Privacy Atlas

15 U.S.C. §§ 1681–1681x

Fair Credit Reporting Act

In force since April 25, 1971

Access / know — grantedObtain the personal data held about you, and the categories, sources and purposes behind it.
Correction — grantedRequire inaccurate personal data to be fixed.
Deletion / erasure — not granted
Portability — not granted
Opt out of sale / sharing — not granted
Opt out of targeted advertising — not granted
Opt out of profiling — not granted
Limit sensitive data use — not granted
Human review of automated decisions — not granted
Non-discrimination — not granted
Appeal a refusal — not granted
Private right of action — grantedSue directly, rather than relying on a regulator to enforce on your behalf.

Consent model: Opt-in
Universal opt-out signal: Not required
Risk assessments: Not required
Data protection officer: Not required
Records of processing: Not required
Processor contract: Not required
Right to cure: None — enforcement may follow immediately
Data broker registration: Not required
Automated decisions: Adverse action notices must be given when a consumer report contributes to a denial, which is the oldest automated-decision transparency duty in US law.

Headline: Actual damages, or statutory damages of $100–$1,000 for wilful non-compliance
Private right of action: Yes — individuals can sue directly
Notes: Punitive damages and attorney's fees are available for wilful violations, which makes the FCRA one of the most litigated privacy statutes in the United States.

December 4, 2003
FACTA
Added free annual file disclosures, fraud alerts and identity-theft provisions.

Timeline