(a) Purpose. The purpose of this part is to implement the Fair Credit Reporting Act. This part generally applies to persons that obtain and use information about consumers to determine the consumer's eligibility for products, services, or employment, share such information among affiliates, and furnish information to consumer reporting agencies.

(b) Scope. (1) [Reserved]

(2) Institutions covered. (i) Except as otherwise provided in this part, the regulations in this part apply to banks that are members of the Federal Reserve System (other than national banks) and their respective operating subsidiaries that are not functionally regulated within the meaning of section 5(c)(5) of the Bank Holding Company Act, as amended (12 U.S.C. 1844(c)(5)), branches and Agencies of foreign banks (other than Federal branches, Federal Agencies, and insured State branches of foreign banks), commercial lending companies owned or controlled by foreign banks, organizations operating under section 25 or 25A of the Federal Reserve Act (12 U.S.C. 601 et seq., and 611 et seq.), and bank holding companies and affiliates of such holding companies, but do not apply to affiliates of bank holding companies that are depository institutions regulated by another federal banking agency or to consumer reporting agencies.

(ii) For purposes of appendix B to this part, financial institutions as defined in section 509 of the Gramm-Leach-Bliley Act (12 U.S.C. 6809), may use the model notices in appendix B to this part to comply with the notice requirement in section 623(a)(7) of the Fair Credit Reporting Act (15 U.S.C. 1681s-2(a)(7)).

(c) Effective dates. The applicable provisions of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act), Pub. L. 108-159, 117 Stat. 1952, shall be effective in accordance with the following schedule:

(1) Provisions effective December 31, 2003. (i) Sections 151(a)(2), 212(e), 214(c), 311(b), and 711, concerning the relation to state laws; and

(ii) Each of the provisions of the FACT Act that authorizes an agency to issue a regulation or to take other action to implement the applicable provision of the FACT Act or the applicable provision of the Fair Credit Reporting Act, as amended by the FACT Act, but only with respect to that agency's authority to propose and adopt the implementing regulation or to take such other action.

(2) Provisions effective March 31, 2004. (i) Section 111, concerning the definitions;

(ii) Section 156, concerning the statute of limitations;

(iii) Sections 312(d), (e), and (f), concerning the furnisher liability exception, liability and enforcement, and rule of construction, respectively;

(iv) Section 313(a), concerning action regarding complaints;

(v) Section 611, concerning communications for certain employee investigations; and

(vi) Section 811, concerning clerical amendments.

(3) Provisions effective December 1, 2004. (i) Section 112, concerning fraud alerts and active duty alerts;

(ii) Section 114, concerning procedures for the identification of possible instances of identity theft;

(iii) Section 115, concerning truncation of the social security number in a consumer report;

(iv) Section 151(a)(1), concerning the summary of rights of identity theft victims;

(v) Section 152, concerning blocking of information resulting from identity theft;

(vi) Section 153, concerning the coordination of identity theft complaint investigations;

(vii) Section 154, concerning the prevention of repollution of consumer reports;

(viii) Section 155, concerning notice by debt collectors with respect to fraudulent information;

(ix) Section 211(c), concerning a summary of rights of consumers;

(x) Section 212(a)-(d), concerning the disclosure of credit scores;

(xi) Section 213(c), concerning enhanced disclosure of the means available to opt out of prescreened lists;

(xii) Section 217(a), concerning the duty to provide notice to a consumer;

(xiii) Section 311(a), concerning the risk-based pricing notice;

(xiv) Section 312(a)-(c), concerning procedures to enhance the accuracy and integrity of information furnished to consumer reporting agencies;

(xv) Section 314, concerning improved disclosure of the results of reinvestigation;

(xvi) Section 315, concerning reconciling addresses;

(xvii) Section 316, concerning notice of dispute through reseller; and

(xviii) Section 317, concerning the duty to conduct a reasonable reinvestigation.

The examples in this part are not exclusive. Compliance with an example, to the extent applicable, constitutes compliance with this part. Examples in a paragraph illustrate only the issue described in the paragraph and do not illustrate any other issue that may arise in this part.

For purposes of this part, unless explicitly stated otherwise:

(a) Act means the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).

(b) Affiliate means any company that is related by common ownership or common corporate control with another company.

(c) [Reserved]

(d) Company means any corporation, limited liability company, business trust, general or limited partnership, association, or similar organization.

(e) Consumer means an individual.

(f)-(h) [Reserved]

(i) Common ownership or common corporate control means a relationship between two companies under which:

(1) One company has, with respect to the other company:

(i) Ownership, control, or power to vote 25 percent or more of the outstanding shares of any class of voting security of a company, directly or indirectly, or acting through one or more other persons;

(ii) Control in any manner over the election of a majority of the directors, trustees, or general partners (or individuals exercising similar functions) of a company; or

(iii) The power to exercise, directly or indirectly, a controlling influence over the management or policies of a company, as the Board determines; or

(2) Any other person has, with respect to both companies, a relationship described in paragraphs (i)(1)(i) through (i)(1)(iii) of this section.

(j) [Reserved]

(k) Medical information means:

(1) Information or data, whether oral or recorded, in any form or medium, created by or derived from a health care provider or the consumer, that relates to:

(i) The past, present, or future physical, mental, or behavioral health or condition of an individual;

(ii) The provision of health care to an individual; or

(iii) The payment for the provision of health care to an individual.

(2) The term does not include:

(i) The age or gender of a consumer;

(ii) Demographic information about the consumer, including a consumer's residence address or e-mail address;

(iii) Any other information about a consumer that does not relate to the physical, mental, or behavioral health or condition of a consumer, including the existence or value of any insurance policy; or

(iv) Information that does not identify a specific consumer.

(l) Person means any individual, partnership, corporation, trust, estate cooperative, association, government or governmental subdivision or agency, or other entity.