Your credit report is a sensitive document that provides a view into your financial situation, and not just anyone can access it.

For instance, can your spouse get a copy of your credit report in order to get some leverage against you during divorce proceedings? Or, when shopping for a car, can a car dealer run a credit check on you without your permission?

Taking note of the violations of consumer privacy that would occur in such situations, the law forbids such access to your credit report.

The Fair Credit Reporting Act aims to protect consumer privacy, among other aspects, recognizing that “information in a person’s credit file was not always kept strictly confidential.”

Thus, one reason for the enactment of the FCRA was to “prevent an undue invasion of the individual’s right of privacy in the collection and dissemination of credit information.”

Legally allowed reasons for credit report access

The FCRA lays out the “permissible purposes” for which an individual or entity can access your credit report. A credit reporting agency should only provide a copy of your credit report in the following cases:

  • You provide written instructions to do so.
  • The bureau receives a court order or subpoena to provide the report.
  • The receiver is using it in connection with a credit transaction involving you (such as deciding whether to grant you a loan or whether to continue to grant you credit).
  •  A debt collector pursuing debt you owe asks for it.
  • You have authorized it to be provided to a prospective employer.
  • An insurance company requests it while underwriting a policy.
  • You apply for a license or other government benefit that requires checking on your eligibility to receive it.
  • Potential investors or servicers, and current insurers, can access your credit report to gauge any credit risk that your loan poses, or to determine whether you will prepay (pay off a loan before it is due).
  • There is a genuine need to review your credit in connection with a business deal you initiate.
  • A state or local child support enforcement agency certifies to a consumer reporting agency about the need to obtain your credit report.
  • An agency managing a state plan under the Social Security Act requests it to set up a child support award.
  • In some circumstances, the Federal Deposit Insurance Corporation or the National Credit Union Administration may request your credit report.

Additionally, a lender cannot obtain your credit report stating that it is for the purpose of deciding whether to grant you a loan and then use the information for other purposes.

Prescreened offers and your credit

Financial institutions will sometimes obtain a list of consumers who meet specific preliminary credit criteria in order to prescreen them before making a credit or insurance offer. This sort of consumer report allows the lender to focus their marketing efforts on consumers who are more likely to meet their credit standards.

The FCRA allows financial institutions to obtain such a prescreened list from a credit reporting agency unless you have specifically opted out of participating in such prescreened offers.

The lender need not offer you the credit, though, if it determines you do not meet its further qualifying standards. These sorts of inquiries show up as a soft credit inquiry on your credit report, but will not impact your credit score.

If the institution decides to lend to you or insure you, it could pull up your credit report before making a final decision. That would be a “hard inquiry,” which could impact your credit score.

Your FCRA rights regarding unauthorized credit report access

The FCRA holds liable any credit reporting agency personnel who provide a copy of your credit report to unauthorized persons. The FCRA also holds accountable those who obtain your credit report without a “permissible purpose.”

A credit reporting agency cannot provide your credit report for a permissible purpose by mistake just because you have the same name as somebody else whose credit report is sought. Instead of just going by name, it should also use other information to determine that it is indeed providing a report for the right person. It would still be an FCRA violation if a credit reporting agency issues a disclaimer stating that it is providing a credit report based purely on name-matching and it is up to the user to make sure that the report belongs to the right person.

In addition to invasion of privacy, consumers could suffer from emotional and reputational harm as well as financial fallouts if someone gets unauthorized access to their credit report. That’s why you could be awarded both actual damages and punitive damages if you sue someone who uses your credit report without a “permissible purpose” and prevail. Your attorney fees could also be covered.

There is a statute of limitations in such cases. If you would like to pursue a lawsuit under the FCRA, you will have to do so within two years of the date you found out about the violation or within five years of the actual date of the violation, whichever is sooner.

The bottom line

Your credit report can’t be obtained by just anyone. The FCRA lays out in what situations a credit reporting agency can provide others access to your report. Even those who want access to your report can only ask for it if they have a legally permissible reason to do so.

Both the credit reporting agency and the person seeking access without a “permissible purpose” can be held liable if they breach the FCRA. And if you decide to pursue such a case, you will have to act before a statute of limitations runs out.