Consumer Credit Control Act of 2021
This bill requires a consumer's affirmative informed consent before a consumer reporting agency may share that consumer's report with third parties for specified purposes. A consumer reporting agency must verify a consumer's identity when obtaining this consent. (Currently, this sharing is generally allowed unless a consumer opts out.)
If the consumer provides consent, a consumer reporting agency may share information with a third party for an extension of credit or the underwriting of insurance.
Additionally, in connection with transactions not initiated by the consumer, a consumer reporting agency may provide a consumer report with the consumer's consent only if the transaction consists of a firm offer of credit or insurance.
Furthermore, consumer reporting agencies may not charge consumers fees in connection with furnishing consumer reports.
The bill also requires consumer reporting agencies to use reasonable efforts to prevent data breaches of consumer reports.
The Government Accountability Office must report on how best to protect information collected in consumer files.
To amend the Fair Credit Reporting Act to require that a consumer 
             authorize the release of certain information.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Consumer Credit Control Act of 
2021''.

SEC. 2. PERMISSIBLE PURPOSES OF REPORTS.

    (a) In General.--The Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.) is amended--
            (1) in section 604 (15 U.S.C. 1681b)--
                    (A) by striking subsections (c) through (e) and 
                inserting the following:
    ``(c) Conditions for Furnishing Certain Consumer Reports.--
            ``(1) In general.--A consumer reporting agency may furnish 
        a consumer report for the following purposes only if the 
        consumer reporting agency obtains affirmative informed consent 
        of the consumer to furnish the consumer report and the consumer 
        reporting agency verifies the identity of the consumer by 
        reviewing the proper identification required under section 610:
                    ``(A) An extension of credit pursuant to subsection 
                (a)(3)(A).
                    ``(B) The underwriting of insurance pursuant to 
                subsection (a)(3)(C).
            ``(2) Additional reports; election.--After the consumer 
        reporting agency obtains affirmative informed consent of the 
        consumer and verifies the identity of the consumer under 
        paragraph (1), the consumer reporting agency may continue to 
        furnish consumer reports solely for the purposes of reviewing 
        or collecting on an account described in subparagraphs (A) and 
        (C) of subsection (a)(3).
            ``(3) Furnishing reports in connection with credit or 
        insurance transactions that are not initiated by consumer.--
                    ``(A) In general.--A consumer reporting agency may 
                furnish a consumer report to a person in connection 
                with any credit or insurance transaction under 
                subparagraph (A) or (C) of subsection (a)(3) that is 
                not initiated by the consumer only if--
                            ``(i) the consumer reporting agency obtains 
                        affirmative informed consent of the consumer to 
                        furnish the consumer report and the consumer 
                        reporting agency verifies the identity of the 
                        consumer by reviewing the proper identification 
                        required under section 610; and
                            ``(ii) the transaction consists of a firm 
                        offer of credit or insurance.
                    ``(B) Election.--The consumer may elect to--
                            ``(i) have the consumer's name and 
                        addresses included in lists of names and 
                        addresses provided by the consumer reporting 
                        agency pursuant to subparagraphs (A) and (C) of 
                        subsection (a)(3) in connection with any credit 
                        or insurance transaction that is not initiated 
                        by the consumer only if--
                                    ``(I) the consumer reporting agency 
                                obtains affirmative informed consent of 
                                the consumer to furnish the consumer 
                                report and the consumer reporting 
                                agency verifies the identity of the 
                                consumer by reviewing the proper 
                                identification required under section 
                                610; and
                                    ``(II) the transaction consists of 
                                a firm offer of credit or insurance; 
                                and
                            ``(ii) revoke at any time the election 
                        pursuant to clause (i) to have the consumer's 
                        name and address included in lists provided by 
                        a consumer reporting agency.
                    ``(C) Information regarding inquiries.--Except as 
                provided in section 609(a)(5), a consumer reporting 
                agency shall not furnish to any person a record of 
                inquiries in connection with a credit or insurance 
                transaction that is not initiated by a consumer.
            ``(4) Disclosures.--
                    ``(A) In general.--A person may not procure a 
                consumer report for any purpose pursuant to 
                subparagraphs (D), (F), and (G) of subsection (a)(3) 
                unless--
                            ``(i) a simple and easy to understand, as 
                        defined in section 1022.54(b) of title 12, Code 
                        of Federal Regulations, as in effect on the 
                        date of enactment of the Consumer Credit 
                        Control Act of 2021, disclosure has been made 
                        to the consumer at any time before the report 
                        is procured or caused to be procured, that 
                        consists solely of the disclosure and the 
                        opportunity to provide the consent described in 
                        clause (ii), that a consumer report may be 
                        obtained for such purposes; and
                            ``(ii) the person has obtained affirmative 
                        informed consent of the consumer for the 
                        procurement of the consumer report by that 
                        person.
                    ``(B) Authorizations.--The consent described in 
                subparagraph (A)(ii) shall be provided on the 
                disclosure described under subparagraph (A)(i).
            ``(5) Rule making.--Not later than 270 days after the date 
        of enactment of the Consumer Credit Control Act of 2021, the 
        Director of the Bureau shall promulgate regulations that--
                    ``(A) implement this subsection;
                    ``(B) establish a model form for the disclosure 
                document pursuant to paragraph (4);
                    ``(C) permit consumers to provide affirmative 
                informed consent required by paragraph (1) for a 
                specific time period for multiple users for the 
                specified purpose during that time period;
                    ``(D) require a consumer reporting agency--
                            ``(i) to provide to each consumer a secure, 
                        convenient, accessible, and cost-free method, 
                        including by toll-free telephone or secure 
                        electronic means, by which a consumer may--
                                    ``(I) provide or revoke any 
                                affirmative informed consent pursuant 
                                to this subsection; and
                                    ``(II) make or revoke any election 
                                pursuant to paragraph (3)(B);
                            ``(ii) to implement any provision or 
                        revocation of affirmative informed consent 
                        pursuant to this subsection not later than 1 
                        business day after the date on which a consumer 
                        provides or revokes affirmative informed 
                        consent; and
                            ``(iii) to implement any election or 
                        revocation of any election pursuant to 
                        paragraph (3)(B) not later than 1 business day 
                        after the date on which a consumer makes or 
                        revokes an election; and
                    ``(E) define what constitutes affirmed informative 
                consent in the manner that provides the greatest 
                protection to consumers.
            ``(6) Prohibitions.--
                    ``(A) In general.--The method described in 
                paragraph (5)(D) shall not be used to--
                            ``(i) collect any information on a consumer 
                        that is not necessary for the purpose of the 
                        consumer to allow or disallow the furnishing of 
                        consumer reports; or
                            ``(ii) advertise any product or service.
                    ``(B) No waiver.--In the offering of a method 
                described in paragraph (5)(D), a consumer reporting 
                agency shall not require a consumer to waive any rights 
                nor indemnify the consumer reporting agency from any 
                liabilities arising from the offering of such method.
            ``(7) Reports.--
                    ``(A) CFPB.--
                            ``(i) Recommendation.--Not later than 270 
                        days after the date of enactment of the 
                        Consumer Credit Control Act of 2021, the 
                        Director of the Bureau shall, after 
                        consultation with the Federal Deposit Insurance 
                        Corporation, the National Credit Union 
                        Administration, the Consumer Advisory Board, 
                        and other Federal and State regulators as the 
                        Director of the Bureau determines are 
                        appropriate, submit to the Committee on 
                        Banking, Housing, and Urban Affairs of the 
                        Senate and the Committee on Financial Services 
                        of the House of Representatives recommendations 
                        on how to provide consumers greater 
                        transparency and personal control over their 
                        consumer reports furnished for permissible 
                        purposes under subsections (a)(3)(E) and 
                        (a)(6).
                            ``(ii) Report.--The Director of the Bureau 
                        shall submit to the Committee on Banking, 
                        Housing, and Urban Affairs of the Senate and 
                        the Committee on Financial Services of the 
                        House of Representatives an annual report that 
                        includes--
                                    ``(I) recommendations on how this 
                                subsection may be improved;
                                    ``(II) a description of efforts to 
                                educate consumers of their rights under 
                                this subsection;
                                    ``(III) a description of 
                                enforcement actions taken to 
                                demonstrate compliance with this 
                                subsection;
                                    ``(IV) recommendations on how to 
                                improve oversight of consumer reporting 
                                agencies and users of consumer reports; 
                                and
                                    ``(V) any other recommendations 
                                concerning how consumers may be 
                                provided greater transparency and 
                                control over their personal 
                                information.
                    ``(B) GAO.--
                            ``(i) Study.--The Comptroller General of 
                        the United States shall conduct a study on what 
                        additional protections or restrictions may be 
                        needed to ensure that the information collected 
                        in consumer files is secure and does not 
                        adversely impact consumers.
                            ``(ii) Report.--Not later than 1 year after 
                        the date of enactment of the Consumer Credit 
                        Control Act of 2021, the Comptroller General of 
                        the United States shall submit to the Committee 
                        on Banking, Housing, and Urban Affairs of the 
                        Senate and the Committee on Financial Services 
                        of the House of Representatives a report on the 
                        results of the study under clause (i), which 
                        shall include--
                                    ``(I) to the greatest extent 
                                possible, the presentation of 
                                unambiguous conclusions and specific 
                                recommendations for further legislative 
                                changes needed to ensure that the 
                                information collected in consumer files 
                                is secure and does not adversely impact 
                                consumers; and
                                    ``(II) if no recommendations for 
                                further legislative changes are 
                                presented, a detailed explanation of 
                                why no such changes are recommended.'';
                    (B) by redesignating subsections (f) and (g) as 
                subsections (d) and (e), respectively; and
                    (C) by adding at the end the following:
    ``(f) No Fees.--No consumer reporting agency may charge a consumer 
any fee for any activity pursuant to or as a result of this section.'';
            (2) in section 607(a) (15 U.S.C. 1681e(a))--
                    (A) in the third sentence, by striking ``make a 
                reasonable effort'' and inserting ``use commercially 
                reasonable efforts''; and
                    (B) by inserting ``Every consumer reporting agency 
                shall use commercially reasonable efforts to avoid 
                unauthorized access to consumer reports and information 
                in the file of a consumer maintained by the consumer 
                reporting agency, including complying with any 
                appropriate standards established under section 501(b) 
                of the Gramm-Leach-Bliley Act (15 U.S.C. 6801(b)).'' 
                after the end of the third sentence;
            (3) in section 609 (15 U.S.C. 1681g), by striking 
        subsection (b) and inserting the following:
    ``(b) Scope of Disclosure.--The Director of the Bureau shall 
promulgate regulations to clarify that any disclosure required by 
subsection (a) shall be made to the consumer when a consumer makes a 
request, irrespective of whether the information required to be 
disclosed is held by the parent, subsidiary, or affiliate of a consumer 
reporting agency.''; and
            (4) in section 610(a)(1) (15 U.S.C. 1681h(a)(1))--
                    (A) by inserting ``, implementing the provision or 
                revocation of any affirmative informed consent, or 
                implementing any election or revocation of any 
                election'' after ``disclosures''; and
                    (B) by striking ``section 609'' and inserting 
                ``sections 604 and 609''.
    (b) Technical and Conforming Amendments.--The Fair Credit Reporting 
Act (15 U.S.C. 1681 et seq.) is amended--
            (1) in section 603(d)(3) (15 U.S.C. 1681a(d)(3)), in the 
        matter preceding subparagraph (A), by striking ``604(g)(3)'' 
        and inserting ``604(e)(3)'';
            (2) in section 605A (15 U.S.C. 1681c-1)--
                    (A) by striking subsections (i) and (j); and
                    (B) by redesignating subsection (k) as subsection 
                (i);
            (3) in section 615(d) (15 U.S.C. 1681m(d))--
                    (A) in paragraph (1)--
                            (i) in the matter preceding subparagraph 
                        (A), by striking ``604(c)(1)(B)'' and inserting 
                        ``604(c)(3)(A)(ii)''; and
                            (ii) in subparagraph (E), by striking 
                        ``604(e)'' and inserting ``604(c)(5)(D)''; and
                    (B) in paragraph (2)(A), by striking ``604(e)'' and 
                inserting ``604(c)(5)(D)''; and
            (4) in section 625(b)(1) (15 U.S.C. 1681t(b)(1))--
                    (A) in subparagraph (A), by striking ``subsection 
                (c) or (e) of section 604'' and inserting 
                ``604(c)(3)'';
                    (B) in subparagraph (I), by adding ``or'' at the 
                end;
                    (C) by striking subparagraph (J); and
                    (D) by redesignating subparagraph (K) as 
                subparagraph (J).
    (c) Applicability.--The amendments made by subsections (a) and (b) 
shall apply to a consumer report, as defined in section 603 of the Fair 
Credit Reporting Act (15 U.S.C. 1681a), furnished after the earlier 
of--
            (1) the date on which the rules issued by the Bureau of 
        Consumer Financial Protection under subsection (c)(5) of 
        section 604 of the Fair Credit Reporting Act, as amended by 
        subsection (a) of this section, require compliance; and
            (2) the date that is 18 months after the date of enactment 
        of this Act.
                                 <all>
Consumer Credit Control Act of 2021
A bill to amend the Fair Credit Reporting Act to require that a consumer authorize the release of certain information.
Consumer Credit Control Act of 2021
Sen. Reed, Jack