(a) Short title.—This Act may be cited as the “Protecting Your Credit Score Act of 2019”.

(b) Table of contents.—The table of contents for this Act is as follows:

Sec. 1. Short title; table of contents.
Sec. 2. Establishment of online consumer portal landing page for consumer access to certain credit information.
Sec. 3. Accuracy in consumer reports.
Sec. 4. Improved Dispute Process for Consumer Reporting Agencies.
Sec. 5. Injunctive relief.
Sec. 6. Increased transparency.
Sec. 7. Consumer reporting agency registry.
Sec. 8. Authority of Bureau with respect to consumer reporting agencies.
Sec. 9. Bureau standards for protecting nonpublic information.
Sec. 10. Report on data security risk assessments in examinations of consumer reporting agencies.
Sec. 11. GAO study on the use of social security numbers.

(a) In general.—Section 612(a)(1) of the Fair Credit Reporting Act (15 U.S.C. 1681j(a)(1)) is amended by adding at the end the following:

“(D) ONLINE CONSUMER PORTAL LANDING PAGE.—

“(i) IN GENERAL.—Not later than 1 year after the date of enactment of this subparagraph, each consumer reporting agency described in section 603(p) shall jointly develop an online consumer portal landing page that gives each consumer unlimited free access to—

“(I) the consumer report of the consumer;

“(II) the means by which the consumer may exercise the rights of the consumer under subparagraph (E) and section 604(e);

“(III) the ability to initiate a dispute with the consumer reporting agency regarding the accuracy or completeness of any information in a report in accordance with section 611(a) or 623(a)(8);

“(IV) the ability to place and remove a security freeze on a consumer report for free under section 605A(i) and (j);

“(V) if the consumer reporting agency offers a product to consumers to prevent access to the consumer report of the consumer for the purpose of preventing identity theft, a disclosure to the consumer regarding the differences between that product and a security freeze as defined under section 605A(i) or (j);

“(VI) information on who has accessed the consumer report of the consumer over the last 24 months, and, as available, for what permissible purpose the consumer report was furnished in accordance with section 604 and section 609; and

“(VII) the credit score of the consumer in accordance with section 609(f)(7).

“(ii) NO WAIVER.—A consumer reporting agency described in section 603(p) may not require a consumer to waive any legal or privacy rights to access—

“(I) a portal established under this subparagraph; or

“(II) any of the services described in clause (i) that are provided through a portal established under this subparagraph.

“(iii) NO ADVERTISING OR SOLICITATIONS.—A portal established under this subparagraph may not contain any advertising, marketing offers, or other solicitations.

“(iv) EXTENSION.—The Bureau may allow the consumer reporting agencies an extension of 1 year to develop the online consumer portal landing page required under clause (i).

“(v) RULE OF CONSTRUCTION.—Nothing in this subparagraph may be construed as requiring a consumer reporting agency to disclose confidential proprietary information through the online consumer portal landing page.

“(E) OPT-OUT OPTIONS.—

“(i) IN GENERAL.—If a consumer reporting agency sells consumer information in a manner that is not included in a consumer report, the consumer reporting agency shall provide each consumer with a method (through a website, by phone, or in writing) by which the consumer may elect, free of charge, to not have the information of the consumer so sold.

“(ii) NO EXPIRATION.—An election made by a consumer under clause (i) shall expire on the date on which the consumer expressly revokes the election through a website, by phone, or in writing.”.

(b) Conforming amendment.—Section 612(f)(1) of the Fair Credit Reporting Act (15 U.S.C. 1681j(f)(1)) is amended, in the matter preceding subparagraph (A), by adding “or that is made through the online consumer portal landing page established under subsection (a)(1)(D),” after “subsections (a) through (d),”.

Section 607(b) of the Fair Credit Reporting Act (15 U.S.C. 1681e) is amended to read as follows:

“(b) Ensuring accuracy.—

“(1) IN GENERAL.—In preparing a consumer report, each consumer reporting agency shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the consumer to whom the report relates.

“(2) MATCHING INFORMATION IN A FILE.—In assuring the maximum possible accuracy under paragraph (1), each consumer reporting agency described in section 603(p) shall ensure that, when including information in the file of a consumer, the consumer reporting agency—

“(A) matches all 9 digits of the social security number of the consumer with the information that the consumer reporting agency is including in the file; or

“(B) if a consumer does not have a social security number, matches information that includes the full legal name, date of birth, current address, and at least one former address of the consumer.

“(3) PERIODIC AUDITS.—Each consumer reporting agency shall perform periodic audits, on a schedule determined by the Bureau, on a representative sample of consumer reports of the agency to check for accuracy.”.

(a) Responsibilities of furnishers of information to consumer reporting agencies.—Section 623 of the Fair Credit Reporting Act (15 U.S.C. 1681s–2) is amended—

(1) in subsection (a)(8)—

(A) in subparagraph (E)(ii), by inserting “and consider” after “review”; and

(B) in subparagraph (F)—

(i) in clause (i)(II), by inserting “, and does not include any new or additional information that would be relevant to a reinvestigation” before the period at the end; and

(ii) by adding at the end the following new clause:

“(iv) NEW OR ADDITIONAL INFORMATION.—For purposes of clause (i)(II), the term ‘new or additional information’—

“(I) means information of a type designated by the Bureau; and

“(II) does not include information previously provided to the person.”; and

(2) in subsection (b)(1), by inserting “and consider” after “review”.

(b) Bureau credit reporting ombudsperson.—Section 611(a) of the Fair Credit Reporting Act (15 U.S.C. 1681i(a)) is amended by adding at the end the following:

“(8) BUREAU CREDIT REPORTING OMBUDSPERSON.—

“(A) IN GENERAL.—Not later than 180 days after the date of enactment of this paragraph, the Bureau shall establish the position of credit reporting ombudsperson, whose specific duties shall include carrying out the Bureau’s responsibilities with respect to—

“(i) resolving persistent errors that are not resolved in a timely manner by a consumer reporting agency; and

“(ii) enhancing oversight of consumer reporting agencies by—

“(I) advising the Director of the Bureau, in consultation with the Office of Enforcement and the Office of Supervision of the Bureau, on any potential violations of paragraph (5) or any other applicable law by a consumer reporting agency, including appropriate corrective action for such a violation; and

“(II) making referrals to the Office of Supervision for supervisory action or the Office of Enforcement for enforcement action, as appropriate, in response to violations of paragraph (5) or any other applicable law by a consumer reporting agency.

“(B) REPORT.—The ombudsperson shall submit to the Committee on Financial Services of the House of Representatives and the Committee on Banking, Housing, and Urban Affairs of the Senate an annual report including statistics and analysis on consumer complaints the Bureau receives relating to consumer reports, as well as a summary of the supervisory actions and enforcement actions taken with respect to consumer reporting agencies during the year covered by the report.”.

(c) Responsibilities of consumer reporting agencies.—Section 611 of the Fair Credit Reporting Act (15 U.S.C. 1681i) is amended—

(1) in subsection (a)—

(A) in paragraph (1), by adding at the end the following:

“(D) OBLIGATIONS OF CONSUMER REPORTING AGENCIES RELATING TO REINVESTIGATIONS.—Commensurate with the volume and complexity of disputes about which a consumer reporting agency receives notice, or reasonably anticipates to receive notice, under this paragraph, each consumer reporting agency shall—

“(i) maintain sufficient personnel to conduct reinvestigations of those disputes; and

“(ii) provide training with respect to the personnel described in clause (i).”;

(B) in paragraph (6)(B)—

(i) by amending clause (ii) to read as follows:

“(ii) a copy of the consumer’s file and a consumer report that is based upon such file as revised, including a description of the specific modification or deletion of information, as a result of the reinvestigation;”;

(ii) by striking clause (iii) and redesignating clauses (iv) and (v) as clauses (vi) and (vii), respectively;

(iii) by inserting after clause (ii) the following:

“(iii) a description of the actions taken by the consumer reporting agency regarding the dispute;

“(iv) if applicable, contact information for any furnisher involved in responding to the dispute and a description of the role played by the furnisher in the reinvestigation process;

“(v) the options available to the consumer if the consumer is dissatisfied with the result of the reinvestigation, including—

“(I) submitting documents in support of the dispute;

“(II) adding a consumer statement of dispute to the file of the consumer pursuant to subsection (b);

“(III) filing a dispute with the furnisher pursuant to section 623(a)(8); and

“(IV) submitting a complaint against the consumer reporting agency or furnishers through the consumer complaint database of the Bureau or the State attorney general for the State in which the consumer resides;”; and

(C) by striking paragraph (7) and redesignating paragraph (8) as paragraph (7); and

(D) in paragraph (7), as so redesignated, by striking “paragraphs (2), (6), and (7)” and inserting “paragraphs (2) and (6)”; and

(2) by adding at the end the following new subsection:

“(h) Notification of deletion of information.—A consumer reporting agency described in section 603(p) shall communicate with other consumer reporting agencies described in section 603(p) to ensure that a dispute initiated with one consumer reporting agency is noted in a file maintained by such other consumer reporting agencies.”.

The Fair Credit Reporting Act (15 U.S.C. 1681 et seq.) is amended—

(1) in section 616 (15 U.S.C. 1681n)—

(A) in subsection (a), by amending the subsection heading to read as follows: “Damages”;

(B) by redesignating subsections (c) and (d) as subsections (d) and (e), respectively; and

(C) by inserting after subsection (b) the following:

“(c) Injunctive relief.—

“(1) IN GENERAL.—In addition to any other remedy under this section, a court may award injunctive relief to require compliance with the requirements imposed under this title with respect to any consumer.

“(2) COSTS AND ATTORNEY’S FEES.—In the event of any successful action for injunctive relief under this subsection, a court may award to the prevailing party costs and reasonable attorney’s fees (as determined by the court) incurred by the prevailing party during the action.”; and

(2) in section 617 (15 U.S.C. 1681o)—

(A) in subsection (a), in the subsection heading, by striking “(a) In General.—” and inserting “(a) Damages.—”;

(B) by redesignating subsection (b) as subsection (c); and

(C) by inserting after subsection (a) the following:

“(b) Injunctive relief.—

“(1) IN GENERAL.—In addition to any other remedy under this section, a court may award injunctive relief to require compliance with the requirements imposed under this title with respect to any consumer.

“(2) COSTS AND ATTORNEY’S FEES.—In the event of any successful action for injunctive relief under this subsection, a court may award to the prevailing party costs and reasonable attorney’s fees (as determined by the court) incurred by the prevailing party during the action.”.

(3) ENFORCEMENT.—Section 615(h)(8) of the Fair Credit Reporting Act (15 U.S.C. 1681m(h)(8)) is amended—

(A) in subparagraph (A), by striking “section” and inserting “subsection”; and

(B) in subparagraph (B), by striking “This section” and inserting “This subsection”.

(a) Disclosures to consumers.—Section 609 of the Fair Credit Reporting Act (15 U.S.C. 1681g) is amended—

(1) in subsection (a)(3)(B)—

(A) in clause (i), by striking “and” at the end; and

(B) by striking clause (ii) and inserting the following:

“(ii) the address and telephone number of the person; and

“(iii) the permissible purpose, as available, of the person for obtaining the consumer report, including the specific type of credit product that is extended, reviewed, or collected, as described in section 604(a)(3)(A).”;

(2) in subsection (f)—

(A) by amending paragraph (7)(A) to read as follows:

“(A) supply the consumer with a credit score through the portal established under section 612(a)(1)(D) or upon request by the consumer, as applicable, that—

“(i) is derived from a credit scoring model that is widely distributed to users by that consumer reporting agency for the purpose of any extension of credit or other transaction designated by the consumer who is requesting the credit score; or

“(ii) is widely distributed to lenders of common consumer loan products and predicts the future credit behavior of the consumer; and”; and

(B) in paragraph (8), by inserting “, except that a credit score shall be provided free of charge to the consumer if requested in connection with a free annual consumer report described in section 612(a) or through the online consumer portal landing page established under section 612(a)(1)(D)” before the period at the end; and

(3) in subsection (g)(1)—

(A) in subparagraph (A)(ii)—

(i) in the clause heading, by striking “subparagraph (D)” and inserting “subparagraph (C)”; and

(ii) by striking “subparagraph (D)” and inserting “subparagraph (C)”;

(B) in subparagraph (B)(ii), by striking “consistent with subparagraph (C)”;

(C) by striking subparagraph (C); and

(D) by redesignating subparagraphs (D) through (G) as subparagraphs (C) through (F), respectively.

(b) Notification requirements.—

(1) ADVERSE INFORMATION NOTIFICATION.—

(A) IN GENERAL.—The Fair Credit Reporting Act (15 U.S.C. 1681 et seq.) is amended—

(i) in section 612 (15 U.S.C. 1681j), by striking subsection (b) and inserting the following:

“(b) Free Disclosure After Notice of Adverse Action or Offer of Credit on Materially Less Favorable Term.—Not later than 30 days after the date on which a consumer reporting agency receives a notification under subsection (a)(2) or (h)(6) of section 615, or from a debt collection agency affiliated with the consumer reporting agency, the consumer reporting agency shall make to a consumer, without charge to the consumer, all disclosures that are made to a user of a consumer report in accordance with the rules prescribed by the Bureau.”; and

(ii) in section 615(a) (15 U.S.C. 1681m(a))—

(I) by redesignating paragraphs (2), (3), and (4) as paragraphs (3), (4), and (5), respectively;

(II) by inserting after paragraph (1) the following:

“(2) direct the consumer reporting agency that provided the consumer report that was used in the decision to take the adverse action to provide the consumer with the disclosures described in section 612(b);”; and

(III) in paragraph (5), as so redesignated—

(aa) in the matter preceding subparagraph (A), by striking “of the consumer’s right”;

(bb) by striking subparagraph (A) and inserting the following:

“(A) that the consumer shall receive a copy of the consumer report with respect to the consumer, free of charge, from the consumer reporting agency that furnished the consumer report; and”; and

(cc) in subparagraph (B), by inserting “of the right of the consumer” before “to dispute”.

(B) CONFORMING AMENDMENT.—Section 604(b)(2)(B)(i) of the Fair Credit Reporting Act (15 U.S.C. 1681b(b)(2)(B)(i)) is amended by striking “section 615(a)(3)” and inserting “section 615(a)(4)”.

(2) NOTIFICATION IN CASES OF LESS FAVORABLE TERMS.—Section 615(h) of the Fair Credit Reporting Act (15 U.S.C. 1681m(h)) is amended—

(A) in paragraph (1), by striking “paragraph (6)” and inserting “paragraph (7)”;

(B) in paragraph (2), by striking “paragraph (6)” and inserting “paragraph (7)”;

(C) in paragraph (5)(C), by striking “may obtain” and inserting “shall receive”;

(D) by redesignating paragraphs (6), (7), and (8) as paragraphs (7), (8), and (9), respectively; and

(E) by inserting after paragraph (5) the following:

“(6) REPORTS PROVIDED TO CONSUMERS.—A person who uses a consumer report as described in paragraph (1) shall notify and direct the consumer reporting agency that provided the consumer report to provide the consumer with the disclosures described in section 612(b).”.

(3) NOTIFICATION OF SUBSEQUENT SUBMISSIONS OF NEGATIVE INFORMATION.—Section 623(a)(7)(A)(ii) of the Fair Credit Reporting Act (15 U.S.C. 1681s–2(a)(7)(A)(ii)) is amended by striking “with respect to” and all that follows through the period at the end and inserting “without providing additional notice to the consumer, unless another person acquires the right to repayment connected to the additional negative information. The acquiring person shall be subject to the requirements of this paragraph and shall be required to send consumers the written notices described in this paragraph, if applicable.”.

Section 621 of the Fair Credit Reporting Act (15 U.S.C. 1681s) is amended by adding at the end the following:

“(h) Consumer reporting agency registry.—

“(1) ESTABLISHMENT OF REGISTRY.—Not later than 180 days after the date of enactment of this subsection, the Bureau shall establish a publicly available registry of consumer reporting agencies that includes—

“(A) each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis;

“(B) each nationwide specialty consumer reporting agency;

“(C) all other consumer reporting agencies that are not included under section 603(p) or 603(x); and

“(D) links to any relevant websites of a consumer reporting agency described under subparagraphs (A) through (C).

“(2) REGISTRATION REQUIREMENT.—The Bureau shall establish a deadline, which shall be not later than 270 days after the date of the enactment of this subsection, by which each consumer reporting agency described in paragraph (1) shall be required to register in the registry established under such paragraph.”.

Section 1024(a)(1) of the Dodd-Frank Wall Street Reform and Consumer Protection Act (12 U.S.C. 5514(a)(1)) is amended—

(1) in subparagraph (D), by striking “or” at the end;

(2) in subparagraph (E), by striking the period at the end and inserting “; or”; and

(3) by adding at the end the following new subparagraph:

“(F) is a consumer reporting agency described under section 603(p) of the Fair Credit Reporting Act.”.

Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.) is amended—

(1) in section 501, by adding at the end the following new subsection:

“(c) Consumer reporting agency safeguards.—The Bureau of Consumer Financial Protection shall establish, by rule, appropriate standards for consumer reporting agencies described under section 603(p) of the Fair Credit Reporting Act relating to administrative, technical, and physical safeguards to protect records and information as described in paragraphs (1) through (3) of subsection (b).”;

(2) in section 504(a)(1)(A), by striking “, except that the Bureau of Consumer Financial Protection shall not have authority to prescribe regulations with respect to the standards under section 501”; and

(3) in section 505(a)(8), by inserting “, other than under subsection (c) of section 501” after “section 501”.

Not later than 90 days after the date of the enactment of this Act, the Director of the Bureau of Consumer Financial Protection shall assess whether examinations conducted by the Director of consumer reporting agencies described under section 603(f) of the Fair Credit Reporting Act (15 U.S.C. 1681a(f)) include sufficient processes to addresses any data security risks to the consumers of such agencies on which such agencies maintain and compile files. Along with the first semiannual report required under section 1016(b) of the Consumer Financial Protection Act of 2010 (12 U.S.C. 5496(b)) to be submitted after the 90-day period after the date of the enactment of this Act, the Director shall submit to Congress a report containing the results of such assessment that includes—

(1) recommendations for improving the processes to addresses any such data security risks; and

(2) the progress of the Director on making any improvements described under paragraph (1).

(a) Study.—The Comptroller General of the United States shall carry out a study on the feasibility and means of consumer reporting agencies replacing the use of social security numbers as identifiers with another type of Federal identification.

(b) Report.—Not later than the end of the 2-year period beginning on the date of the enactment of this Act, the Comptroller General shall issue a report to the Congress containing all findings and determinations made in carrying out the study required under subsection (a).