Question & Answer

Question: Sometimes when making a business loan decision, we want to review credit reports on the owners of the business. This would involve pulling a consumer report from the credit bureau we use for consumer lending. If we do this, is it covered by the FCRA? Do we need the customer's written permission to obtain the report?

Answer: This falls into a murky area of FCRA. There isn't an absolute answer, but there is some best advice. First, the FCRA does not contain a consumer/business purpose test. The Act operates by forbidding a consumer reporting agency from furnishing a consumer report except under certain circumstances. For purposes of your question, two purposes could apply. First, the consumer reporting agency may furnish the report "to a person which it has reason to believe intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to?the consumer." Second, the consumer reporting agency may furnish the report "in accordance with the written instructions of the consumer to whom it relates."

Let's look closely at the first permissible purpose. Without question, the information is being used in connection with a credit transaction involving the consumer. Routine consumer credit applications fall squarely into this permissible purpose. The business loan application is somewhat different. For starters, the consumer is not the applicant - the business is. Although the consumer is not actually the applicant, the consumer is arguably involved in the transaction. But, the credit is not being extended to the consumer. It will be extended to the business. So this permissible purpose doesn't clearly apply. And if the circumstances don't fit the permissible purpose, we can't get the credit report!

Although the first circumstance is murky, the second circumstance clearly can be used. Written permission from the consumer clearly establishes a permissible purpose. That's why the pundits in this field recommend getting the signature of the individual who is involved in the business credit application. We agree with the pundits. Not only that, the FTC staff told us that getting the signature is the best course to follow.

Commercial lenders aren't going to like this one. But remember, we are dealing with privacy - a topic that is volatile and highly political. It isn't worth it to make mistakes in this area. Mistakes will end up on the news, in the examination report, or in Congress - where compliance comes from!

Copyright © 1997 Compliance Action. Originally appeared in Compliance Action, Vol. 2, No. 14, 12/97