As mentioned last month, I was alarmed while listening to a presentation by Paul Metry and Smitha Koppuzha of the National Automobile Dealers Assn.'s Legal and Regulatory Group.
They outlined the legal responsibility that dealerships have concerning federal regulations on identity theft and privacy issues. They also covered penalties for non-compliance with the Fair and Accurate Credit Transactions (FACT) Act of 2003.
The provisions of this one piece of legislation that affect car dealers are so far reaching that I reviewed part of the FACT Act last month and the rest this month.
Remember that with this and certain other legislation and rulings, auto dealerships meet the definition of a “financial institution.”
The new law amends the Fair Credit Reporting Act and continues its preemption over state law.
The FACT Act also imposes several new duties. Many of these are designed to prevent identity theft, others to enhance the accuracy of consumer reports and to provide consumers greater control over the marketing solicitations they receive.
Disposal of Consumer Report Info
This rule requires reasonable measures to protect against unauthorized access to, or use of, consumer information in connection with its disposal.
Entities need to develop, implement and monitor compliance with policies and procedures for disposal of consumer information.
Examples of “reasonable measures” are burning, pulverizing, shredding of papers with consumer info and destruction or erasure of electronic media with consumer info. Entities complying with the Federal Trade Commission Safeguards Rule should incur few if any, additional compliance costs.
Furnishing Negative Information
Beginning December 1, 2004, a financial institution that regularly furnishes information to credit reporting agency must notify a consumer no later than 30 days after it provides negative information regarding credit extended to that consumer.
The notice may not be combined with initial Truth in Lending Act disclosures. The Federal Reserve Board has developed two model notices for this purpose. Safe Harbor protection exists for financial institutions that properly use the model notices.
Issuing Risk-Based Pricing Notices
If you grant credit to a customer on terms that are materially less favorable than the most favorable terms available to a substantial proportion of your other credit customers, based in whole or in part from information contained in a consumer report, you must give the customer a notice in the form and manner prescribed by the Federal Reserve Board and the Federal Trade Commission.
The notice is not required for consumers to whom credit was granted on the “specific material terms” applied for (this exception does not apply if the creditor specified terms only after the consumer initiated the transaction and the creditor obtained a consumer report), or the creditor has or will issue an adverse action notice under the Fair Credit Reporting Act.
At a minimum, the notice must:
- State that credit terms offered are based on info from a consumer report
- Identify credit reporting agency furnishing the report
- State that consumer may obtain free copy of consumer report from that agency
- Provide agency's contact info for obtaining the report
A creditor is not liable for failing to issue riski-based pricing notices if, at the time of the failure, it maintained reasonable policies and procedures to comply with this duty. Violations of this section may result in administrative enforcement by the trade commission.
Reconciling Different Addresses
Credit-reporting agencies must notify users when the address of a customer for whom the user has ordered a consumer report differs from the address they have on file for the customer. Users must develop reasonable policies and procedures to form a reasonable belief that they know the identity of such customers.
Don E. Ray is a CPA with the Dixon Hughes Dealer Services Group. He's at 901-684-5643 and [email protected].
