Summary of Your Rights
Under the Fair Credit Reporting Act (FCRA), PIPEDA, and GDPR
Your Rights Under the Fair Credit Reporting Act (FCRA)
The federal Fair Credit Reporting Act (FCRA) promotes the accuracy, fairness, and privacy of information in the files of consumer reporting agencies. The following is a summary of your major rights under the FCRA:
- You must be told if information in your file has been used against you. Anyone who uses a credit report or another type of consumer report to deny your application for credit, insurance, or employment — or to take another adverse action against you — must tell you, and must give you the name, address, and phone number of the agency that provided the information.
- You have the right to know what is in your file. You may request and obtain all the information about you in the files of a consumer reporting agency. You will be required to provide proper identification.
- You have the right to ask for a credit score. Credit scores are numerical summaries of your credit-worthiness based on information from credit bureaus.
- You have the right to dispute incomplete or inaccurate information. If you identify information in your file that is incomplete or inaccurate, and report it to the consumer reporting agency, the agency must investigate unless your dispute is frivolous.
- Consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information. Inaccurate, incomplete, or unverifiable information must be removed or corrected, usually within 30 days.
- Consumer reporting agencies may not report outdated negative information. In most cases, a consumer reporting agency may not report negative information that is more than seven years old, or bankruptcies that are more than 10 years old.
- Access to your file is limited. A consumer reporting agency may provide information about you only to people with a valid need — usually to consider an application with a creditor, insurer, employer, landlord, or other business.
- You must give your consent for reports to be provided to employers. A consumer reporting agency may not give out information about you to your employer, or a potential employer, without your written consent.
- You may limit "prescreened" offers of credit and insurance you get based on information in your credit report.
- You may seek damages from violators. If a consumer reporting agency, or in some cases a user of consumer reports or a furnisher of information to a consumer reporting agency, violates the FCRA, you may be able to sue in state or federal court.
- You have the right to obtain a free report within 60 days of receiving an adverse action notice based on information in a consumer report.
For more information: Visit www.consumerfinance.gov/learnmore or contact the Federal Trade Commission.
Additional Rights by Jurisdiction
Canada (PIPEDA)
Under the Personal Information Protection and Electronic Documents Act, you have the right to:
- Know why your personal information is being collected
- Expect your information to be collected, used, or disclosed only for reasonable purposes
- Withdraw your consent at any time (subject to legal restrictions)
- Access your personal information and challenge its accuracy
- File a complaint with the Privacy Commissioner of Canada
EU/UK (GDPR)
Under the General Data Protection Regulation, you have the right to:
- Access your personal data (Right of Access)
- Rectify inaccurate data (Right to Rectification)
- Erase your data (Right to be Forgotten)
- Restrict processing (Right to Restriction)
- Data portability (Right to Data Portability)
- Object to processing (Right to Object)
- Lodge a complaint with a supervisory authority
How to Dispute Information or Exercise Your Rights
If you believe any information in a consumer report about you is inaccurate or incomplete, or if you wish to exercise any of the rights described above, please contact us at:
disputes@indicia.confidion.com
We will respond to all disputes and data subject requests within the timeframes required by applicable law (typically 30 days under FCRA, 30 days under PIPEDA, and 30 days under GDPR).