Since 1996, the preemption provisions of the federal Fair Credit Reporting Act (FCRA) have provided (i) a general rule regarding preemption, (ii) a specific preemption rule, (iii) exceptions to the preemption rule and (iv) a sunset provision. Under the general rule, state laws with respect to the collection, distribution or use of any information on consumers are preempted only to the extent that they are inconsistent with the FCRA. Under the specific preemption rule, state laws with respect to (i) any subject matter regulated under enumerated provisions of the FCRA, (ii) the exchange of information among affiliated entities and (iii) the form and content of disclosures required under 15 U.S.C. § 1681g(c) (the summary of rights required to be included with disclosures provided to consumers) are preempted. The exceptions to the specific preemption rule carve out specified provisions of California, Massachusetts and Vermont laws. The sunset provision provides that the specific preemption rule will not apply to state laws that (i) are enacted after January 1, 2004, (ii) explicitly state an intent to supplement the FCRA and (ii) give greater protection to consumers than provided under the FCRA. Thus, under the 1996 version of the FCRA, any state legislation enacted after January 1, 2004 explicitly supplementing the FCRA and providing greater consumer protections than the FCRA would not be subject to the specific preemption rule.

With the enactment of the Fair and Accurate Credit Transactions Act of 2003 (FACTA), however, Congress (i) repealed the sunset provision, (ii) included laws for the prevention or mitigation of identity theft among the type of laws subject to the general rule, (iii) added additional types of state laws subject to the specific preemption rule based on new provisions of the FACTA and (iv) added specified provisions of California, Colorado, Georgia, Maine, Maryland, Massachusetts, New Jersey and Vermont laws to the list of exceptions to the specific preemption rule. These amendments will become effective within one year of December 4, 2003 (depending on the date that implementing regulations are established).

Mike Tomkies