Important Laws and Regulations for Consumer Protection

The following are selected United States federal laws and regulations relating to the security of personal information about an individual. This should not be considered a complete list.

Fair Credit Reporting Act (FCRA)

• This law regulates the collection, dissemination, and use of consumer credit information and forms the base of consumer credit rights in the United States. It was originally passed in 1970 and is enforced by the U.S. Federal Trade Commission.
• If you notify a credit bureau of an error in your credit report, the FCRA requires the bureau to investigate your allegations within 30 days, review all information you provide, remove inaccurate and unverified information and adopt procedures to keep the information from reappearing. In addition, the law requires that creditors refrain from reporting incorrect information to credit bureaus.

Fair and Accurate Credit Transactions Act (FACTA)

• This law was passed in 2003 as an amendment to the FCRA.
• The act allows consumers to request and obtain a free credit report once every twelve months from each of the three nationwide consumer credit reporting agencies (Equifax, Experian and TransUnion). In cooperation with the Federal Trade Commission, the three major credit reporting agencies set up the website, www.annualcreditreport.com, to provide free access to annual credit reports.

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

• The primary focus of HIPAA was to improve the health insurance accessibility to people changing employers or leaving the workforce. It also addressed issues relating to electronic transmission of health-related data in Title II, Subtitle F of the Act entitled “Administrative Simplification.”
• The HIPAA Security Standards require a covered entity to implement policies and procedures to ensure the confidentiality, integrity, and availability of all electronic protected health information; protect against any reasonably anticipated threats or hazards to the security of such information; and protect against any reasonably anticipated uses or disclosures that are not permitted.
• The HIPAA security standards were effective on April 21, 2003. The compliance date for covered entities is by April 21, 2005 and April 21, 2006 for small health plans.

Gramm-Leach-Bliley Act (GLBA)

• The Financial Modernization Act of 1999, also known as the “Gramm-Leach-Bliley Act” or GLB Act, includes provisions to protect consumers’ personal financial information held by financial institutions. There are three principal parts to the privacy requirements: the Financial Privacy Rule, Safeguards Rule and pretexting provisions.
• The Privacy Rule took effect on November 13, 2000 and compliance was required on July 1, 2001. The Safeguard Rule was effective on May 23, 2003.