On February 16, Kentucky state representative Steve Bratcher (R) introduced House Bill (HB) 578. The bill seeks to create a new section of the Kentucky Consumer Protection Act that would restrict how consumer reporting agencies (CRAs) share individual’s information with third parties under specific conditions, mandating explicit consent from the consumer.

Specifically, HB 578 provides that when a financial institution requests a person’s consumer report or credit score from a CRA, the CRA is barred from furnishing that information unless it has obtained a written consent and acknowledgment from the person authorizing the CRA to provide that information.

The bill also provides enforcement mechanisms. These include actions initiated by the Attorney General and a private right of action. Statutory damages for non-compliance are set at $2,000 per violation. Further, in the event of a private right of action, plaintiffs may be entitled to treble damages as well as attorney’s fees and costs.

Our Take:

This bill, if passed, would force CRAs to essentially obtain the written instructions of the consumer to release a consumer report to a financial institution, even where that financial institution has an otherwise permissible purpose. Further, it puts all the responsibility on the CRAs to ensure that the consumer consents, as the enforcement remedies are aimed solely at CRAs and not the ultimate users of the consumer reports or credit scores. This would further raise severe tensions with the Fair Credit Reporting Act, which allows access for limited permissible purposes without consent, would represent a massive change in industry practice, and hence likely would face a challenge on preemption grounds. Yet, it continues the trend of state-level efforts to impose new limitations on consumer reporting.