(a) Purpose. The purpose of the centralized source is to enable consumers to make a single request to obtain annual file disclosures from all nationwide consumer reporting agencies, as required under section 612(a) of the FCRA, 15 U.S.C. 1681j(a).

(b) Establishment and operation. All nationwide consumer reporting agencies shall jointly design, fund, implement, maintain, and operate a centralized source for the purpose described in Paragraph (a) of this section. The centralized source required by this part shall:

(1) Enable consumers to request annual file disclosures by any of the following request methods, at the consumers' option:

(i) A single, dedicated Web site,

(ii) A single, dedicated toll-free telephone number; and

(iii) Mail directed to a single address;

(2) Be designed, funded, implemented, maintained, and operated in a manner that:

(i) Has adequate capacity to accept requests from the reasonably anticipated volume of consumers contacting the centralized source through each request method, as determined in accordance with Paragraph (c) of this section;

(ii) Collects only as much personally identifiable information as is reasonably necessary to properly identify the consumer as required under the FCRA, section 610(a)(1), 15 U.S.C. 1681h(a)(1), and other applicable laws and regulations, and to process the transaction(s) requested by the consumer;

(iii) Provides information through the centralized source Web site and telephone number regarding how to make a request by all request methods required under paragraph (b)(1) of this section; and

(iv) Provides clear and easily understandable information and instructions to consumers, including, but not necessarily limited to:

(A) Providing information on the progress of the consumer's request while the consumer is engaged in the process of requesting a file disclosure;

(B) For a Web site request method, providing access to a “help” or “frequently asked questions” screen, which includes specific information that consumers might reasonably need to request file disclosures, the answers to questions that consumers might reasonably ask, and instructions whereby a consumer may file a complaint with the centralized source and with the Bureau;

(C) In the event that a consumer requesting a file disclosure through the centralized source cannot be properly identified in accordance with the FCRA, section 610(a)(1), 15 U.S.C. 1681h(a)(1), and other applicable laws and regulations, providing a statement that the consumers' identity cannot be verified; and directions on how to complete the request, including what additional information or documentation will be required to complete the request, and how to submit such information; and

(D) A statement indicating that the consumer has reached the Web site or telephone number for ordering free annual credit reports as required by Federal law; and

(3) Make available to consumers a standardized form established jointly by the nationwide consumer reporting agencies, which consumers may use to make a request for an annual file disclosure, either by mail or on the Web site required under paragraph (b)(1) of this section, from the centralized source required by this part. The form provided at appendix L to part 1022, may be used to comply with this section.

(c) Requirement to anticipate. The nationwide consumer reporting agencies shall implement reasonable procedures to anticipate, and to respond to, the volume of consumers who will contact the centralized source through each request method, to request, or attempt to request, a file disclosure, including developing and implementing contingency plans to address circumstances that are reasonably likely to occur and that may materially and adversely impact the operation of the nationwide consumer reporting agency, a centralized source request method, or the centralized source.

(1) The contingency plans required by this section shall include reasonable measures to minimize the impact of such circumstances on the operation of the centralized source and on consumers contacting, or attempting to contact, the centralized source.

(i) Such reasonable measures to minimize impact shall include, but are not necessarily limited to:

(A) The extent reasonably practicable under the circumstances, providing information to consumers on how to use another available request method;

(B) The extent reasonably practicable under the circumstances, communicating, to a consumer who attempts but is unable to make a request, the fact that a condition exists that has precluded the centralized source from accepting all requests, and the period of time after which the centralized source is reasonably anticipated to be able to accept the consumers' request for an annual file disclosure; and

(C) Taking all reasonable steps to restore the centralized source to normal operating status as quickly as reasonably practicable under the circumstances.

(ii) Reasonable measures to minimize impact may also include, as appropriate, collecting request information but declining to accept the request for processing until a reasonable later time, provided that the consumer is clearly and prominently informed, to the extent reasonably practicable under the circumstances, of when the request will be accepted for processing.

(2) A nationwide consumer reporting agency shall not be deemed in violation of paragraph (b)(2)(i) of this section if a centralized source request method is unavailable to accept requests for a reasonable period of time for purposes of conducting maintenance on the request method, provided that the other required request methods remain available during such time.

(d) Disclosures required. If a nationwide consumer reporting agency has the ability to provide a consumer report to a third party relating to a consumer, regardless of whether the consumer report is owned by that nationwide consumer reporting agency or by an associated consumer reporting agency, that nationwide consumer reporting agency shall, upon proper identification in compliance with section 610(a)(1) of the FCRA, 15 U.S.C. 1681h(a)(1), provide an annual file disclosure to such consumer if the consumer makes a request through the centralized source.

(e) High request volume and extraordinary request volume—

(1) High request volume. Provided that a nationwide consumer reporting agency has implemented reasonable procedures developed in accordance with Paragraph (c) of this section, entitled “requirement to anticipate,” the nationwide consumer reporting agency shall not be deemed in violation of Paragraph (b)(2)(i) of this section for any period of time in which a centralized source request method, the centralized source, or the nationwide consumer reporting agency experiences high request volume, if the nationwide consumer reporting agency:

(i) Collects all consumer request information and delays accepting the request for processing until a reasonable later time; and

(ii) Clearly and prominently informs the consumer of when the request will be accepted for processing.

(2) Extraordinary request volume. Provided that the nationwide consumer reporting agency has implemented reasonable procedures developed in compliance with Paragraph (c) of this section, entitled “requirement to anticipate,” the nationwide consumer reporting agency shall not be deemed in violation of Paragraph (b)(2)(i) of this section for any period of time during which a particular centralized source request method, the centralized source, or the nationwide consumer reporting agency experiences extraordinary request volume.

(f) Information use and disclosure. Any personally identifiable information collected from consumers as a result of a request for annual file disclosure, or other disclosure required by the FCRA, made through the centralized source, may be used or disclosed by the centralized source or a nationwide consumer reporting agency only:

(1) To provide the annual file disclosure or other disclosure required under the FCRA requested by the consumer;

(2) To process a transaction requested by the consumer at the same time as a request for annual file disclosure or other disclosure;

(3) To comply with applicable legal requirements, including those imposed by the FCRA and this part; and

(4) To update personally identifiable information already maintained by the nationwide consumer reporting agency for the purpose of providing consumer reports, provided that the nationwide consumer reporting agency uses and discloses the updated personally identifiable information subject to the same restrictions that would apply, under any applicable provision of law or regulation, to the information updated or replaced.

(g) Communications provided through centralized source.

(1) Any advertising or marketing for products or services, any communications or instructions that advertise or market any products or services, or any request to establish an account through the centralized source must be delayed until after the consumer has obtained his or her annual file disclosure.

(i) In the case of requests made by mail or telephone, the consumer “has obtained his or her annual file disclosure” when the file disclosure is mailed, and the nationwide consumer reporting agency may include advertising for other products or services with the file disclosure.

(ii) In the case of requests made through the centralized source Web site, the consumer “has obtained his or her annual file disclosure” when the file disclosure is delivered to the consumer through the Internet, and the nationwide consumer reporting agency may include advertising for other products or services with the file disclosure.

(2) Any communications, instructions, or permitted advertising or marketing shall not interfere with, detract from, contradict, or otherwise undermine the purpose of the centralized source stated in Paragraph (a) of this section.

(3) Examples of interfering, detracting, inconsistent, and/or undermining communications include:

(i) Centralized source materials that represent, expressly or by implication, that a consumer must purchase a paid product or service in order to receive or to understand the annual file disclosure;

(ii) Centralized source materials that represent, expressly or by implication, that annual file disclosures are not free, or that obtaining an annual file disclosure will have a negative impact on the consumers' credit standing; and

(iii) Centralized source materials that falsely represent, expressly or by implication, that a product or service offered ancillary to receipt of a file disclosure, such as a credit score or credit monitoring service, is free, or fail to clearly and prominently disclose that consumers must cancel a service, advertised as free for an initial period of time, to avoid being charged, if such is the case.

(h) Other practices prohibited through the centralized source. The centralized source shall not:

(1) Contain hyperlinks to commercial or proprietary Web sites until after the consumer has obtained his or her annual file disclosure, except for technical transfers to a Web page on which consumers can request their free annual file disclosure; provided, however, that no hyperlinks to commercial Web sites shall appear on the initial page of the centralized source.

(2) Require consumers to set up an account in connection with obtaining an annual file disclosure; or

(3) Ask or require consumers to agree to terms or conditions in connection with obtaining an annual file disclosure.