfico.com/Include/Store/Legal/FAQAlertMatrix (last visited May 2, 2019).
---------------------------------------------------------------------------

    Third, the proposed rule included inquiries or requests for a 
consumer report as a material addition or modification, with an 
exception for inquiries for prescreening or account review. The NPRM 
noted that notifying consumers of pre-screening or account review 
inquiries could result in over-notification, making it difficult for 
consumers to determine when an inquiry indicates that they are 
potentially the victim of identity theft or other fraud. The proposed 
rule did not include an exception for inquiries for the purposes of 
account collection, but the NPRM asked whether NCRAs have the ability 
to differentiate between account collection and account review 
inquiries.
    CDIA's comment indicated that NCRAs cannot distinguish between 
account review and collection.\33\ CDIA explained that the NCRAs only 
require companies to provide their permissible purpose for obtaining a 
consumer report, but that the permissible purpose for account review 
and account collection is the same. Thus, if the rule were to require 
notifications of inquiries made for account collection (as the proposed 
rule did), NCRAs would likely provide notifications of inquiries for 
account review, which could result in overnotification. Accordingly, 
CDIA recommended notification be limited to ``inquiries or requests for 
a consumer report in connection with the establishment of a new credit 
plan or extension of credit, other than under an open-end credit plan 
(as defined in section 103(i)),\34\ in the name of the consumer.'' \35\ 
CDIA noted that similar language is used elsewhere in the FCRA.\36\
---------------------------------------------------------------------------

    \33\ See CDIA (comment 23) at 9.
    \34\ An open-end credit plan is ``a plan under which the 
creditor reasonably contemplates repeated transactions, which 
prescribes the terms of such transactions, and which provides for a 
finance charge which may be computed from time to time on the 
outstanding unpaid balance.'' 15 U.S.C. 1602(j). A typical example 
of an open-end credit plan is a credit card. Thus, under the 
recommended language an inquiry triggered by a creditor conducting 
account review for an existing credit card account would not require 
notification.
    \35\ See CDIA (comment 23) at 6-7.
    \36\ See 15 U.S.C. 1681c-1(h).
---------------------------------------------------------------------------

    Given that the NCRAs do not differentiate between inquiries for 
account review and account collection, the Commission agrees that 
inquiries for account collection should be excepted. The Commission 
notes that if a company establishes a new collection account, the NCRA 
would already have to send a notification because new accounts are 
included in the list of material additions or modifications. To ensure 
that there is no ambiguity about that requirement, the Commission has 
decided to modify Sec.  609.2(l)(1) to provide that significant changes 
to a consumer's file includes new accounts opened in the consumer's 
name, including new collection accounts. With respect to Sec.  
609.2(l)(2), the Commission declines to adopt CDIA's proposed language. 
The proposed language would only require notification for inquiries or 
requests for a consumer report in connection with a credit transaction. 
Thus, for example, military consumers would not receive a notification 
if an employer or insurer requested their report because someone 
applied for employment or insurance in their name, which could be 
indicative of identity theft. Therefore, the Commission has determined 
to modify Sec.  609.2(l)(2)(i) to provide that an inquiry made for a 
prescreened list obtained for the purpose of making a firm offer of 
credit or insurance as described in 15 U.S.C. 1681b(c)(1)(B) or for the 
purpose of reviewing or collecting an account of the consumer shall not 
be considered a material addition or modification.
    Finally, two commenters recommended adding a significant drop in 
credit score, such as 25 points or more, to the list of material 
additions or modifications. These commenters suggested that such a drop 
may indicate a significant change to the consumer's file, possibly due 
to fraud.\37\ Military groups also noted that a large drop in credit 
score could signal a problem that leads to revocation of a military 
consumer's security clearance.
---------------------------------------------------------------------------

    \37\ See NCLC et al. (comment 20) at 3 (NCLC suggested that a 
credit score drop might be caused by a drastic increase in the usage 
of a credit line, due to existing account fraud); Veterans Education 
Success et al. (comment 22) at 2-3.
---------------------------------------------------------------------------

    Although the Commission is sympathetic to these concerns, it 
declines to make this change. The rule already requires the NCRAs to 
provide a notification about events that would likely cause a 
significant drop in credit score, such as a delinquency. Beyond 
requiring notification of substantive events that would likely cause a 
significant drop in credit score, the Commission does not have 
information at this time to determine the feasibility and costs of this 
proposal. For example, it is not clear how often the NCRAs are 
calculating credit scores in the absence of a request from a consumer 
or creditor. Nor is it clear how much it would cost NCRAs to 
continuously monitor credit scores for the purpose of providing an 
alert when there is a significant drop. Thus, the Commission declines 
to include this change.
vii. Definition of Negative Information, Sec.  609.2(n)
    The NPRM defined ``negative information'' as having the meaning 
provided in 15 U.S.C. 1681s-2(a)(7)(G)(i), which in turn defines 
``negative information'' to mean ``information concerning a customer's 
delinquencies, late payments, insolvency, or any form of default,'' in 
the context of furnishers providing information to the CRAs. The 
Commission received one comment on this definition. CDIA noted that the 
proposed definition does not provide enough specificity to the NCRAs as 
to

[[Page 31186]]

when notification is required.\38\ CDIA recommended that the Commission 
modify the definition as follows: Accounts furnished to the NCRAs as 
more than 30 days delinquent, accounts furnished to the NCRAs as being 
included in bankruptcy petition filings, and new public records (such 
as suits or judgments). The Commission believes that CDIA's proposed 
language covers the negative information that the Commission intended 
for the proposed rule to require notification of and therefore has 
decided to modify the language to provide the NCRAs greater 
specificity. The Commission is also adding additional detail to provide 
a non-exhaustive list of what types of new public records may 
constitute negative information. Thus, the Commission has decided to 
modify the definition of ``negative information'' as follows: Accounts 
furnished to the NCRAs as more than 30 days delinquent, accounts 
furnished to the NCRAs as being included in bankruptcy petition 
filings, and new public records, including, but not limited to, 
bankruptcy filings, civil court judgments, foreclosures, liens, and 
convictions.
---------------------------------------------------------------------------

    \38\ See CDIA (comment 23) at 8-9.
---------------------------------------------------------------------------

viii. Definitions of Consumer, Consumer Report, Contact Information, 
Credit, File, Firm Offer of Credit, and Nationwide Consumer Reporting 
Agency
    The Commission received no comments on the proposed rule's 
definitions of ``consumer,'' ``consumer report,'' ``contact 
information,'' ``credit,'' ``file,'' ``firm offer of credit,'' and 
``nationwide consumer reporting agency.'' The Commission adopts these 
definitions without modification.

c. Requirement To Provide Free Electronic Credit Monitoring Service, 
Sec.  609.3

    Proposed Sec.  609.3(a) required the NCRAs to provide a free 
electronic credit monitoring service to active duty military 
consumers.\39\ Proposed Sec.  609.3(b) allowed the NCRAs to condition 
provision of the service upon the consumer providing appropriate proof 
of identity; contact information; and appropriate proof that the 
consumer is an active duty military consumer. Proposed Sec.  609.3(c) 
provided the methods for verifying a consumer's status as an active 
duty military consumer. Proposed Sec.  609.3(d) limited the ways that 
the NCRAs can use or disclose the information collected from consumers 
as a result of a request to obtain the service. Proposed Sec.  609.3(e) 
placed limitations on the types of communications that may surround 
enrollment in the service. Proposed Sec.  609.3(f) prohibited asking or 
requiring a consumer to agree to terms or conditions in connection with 
obtaining the service.
---------------------------------------------------------------------------

    \39\ The Commission received one comment stating that the FTC 
should seek rulemaking authority to provide free credit monitoring 
services to all U.S. residents and not just active duty military 
consumers. Electronic Privacy Information Center (comment 26) at 2-
3. The Commission does not take a position on the merits of this 
proposal because it is outside the scope of this rulemaking.
---------------------------------------------------------------------------

i. Appropriate Proof of Active Duty Military Consumer Status, Sec.  
609.3(c)
    The proposed rule required NCRAs to verify a consumer's status as 
an active duty military consumer through one of four methods: A copy of 
the consumer's active duty orders; a copy of a certification of active 
duty status issued by the DoD; a method or service approved by the DoD; 
or a certification of active duty status approved by the NCRA. The 
Commission requested comment on whether these methods are adequate or 
if other methods should be included. The Commission also asked whether 
it is burdensome for consumers to provide appropriate proof, and if so, 
if there are ways to minimize the burden.
    The Commission received several comments on the methods for 
validating a consumer's active duty military consumer status. CDIA 
recommended that the Commission work with DoD to come up with an 
automated system to conclusively determine whether a consumer is 
eligible for the service and that will also verify the time period for 
which the consumer is eligible for the service.\40\ Absent an automated 
system, CDIA stated that the Commission should clarify that the 
determination of active duty status is valid for two years and then 
must be renewed. Consumer groups similarly suggested that the NCRAs be 
allowed to use the DoD developed database that lenders use to comply 
with the Military Lending Act (``MLA'').\41\
---------------------------------------------------------------------------

    \40\ See CDIA (comment 23) at 11.
    \41\ See NCLC et al. (comment 20) at 6.
---------------------------------------------------------------------------

    With respect to the requests for an automated system run by the 
DoD, the Commission notes that if DoD were to develop such a system, it 
would be considered ``a method or service approved by the DoD'' and 
thus would not require any modification to the rule. The Commission 
will work with the DoD to explore whether a DoD-run system or database 
is viable.\42\ The Commission agrees that in the absence of an 
automated system, the rule should specify a period of time for which 
the determination of active duty status is valid. The Commission 
believes that the two-year time period suggested by CDIA is reasonable. 
Indeed, it is twice as long as the duration of an active duty military 
fraud alert.\43\ Therefore, the Commission is adding a provision to the 
final rule establishing that an NCRA's verification of active duty 
military consumer status is valid for two years. After the expiration 
of the two-year period, the NCRA may require the consumer to provide 
proof that the consumer continues to be an active duty military 
consumer.
---------------------------------------------------------------------------

    \42\ With respect to the comment that NCRAs be allowed to use 
the MLA database, the Commission notes that DoD currently only 
allows the database to be used for determining whether someone is 
eligible for MLA protections. In any event, the definition of a 
covered borrower under the MLA is more expansive than the rule's 
definition of active duty military consumer. For example, the MLA 
regulations do not require that a military consumer be assigned to 
service away from their usual duty station. They also cover 
dependents. See 32 CFR 232.3(g).
    \43\ 12 CFR 1022.121.
---------------------------------------------------------------------------

    Military groups recommended that the Commission remove the option 
for a certification approved by the NCRA because it may allow 
inadequate methods of proof.\44\ The Commission believes that it would 
benefit military consumers to allow the NCRAs to accept additional 
certifications of their choosing, such as having the consumer check a 
box certifying that they are an active duty military consumer. If the 
NCRA decides that the ease of such a method outweighs the risk that 
some consumers may misrepresent that they are eligible for the free 
service, any costs of such a determination would be borne by the NCRA.
---------------------------------------------------------------------------

    \44\ See Veterans Education Success et al. (comment 22) at 2.
---------------------------------------------------------------------------

    Various commenters recommended additional methods of validation. 
One commenter raised concerns about whether the current methods of 
proof would cover members of the National Guard when not on active duty 
orders.\45\ This commenter suggested that a current leave and earnings 
statement is a method of proof that would be available to the National 
Guard.\46\ Another commenter suggested that a letter from the 
consumer's commanding officer should be appropriate proof.\47\
---------------------------------------------------------------------------

    \45\ See NCLC et al. (comment 20) at 6-7.
    \46\ See NCLC et al. (comment 20) at 6. See also Veterans 
Education Success et al. (comment 22) at 2; NCLC et al.
    \47\ American Financial Services Association (comment 21) at 2. 
Another commenter suggested that the methods should include a letter 
other than active duty orders because the commenter stated that 
orders may include the consumer's Social Security number. See 
Marlatt (comment 7).
---------------------------------------------------------------------------

    The Commission understands the desire to provide military consumers

[[Page 31187]]

and the NCRAs flexibility in the types of documentation that they can 
use to verify active duty military consumer status. In light of the 
fact that what constitutes appropriate proof for National Guard members 
will likely differ from that for active duty military more generally, 
the Commission has decided not to attempt to include a list of all 
suitable documents in the rule. Rather, to allow maximum flexibility, 
the Commission has decided to retain two of the methods from the 
proposed rule: (1) A method or service approved by the DoD; and (2) a 
certification of active duty status approved by the NCRA. The 
Commission notes that while it is removing the two additional methods 
that were in the proposed rule: (1) A copy of the consumer's active 
duty orders; and (2) a copy of a certification of active duty status 
issued by the DoD--those documents, as well as the additional documents 
recommended by the commenters, can still be incorporated into a 
certification method approved by DoD or the NCRA.
    The Commission is also clarifying that the procedures that the 
NCRAs use to determine appropriate proof of active duty military 
consumer status must include methods that allow all eligible consumers 
to enroll. For example, an NCRA cannot decide that the only proof of 
status it will accept from a member of the National Guard is active 
duty orders, given that most members of the National Guard will not 
have active duty orders. To the extent that the NCRAs find it difficult 
to verify that individuals meet the definition of an ``active duty 
military consumer,'' particularly with respect to whether they are 
assigned to service away from their usual duty station, the Commission 
encourages the NCRAs to err on the side of providing the free service 
more broadly. To provide an incentive for the NCRAs to provide the free 
service to a broader set of military consumers and to reduce the 
likelihood that an eligible consumer is excluded from the free service, 
the Commission will deem an NCRA to be in compliance with this 
provision if it provides free electronic credit monitoring services to 
(1) consumers who self-certify active duty status, as defined in 10 
U.S.C. 101(d); (2) consumers who self-certify that they are a reservist 
performing duty under a call or order to active duty under a provision 
of law referred to in 10 U.S.C. 101(a)(13); and (3) consumers who self-
certify that they are a member of the National Guard, as defined in 10 
U.S.C. 101(c).
ii. Information Use and Disclosure, Sec.  609.3(d)
    The proposed rule limited the ways that the NCRAs can use or 
disclose the information collected from consumers as a result of a 
request to obtain the free electronic credit monitoring service. The 
proposed rule allowed NCRAs to use the information collected only: (1) 
To provide the free electronic credit monitoring service requested by 
the consumer; (2) to process a transaction requested by the consumer at 
the same time as a request for the service; (3) to comply with 
applicable legal requirements; or (4) to update information already 
maintained by the NCRA for the purpose of providing consumer reports, 
with certain limitations. The NPRM noted that these restrictions on use 
and disclosure are identical to the requirements placed on the NCRAs' 
collection of personally identifiable information from consumers using 
the centralized source for annual credit reports.\48\ The Commission 
requested comment on whether the allowed uses and disclosures are 
appropriate and whether the rule should permit additional uses.
---------------------------------------------------------------------------

    \48\ 12 CFR 1022.136(f).
---------------------------------------------------------------------------

    Several commenters supported these restrictions and noted that they 
would prevent the use of the personal information collected from 
military consumers for marketing or other unanticipated uses.\49\ On 
the other hand, CDIA commented that the restrictions are unnecessary in 
light of the Commission's authority under Section 5 of the FTC Act to 
address unfair or deceptive acts or practices.\50\ CDIA also argued 
that the restrictions are beyond the scope of the FTC's statutory 
authority under the Act. The American Financial Services Association 
commented that the Commission should ensure that the restrictions do 
not prevent the information's use for the purpose of studying the 
effect the MLA regulations are having on the availability of 
credit.\51\
---------------------------------------------------------------------------

    \49\ See Electronic Privacy Information Center (comment 26) at 
2; NCLC et al. (comment 20) at 7; Veterans Education Success et al. 
(comment 22) at 2.
    \50\ See CDIA (comment 23) at 12.
    \51\ American Financial Services Association (comment 21) at 1-
2. This commenter also requested that the Commission encourage the 
DoD to grant consumer reporting agencies permission to pull data 
from the MLA database for purposes of such a study. The Commission 
does not have any role in administering the MLA database and defers 
to DoD as to appropriate uses of the information contained therein.
---------------------------------------------------------------------------

    The Commission does not agree that the agency's Section 5 authority 
renders the proposed rule's restrictions unnecessary. Under Section 5, 
the Commission would be limited to pursuing a law enforcement action in 
circumstances where an NCRA deceived a military consumer or used or 
disclosed the information in a manner that caused or was likely to 
cause substantial injury that was not reasonably avoidable by consumer 
themselves and not outweighed by countervailing benefits to consumers 
or to competition. However, even in circumstances not involving 
deception or substantial injury, the Commission does not believe that 
it would be appropriate to make an active duty military consumer's 
access to the free electronic credit monitoring service contingent on 
the consumer's willingness to allow a NCRA to use the consumer's 
information for unrelated, secondary uses. The Commission believes that 
the use and disclosure restrictions are within its authority under the 
Act because they are necessary to ensure that the Act's purpose of 
providing active duty military consumers with free electronic credit 
monitoring is not undermined by consumers' concerns about secondary 
uses of their personal information.\52\
---------------------------------------------------------------------------

    \52\ Section 605A(k)(3) of the FCRA, 15 U.S.C. 1681c-1(k)(3), 
requires the Commission to promulgate regulations that ``at a 
minimum'' define electronic credit monitoring service and material 
additions or modifications to the file of a consumer and state what 
constitutes appropriate proof of active duty military status. Thus, 
the statute contemplates that the Commission's regulations may go 
beyond defining those terms.
---------------------------------------------------------------------------

    With respect to the specific request to allow the information to be 
used for the purpose of studying the effect MLA regulations have on the 
availability of credit, the Commission declines to grant an exception 
to allow military consumers' personal information to be used for such a 
purpose, which is unrelated to their request for the free electronic 
credit monitoring. For these reasons, the Commission has decided to 
retain the proposed rule's information use and disclosure restrictions 
without modification.
iii. Communications Surrounding Enrollment in Electronic Credit 
Monitoring Service, Sec.  609.3(e)
    Proposed Sec.  [thinsp]609.3(e) placed limitations on the types of 
communications that may surround enrollment in the electronic credit 
monitoring service, similar to the restriction on advertising on the 
annual credit report website.\53\ Proposed Sec.  609.3(e)(1) restricted 
any advertising or marketing for products or services, or any 
communications or instructions that advertise or market any products 
and services, to a consumer who has

[[Page 31188]]

indicated an interest in signing up for the free electronic credit 
monitoring service until after the consumer has enrolled in the 
service. Section 609.3(e)(2) of the proposed rule specified that any 
communications, instructions, or permitted advertising or marketing may 
not interfere with, detract from, contradict, or otherwise undermine 
the purpose of providing a free electronic credit monitoring service to 
active duty military consumers. Section 609.3(e)(3) of the proposed 
rule provided examples of conduct that would interfere with, detract 
from, contradict, or undermine the purpose of the rule. The Commission 
solicited comment on whether the limitations are necessary to ensure 
that active duty military consumers are able easily to obtain their 
free electronic credit monitoring service. The Commission also asked 
whether the limitations impose undue burdens on the NCRAs, and if so, 
whether there are ways to minimize the burdens. The Commission also 
asked whether there are more examples of prohibited conduct that should 
be included in the rule.
---------------------------------------------------------------------------

    \53\ 12 CFR 1022.136(g).
---------------------------------------------------------------------------

    Consumer groups stated that the limitations are necessary to allow 
military consumers to get the free credit monitoring easily without 
encountering distracting advertising.\54\ They further recommended that 
the Commission prohibit the NCRAs from representing or implying that 
the service is inferior to the NCRA's commercial credit monitoring 
services. They also recommended that the Commission prohibit the NCRAs 
from offering identity theft insurance at any time in connection with 
the free credit monitoring because of concerns about the usefulness of 
such insurance.
---------------------------------------------------------------------------

    \54\ See NCLC et al. (comment 20) at 7; see also Veterans 
Education Success et al. (comment 22) at 2.
---------------------------------------------------------------------------

    After carefully considering these suggestions, the Commission has 
decided not to add prohibitions beyond those already included in the 
proposed rule. Section 609.3(e)(3)'s prohibited communications are 
designed to ensure that active duty military consumers are not confused 
or deceived by communications related to a NCRA's products and 
services. If a NCRA makes a deceptive representation to consumers about 
its commercial credit monitoring products or identity theft insurance, 
the Commission can pursue an enforcement action under Section 5 of the 
FTC Act. Some consumers may be interested in paying an additional fee 
in order to obtain services that may not be available within the free 
electronic credit monitoring service. Therefore, given that the rule 
already prohibits marketing until after the consumer has enrolled in 
the free service, the Commission does not believe it is necessary to 
prohibit truthful advertising regarding the NCRA's products and 
services after enrollment.
    CDIA stated that the restrictions are unnecessary and outside of 
the Commission's statutory authority under the Act.\55\ CDIA also noted 
that unlike free annual credit reports, which the NCRAs offer through a 
centralized website, the NCRAs will offer the free electronic credit 
monitoring through their own commercial websites. CDIA argued that this 
makes it more difficult to determine when advertising is and is not 
permitted. CDIA criticized the proposed rule's standard of delaying 
marketing ``once a consumer has indicated that the consumer is 
interested in obtaining the service . . . such as by clicking on a link 
for services'' as ambiguous. Therefore, if the Commission retains the 
marketing limitations, CDIA requested additional clarification on this 
point to make clear that marketing is prohibited only during the 
enrollment process. CDIA recommended the following language for Sec.  
609.3(e)(1): ``once a consumer is in the process of accessing the 
ability to enroll in the service required under paragraph (a) of this 
section and only during the enrollment process. . . .''
---------------------------------------------------------------------------

    \55\ See CDIA (comment 23) at 13.
---------------------------------------------------------------------------

    After considering the comments, the Commission has determined that 
retaining the restrictions on communications is necessary to further 
the Act's purpose of providing active duty military consumers with a 
free electronic credit monitoring service. These restrictions help 
ensure that active duty military consumers are not thwarted by 
confusing advertisements or communications that dissuade them from 
enrolling in the free service.
    The Commission recognizes that the proposed rule's limitation on 
advertising from the time the consumer ``has indicated an interest in 
signing up for the free electronic credit monitoring service'' may have 
been unclear. The Commission did not intend to ban advertising on all 
web pages of the NCRAs; rather, it sought to limit advertising on pages 
that are part of the product enrollment process. To provide greater 
clarity, the Commission has decided to modify Sec.  609.3(e)(1) to 
provide that once a consumer is in the process of accessing the ability 
to enroll in the service required under paragraph (a) and only during 
the enrollment process, any advertising or marketing for products or 
services, or any communications or instructions that advertise or 
market any products and services, must be delayed until after the 
consumer has enrolled in that service. The Commission interprets this 
to mean that the NCRAs shall not advertise on the pages of the NCRA's 
website or app dedicated to providing active duty military consumers 
with their rights under this regulation, until after the consumer has 
enrolled in the service.
iv. Other Prohibited Practices, Sec.  609.3(f)
    The proposed rule also prohibited asking or requiring an active 
duty military consumer to agree to terms or conditions in connection 
with obtaining a free electronic credit monitoring service. The 
Commission asked whether this prohibition is necessary; whether CRAs 
currently require customers of commercial credit monitoring services to 
agree to terms or conditions; and whether the prohibition imposes undue 
burdens on the NCRAs. Commenters that supported the inclusion of these 
prohibitions specifically pointed out that without them, the NCRAs 
could require military consumers to agree to mandatory arbitration 
clauses in order to receive free credit monitoring.\56\ However, CDIA 
commented that the prohibitions are unnecessary and outside of the 
FTC's statutory authority under the Act.\57\ CDIA also expressed 
concern that the NCRAs would be in violation of these prohibitions if 
they sought to condition providing the service on the provision of 
appropriate proof of identity, contact information, and appropriate 
proof of active duty military status, as required by the proposed rule. 
CDIA further posited that seeking the consumer's written instructions 
to comply with the FCRA's permissible purpose requirements or consent 
to receive text notifications pursuant to the Telephone Consumer 
Protection Act could violate this provision.
---------------------------------------------------------------------------

    \56\ See NCLC et al. (comment 20) at 8; see also Veterans 
Education Success et al. (comment 22) at 2.
    \57\ See CDIA (comment 23) at 14-15.
---------------------------------------------------------------------------

    As the NPRM noted, this restriction is similar to the restriction 
for the annual credit report website.\58\ The Commission believes it is 
within its statutory authority to ensure that an active duty military 
consumer's right to obtain a free electronic credit monitoring service 
is unfettered and without any restrictions or conditions, apart from 
providing appropriate proof of identity, contact information, and 
appropriate proof that the consumer is an active duty military 
consumer. The

[[Page 31189]]

Commission believes that allowing the NCRAs to condition provision of 
the free electronic credit monitoring service on the consumer's 
agreement to a variety of terms and conditions could dissuade military 
consumers from availing themselves of the service. However, the 
Commission recognizes that there may be certain instances in which 
legal requirements may require the NCRAs to receive consumers' consent 
for certain aspects of the service. Thus, the Commission has decided to 
retain the prohibition with the following modification: A NCRA shall 
not ask or require an active duty military consumer to agree to terms 
or conditions in connection with obtaining a free electronic credit 
monitoring service, other than those terms or conditions required to 
comply with applicable legal requirements.
---------------------------------------------------------------------------

    \58\ 12 CFR 1022.136(h).
---------------------------------------------------------------------------

d. Timing of Electronic Credit Monitoring Notices, Sec.  609.4

    The proposed rule required that the electronic notifications be 
provided within 24 hours of any material additions or modifications to 
a consumer's file. The Commission requested comment on whether the 
proposed rule's 24-hour timing was appropriate. The Commission received 
one comment on the timing requirements. CDIA commented that the timing 
requirement is outside of the Commission's statutory authority and that 
it should be kept out of the final rule. It recommended that if the 
timing requirement remains, the Commission should instead require 
notifications within 48 hours to be consistent with the NCRA's 
commercial credit monitoring services. CDIA also recommended that the 
Commission provide a safe harbor for NCRAs to provide notifications 
within the same timing that they use for their commercial credit 
monitoring services.\59\
---------------------------------------------------------------------------

    \59\ See CDIA (comment 23) at 15.
---------------------------------------------------------------------------

    The Commission believes it is necessary and within its statutory 
authority under the Act to specify the time within which electronic 
notifications must be made. If military consumers are not notified of 
the material additions or modifications to their files within a 
reasonable amount of time, the electronic credit monitoring service 
would not be as effective. For example, if a consumer is notified 
promptly about a new account that has been fraudulently opened in his 
or her name and appears on his or her consumer report, he or she may 
decide to place a fraud alert or security freeze on their file, which 
may help prevent the opening of additional fraudulent accounts. The 
Commission declines to give the NCRAs a safe harbor for providing the 
notifications within the same timing that they use for their commercial 
credit monitoring products because that timing could change in the 
future, and the Commission believes it is necessary to set a baseline. 
However, the Commission has decided to modify the timing requirement to 
require notification within 48 hours of any material additions or 
modifications to a consumer's file. This will align the requirement 
with the timing that CDIA states the NCRAs currently use for their 
commercial services, while still requiring that the NCRAs provide the 
notifications in a prompt manner upon making a change to the consumer's 
file.\60\
---------------------------------------------------------------------------

    \60\ The Commission notes that there is a lag between when many 
events, such as a late payment, occur and when a creditor reports 
them to the NCRA and the NCRA updates its files. Thus, the NCRAs can 
only provide notification once they are aware of these events, which 
means that even with prompt credit monitoring notifications, there 
is a delay between when an event occurs and when the consumer will 
receive an alert.
---------------------------------------------------------------------------

e. Additional Information To Be Included in Electronic Credit 
Monitoring Notices, Sec.  609.5

    The proposed rule also required that the electronic notifications 
include a hyperlink to a summary of the consumer's rights under the 
FCRA, as prescribed by the Bureau of Consumer Financial Protection.\61\ 
The Commission noted that it would be useful for consumers to be able 
to easily access information about their rights to, for example, obtain 
consumer reports and dispute information on their reports. The 
Commission requested comment on whether requiring this link would 
provide useful information to consumers and whether there is a 
different method of providing this information that would be more 
effective.
---------------------------------------------------------------------------

    \61\ 15 U.S.C. 1681g(c).
---------------------------------------------------------------------------

    Consumer groups commented that the Commission should also require 
the provision of the Summary of Rights of Identity Theft Victims 
outlined in 15 U.S.C. 1681g(d).\62\ While the Commission agrees that 
the Summary of Rights for Identity Theft Victims also provides useful 
information for consumers, the Commission does not believe it is 
appropriate to mandate its inclusion in the electronic notifications. 
The language of that document contemplates that it will be given to 
consumers when they have contacted a CRA about being the victim of 
identity theft, which likely will not be true for many of the 
recipients of the electronic credit monitoring notices.\63\
---------------------------------------------------------------------------

    \62\ See NCLC et al. (comment 20) at 8-9.
    \63\ For example, it states at the beginning of the document, 
``[y]ou are receiving this information because you have notified a 
consumer reporting agency that you believe that you are a victim of 
identity theft.'' The Bureau's model document can be found at: 
https://files.consumerfinance.gov/f/documents/bcfp_consumer-identity-theft-rights-summary_2018-09.docx.
---------------------------------------------------------------------------

    NCLC also recommended that the Commission require a more prominent 
method of providing the summary of rights, such as including the 
document in the same email or web page, rather than just a 
hyperlink.\64\ NCLC also suggested that if the rule requires access to 
the credit report following a notification, the summary of rights could 
be appended to the report. On the other hand, CDIA commented that it 
had no objections to the general requirement, but expressed concern 
about including the hyperlink in text message or mobile application 
notifications, which may be space limited. CDIA recommended that the 
NCRAs have the flexibility to provide the link on any page within the 
electronic credit monitoring service to which the notification may 
direct the consumer.
---------------------------------------------------------------------------

    \64\ See NCLC et al. (comment 20) at 9.
---------------------------------------------------------------------------

    Given the space constraints in text messages and mobile 
applications, the Commission will modify the rule to allow the NCRAs to 
provide the link to the summary of rights on the first page of the 
website to which the electronic notification may direct the consumer. 
The Commission will also modify the rule to require that the summary of 
rights be included with the credit report that consumers can choose to 
access following the receipt of a notification, as required when a 
consumer requests a copy of their file under section 609 of the FCRA, 
15 U.S.C. 1681g.

f. Severability, Sec.  609.6

    Proposed Sec.  609.6 stated that the provisions of the proposed 
rule are separate and severable from one another, so that if any 
provision was stayed or determined to be invalid, it was the 
Commission's intention that the remaining provisions shall continue in 
effect. The Commission received no comments on this provision and 
adopts it without modification.

g. Compliance Date

    The proposed rule did not address the date by which the NCRAs will 
be required to comply with the rule. CDIA commented that the rule needs 
to provide an appropriate amount of time for the NCRAs to implement the 
service

[[Page 31190]]

required by the rule.\65\ CDIA stated that one year from the effective 
date would be necessary, but that the time could be reduced if the 
NCRAs are given a safe harbor for providing their existing credit 
monitoring services to active duty military consumers for free.
---------------------------------------------------------------------------

    \65\ See CDIA (comment 23) at 16-17.
---------------------------------------------------------------------------

    The Commission recognizes that the NCRAs will need time following 
the publication of the final rule to implement the service. For 
example, they will likely need to create systems to accept proof of 
active duty military status. They may need to make engineering and 
product changes to generate alerts about certain changes to a credit 
file. However, the Commission also notes that Congress gave the 
Commission only one year from the enactment of the Act to promulgate 
these regulations, presumably to ensure that active duty military 
consumers receive the free credit monitoring sooner rather than later. 
For example, Senators Carper and Coons, who drafted the credit 
monitoring provision of the Act, requested that the Commission, 
``conclude the rulemaking process expeditiously so that servicemembers 
may begin benefiting from this service as soon as possible.'' \66\
---------------------------------------------------------------------------

    \66\ Letter from Senator Thomas R. Carper and Senator 
Christopher A. Coons of the United States Senate Regarding the 
Military Credit Monitoring Rulemaking Proceeding and the Proposed 
Rule Set Forth in the Notice of Proposed Rulemaking (January 23, 
2019) at 2.
---------------------------------------------------------------------------

    Balancing these factors, the Commission has determined to set a 
compliance date of 3 months from the effective date of these 
regulations. However, to give the NCRAs additional time to set up their 
systems, while still allowing consumers to benefit from the new rights 
created by the Act, the Commission will allow the NCRAs to comply with 
Sec. Sec.  609.3(a), 609.4, and 609.5 by offering their commercial 
credit monitoring service for free, for a period of up to one year from 
the effective date of the rule.

Paperwork Reduction Act

    The Paperwork Reduction Act (PRA), 44 U.S.C. chapter 35, requires 
federal agencies to seek and obtain OMB approval before undertaking a 
collection of information directed to ten or more persons.\67\ Under 
the PRA, a rule creates a ``collection of information'' when ten or 
more persons are asked to report, provide, disclose, or record 
information in response to ``identical questions.'' \68\ As the 
notification requirements fall upon the three NCRAs, it does not meet 
the PRA threshold count of ten or more persons to constitute a 
``collection of information.'' Further, the proof of identity the rule 
requires of those for whom the rulemaking is designed to benefit, 
consumers on active duty military status, falls within OMB's general 
exception for disclosures that require persons to provide or display 
only facts necessary to identify themselves.\69\
---------------------------------------------------------------------------

    \67\ 44 U.S.C. 3502(3)(A)(i).
    \68\ See 44 U.S.C. 3502(3)(A).
    \69\ See 5 CFR 1320.3(h)(1).
---------------------------------------------------------------------------

Regulatory Flexibility Act

    The Regulatory Flexibility Act (RFA) \70\ requires that the 
Commission conduct an initial and a final analysis of the anticipated 
economic impact of the rule on small entities. The purpose of a 
regulatory flexibility analysis is to ensure the agency considers the 
impacts on small entities and examines regulatory alternatives that 
could achieve the regulatory purpose while minimizing burdens on small 
entities. The RFA \71\ provides that such an analysis is not required 
if the agency head certifies that the regulatory action will not have a 
significant economic impact on a substantial number of small entities.
---------------------------------------------------------------------------

    \70\ 5 U.S.C. 601-612.
    \71\ 5 U.S.C. 605.
---------------------------------------------------------------------------

    The Commission believes that the rule will not have a significant 
economic impact on small entities. The final rule applies to NCRAs. The 
Commission has not identified any NCRAs that are small entities.\72\ 
Therefore, the Commission certifies that the rule will not have a 
significant economic impact on a substantial number of small 
businesses.
---------------------------------------------------------------------------

    \72\ The size standard the Small Business Administration has 
identified by the North American Industry Classification System code 
for credit bureaus (code number 561450), i.e., CRAs, is $15 million. 
See 13 CFR 121.201. The rule only applies to NCRAs. There are 
currently only three NCRAs, Equifax, Experian, and TransUnion, and 
all exceed this size standard.
---------------------------------------------------------------------------

    The final rule is similar to the rule proposed in the NPRM. In its 
Initial Regulatory Flexibility Analysis (IRFA), the Commission 
determined that the proposed rule would not have a significant impact 
on small entities because the NCRAs to which the proposed rule would 
apply were not small entities.
    Although the Commission certifies under the RFA that the rule will 
not have a significant impact on a substantial number of small 
entities, and hereby provides notice of that certification to the Small 
Business Administration, the Commission nonetheless has determined that 
publishing a final regulatory flexibility analysis (FRFA) is 
appropriate to ensure that the impact of the rule is fully addressed. 
Therefore, the Commission has prepared the following analysis:

A. Need for and Objectives of the Final Rule

    The Economic Growth, Regulatory Relief, and Consumer Protection 
Act, Public Law 115-174, directs the Commission to promulgate 
regulations to implement section 302(d)(1) of the Act, which shall at a 
minimum: (1) Define ``electronic credit monitoring service'' and 
``material additions or modifications to the file of a consumer,'' and 
(2) establish what constitutes appropriate proof that a consumer is an 
active duty military consumer. In this action, the Commission issues a 
rule that would fulfill the statutory mandate. The Act requires that 
the Commission promulgate this rule not later than one year after the 
date of enactment, or May 24, 2019.

B. Significant Issues Raised in Public Comments

    The Commission did not receive any comments that addressed the 
burden on small entities.

C. Small Entities To Which the Final Rule Will Apply

    The final rule will apply only to NCRAs. The Commission has not 
identified any NCRAs that are small entities.

D. Projected Reporting, Recordkeeping, and Other Compliance 
Requirements, Including Classes of Covered Small Entities and 
Professional Skills Needed To Comply

    Under the final rule, NCRAs will have to provide free electronic 
credit monitoring services to active duty military consumers. There are 
no reporting or recordkeeping requirements, or types of professional 
skills necessary for preparation of any such report or record, under 
the rule. In any event, as noted earlier, the final rule applies only 
to NCRAs, and they are not small entities.

E. Significant Alternatives to the Final Rule

    The Commission has not identified any particular alternative 
methods of compliance as necessary to reduce burdens on small entities, 
because the Commission does not believe any NCRAs subject to the final 
rule are small entities, as noted earlier.
    Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), 
the Office of Information and Regulatory Affairs designated this rule 
as not a ``major rule,'' as defined by 5 U.S.C. 804(2).

[[Page 31191]]

List of Subjects in 16 CFR Part 609

    Consumer reporting agencies, Consumer reports, Credit, Fair Credit 
Reporting Act, Trade practices.

    Accordingly, the Federal Trade Commission amends title 16, chapter 
I, subchapter F, of the Code of Federal Regulations as follows:

0
1. Revise the heading of subchapter F to read as follows:

SUBCHAPTER F--FAIR CREDIT REPORTING ACT

0
2. Add part 609 to subchapter F to read as follows:

PART 609--FREE ELECTRONIC CREDIT MONITORING FOR ACTIVE DUTY 
MILITARY

Sec.
609.1 Scope of regulations in this part.
609.2 Definitions.
609.3 Requirement to provide free electronic credit monitoring 
service.
609.4 Timing of electronic credit monitoring notices.
609.5 Additional information to be included in electronic credit 
monitoring notices.
609.6 Severability.

    Authority: 15 U.S.C. 1681c-1(k).


Sec.  [thinsp]609.1   Scope of regulations in this part.

    This part implements Section 605A(k)(2) of the Fair Credit 
Reporting Act, 15 U.S.C. 1681c-1(k)(2), which requires consumer 
reporting agencies that compile and maintain files on consumers on a 
nationwide basis to provide a free electronic credit monitoring service 
to active duty military consumers that, at a minimum, notifies them of 
any material additions or modifications to their files.


Sec.  [thinsp]609.2   Definitions.

    For purposes of this part, the following definitions apply:
    (a) Active duty military consumer means:
    (1) A consumer in military service as defined in 15 U.S.C. 
1681a(q)(1); or
    (2) A member of the National Guard as defined in 10 U.S.C. 101(c).
    (b) Appropriate proof of identity has the meaning set forth in 12 
CFR 1022.123.
    (c) Consumer has the meaning provided in 15 U.S.C. 1681a(c).
    (d) Consumer report has the meaning provided in 15 U.S.C. 1681a(d).
    (e) Contact information means information about a consumer, such as 
a consumer's first and last name and email address, that is reasonably 
necessary to collect in order to provide the electronic credit 
monitoring service.
    (f) Credit has the meaning provided in 15 U.S.C. 1681a(r)(5).
    (g) Electronic credit monitoring service means a service through 
which nationwide consumer reporting agencies provide, at a minimum, 
electronic notification of material additions or modifications to a 
consumer's file and following a notification, access to all information 
in the consumer's file at the nationwide consumer reporting agency at 
the time of the notification, in accordance with 15 U.S.C. 1681g(a).
    (h) Electronic notification means:
    (1) A notice provided to the consumer via:
    (i) Mobile application;
    (ii) Email; or
    (iii) Text message;
    (2) If the notice in paragraph (h)(1) of this section does not 
inform the consumer of the specific material addition or modification 
that has been made, such notice must link to a website that provides 
that information.
    (i) File has the meaning provided in 15 U.S.C. 1681a(g).
    (j) Firm offer of credit has the meaning provided in 15 U.S.C. 
1681a(l).
    (k) Free means provided at no cost to the consumer.
    (l) Material additions or modifications means significant changes 
to a consumer's file, including:
    (1) New accounts opened in the consumer's name, including new 
collection accounts;
    (2) Inquiries or requests for a consumer report;
    (i) However, an inquiry made for a prescreened list obtained for 
the purpose of making a firm offer of credit or insurance as described 
in 15 U.S.C. 1681b(c)(1)(B) or for the purpose of reviewing or 
collecting an account of the consumer shall not be considered a 
material addition or modification.
    (ii) [Reserved]
    (3) Material changes to a consumer's address;
    (4) Changes to credit account limits of $100 or greater; and
    (5) Negative information.
    (m) Nationwide consumer reporting agency has the meaning provided 
in 15 U.S.C. 1681a(p).
    (n) Negative information means accounts furnished to the nationwide 
consumer reporting agencies as more than 30 days delinquent, accounts 
furnished to the nationwide consumer reporting agencies as being 
included in bankruptcy petition filings, and new public records, 
including, but not limited to, bankruptcy filings, civil court 
judgments, foreclosures, liens, and convictions.


Sec.  609.3   Requirement to provide free electronic credit monitoring 
service.

    (a) General requirements. Nationwide consumer reporting agencies 
must provide a free electronic credit monitoring service to active duty 
military consumers.
    (b) Determining whether a consumer must receive electronic credit 
monitoring service. Nationwide consumer reporting agencies may 
condition provision of the service required under paragraph (a) of this 
section upon the consumer providing:
    (1) Appropriate proof of identity;
    (2) Contact information; and
    (3) Appropriate proof that the consumer is an active duty military 
consumer.
    (c) Appropriate proof of active duty military consumer status. (1) 
A consumer's status as an active duty military consumer can be verified 
through:
    (i) A method or service approved by the Department of Defense; or
    (ii) A certification of active duty military consumer status 
approved by the nationwide consumer reporting agency.
    (2) Provided, however, that the procedures a nationwide consumer 
reporting agency uses to determine appropriate proof of active duty 
military consumer status must include methods that allow all eligible 
consumers to enroll. A nationwide consumer reporting agency shall be 
deemed in compliance with paragraph (c) of this section if it provides 
free electronic credit monitoring services to:
    (i) Consumers who self-certify active duty status, as defined in 10 
U.S.C. 101(d);
    (ii) Consumers who self-certify that they are a reservist 
performing duty under a call or order to active duty under a provision 
of law referred to in 10 U.S.C. 101(a)(13); and
    (iii) Consumers who self-certify that they are a member of the 
National Guard, as defined in 10 U.S.C. 101(c).
    (3) A nationwide consumer reporting agency's verification of active 
duty military consumer status is valid for two years. After the 
expiration of the two-year period, the nationwide consumer reporting 
agency may require the consumer to provide proof that the consumer 
continues to be an active duty military consumer in accordance with 
paragraphs (c)(1) and (2) of this section.
    (d) Information use and disclosure. Any information collected from 
consumers as a result of a request to obtain the service required under 
paragraph (a) of this section, may be used or disclosed by the 
nationwide consumer reporting agency only:
    (1) To provide the free electronic credit monitoring service 
requested by the consumer;

[[Page 31192]]

    (2) To process a transaction requested by the consumer at the same 
time as a request for the free electronic credit monitoring service;
    (3) To comply with applicable legal requirements; or
    (4) To update information already maintained by the nationwide 
consumer reporting agency for the purpose of providing consumer 
reports, provided that the nationwide consumer reporting agency uses 
and discloses the updated information subject to the same restrictions 
that would apply, under any applicable provision of law or regulation, 
to the information updated or replaced.
    (e) Communications surrounding enrollment in electronic credit 
monitoring service. (1) Once a consumer is in the process of accessing 
the ability to enroll in the service required under paragraph (a) of 
this section and only during the enrollment process, any advertising or 
marketing for products or services, or any communications or 
instructions that advertise or market any products and services, must 
be delayed until after the consumer has enrolled in that service.
    (2) Any communications, instructions, or permitted advertising or 
marketing shall not interfere with, detract from, contradict, or 
otherwise undermine the purpose of providing a free electronic credit 
monitoring service to active duty military consumers that notifies them 
of any material additions or modifications to their files.
    (3) Examples of interfering, detracting, inconsistent, and/or 
undermining communications include:
    (i) Materials that represent, expressly or by implication, that an 
active duty military consumer must purchase a paid product or service 
in order to receive the service required under paragraph (a) of this 
section; or
    (ii) Materials that falsely represent, expressly or by implication, 
that a product or service offered ancillary to receipt of the free 
electronic credit monitoring service, such as identity theft insurance, 
is free, or that fail to clearly and prominently disclose that 
consumers must cancel a service, advertised as free for an initial 
period of time, to avoid being charged, if such is the case.
    (f) Other prohibited practices. A nationwide consumer reporting 
agency shall not ask or require an active duty military consumer to 
agree to terms or conditions in connection with obtaining a free 
electronic credit monitoring service, other than those terms or 
conditions required to comply with applicable legal requirements.


Sec.  [thinsp]609.4   Timing of electronic credit monitoring notices.

    The notice required in Sec.  609.3(a) must be provided within 48 
hours of any material additions or modifications to a consumer's file.


Sec.  [thinsp]609.5  Additional information to be included in 
electronic credit monitoring notices.

    (a) The notice required in Sec.  609.3(a), or the first page within 
the electronic credit monitoring service to which the notice may direct 
the consumer, shall include a hyperlink to a summary of the consumer's 
rights under the Fair Credit Reporting Act, as prescribed by the Bureau 
of Consumer Financial Protection under 15 U.S.C. 1681g(c).
    (b) The nationwide consumer reporting agency shall provide to a 
consumer, with each file disclosure provided in Sec.  609.3(a), the 
summary of the consumer's rights under the Fair Credit Reporting Act, 
as prescribed by the Bureau of Consumer Financial Protection under 15 
U.S.C. 1681g(c).


Sec.  [thinsp]609.6   Severability.

    The provisions of this part are separate and severable from one 
another. If any provision is stayed, or determined to be invalid, it is 
the Commission's intention that the remaining provisions shall continue 
in effect.

    By direction of the Commission.
April J. Tabor,
Acting Secretary.
[FR Doc. 2019-13598 Filed 6-28-19; 8:45 am]
BILLING CODE 6750-01-P

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.