With the 108th Congress in session less than a month, a showdown over privacy issues is already gearing up.  Under the new Republican leadership, Senator Richard Shelby (R-AL), became the chairman of the Senate Banking Committee.  Known for his strong support of opt-in privacy provisions and states' rights, Senator Shelby will be a key player in the debate over key elements of the Fair Credit Reporting Act (FCRA), including the expiration this year of the national standards provision that preempts state legislatures from regulating certain aspects of consumer reporting.

On the other side of Congress and the debate is House Financial Services Committee Chairman Michael G. Oxley (R-OH), who is on the record as strongly opposing any change to the current privacy rules set forth in the Gramm-Leach-Bliley Act.

Not to be left out, the Bush Administration has also weighed in and stated that, as part of the push for information security, the Treasury Department's top priority in the FCRA debate is to make it quicker and easier for consumers who have been victimized by identity theft to right wrongs in their credit reports.

Privacy is a matter that touches all of our lives.  Computers have made it much easier and more profitable for companies to gather and disseminate information that most Americans consider private.  The 90th Congress, recognizing that Americans need some way to protect themselves from threats to their privacy, passed the FCRA to ensure public confidence in the rapidly expanding area of credit-based consumer lending.  The FCRA deals with consumer credit report information and how it can be used and shared, including individuals' right to access their own records and correct any mistakes found.

Amendments to the FCRA passed in 1996, among other things, preempt states from regulating the rights of credit bureaus or banks to share information between affiliates.  Those amendments are set to expire January 1, 2004.  With the Federal Trade Commission this week reporting a surge in consumer fraud losses as a result of identity theft, now is not the time for FCRA to be dismantled.  The FCRA establishes standards for gathering and reporting credit information.  These standards govern the generation, dissemination and use of credit information and provide procedures for disputing the information contained therein.  Inconsistencies and over-regulation would not serve lenders and ultimately could grind to a halt consumers' access to many credit resources.

It is clearly within Congress' power to reauthorize uniform standards for the sharing of private information.  When a state statute conflicts with a federal provision, the federal statute preempts that of the state due to the Supremacy Clause of the U.S. Constitution, which provides that "This Constitution, and the Laws of the United States which shall be made in pursuance thereof; and all treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding."

Many legitimate arguments can be made for why Congress must reauthorize the state preemption provisions.  First among them is that Congress has the authority to regulate conduct that concerns or interferes with interstate commerce through the broad powers delegated through the Commerce Clause. The Commerce Clause contained within the U.S. Constitution states:  "The Congress shall have Power . . . To regulate commerce . . . among the several States . . . ."  (U.S. Const., Art. 1, sec. 8, cl. 3).  It is well settled that the Supreme Court's Commerce Clause jurisprudence gives the federal government the ability to regulate commerce.  

Likewise, it is well established that the "dormant Commerce Clause" might play some role in the choice of laws to block states from regulating or taxing in a way that would materially burden or discriminate against interstate commerce. The Supreme Court has long recognized that certain types of commerce, like rail and highway traffic, are uniquely suited to national, as opposed to state, regulation.  See, e.g., Wabash, St. L. & P.R. Co. v. Illinois, 118 U.S. 557 (1886).  More recently, the Supreme Court recognized that "[t]he Internet is 'a unique and wholly new medium of worldwide human communication' . . . located in no particular geographical location but available to anyone, anywhere in the world . . . ."  (Reno v. ACLU, 521 U.S. 844, 850-51 (1997) (citation omitted).  Much like the highway and railway system in the United States and worldwide, the borderless nature of the Internet makes it difficult to say that activities conducted in cyberspace constitute intrastate or national transactions.

Numerous suits have been filed throughout the United States challenging state statutes limiting Internet activity as violative of the commerce clause.  In 1997, a federal district judge cited the commerce clause to void New York's law attempting to protect minors on the Internet, stating that "[t]he unique nature of the Internet highlights the likelihood that a single actor might be subject to haphazard, uncoordinated, and even outright inconsistent regulation by states that the actor never intended to reach and possibly was unaware were being accessed.  Typically, states' jurisdictional limits are related to geography; geography, however, is virtually a meaningless construct on the Internet."  (American Library Ass'n v. Pataki, 969 F. Supp. 160, 168-69 (S.D.N.Y. 1997)).  The court further recognized that "the Internet is one of those areas of commerce that must be marked off as a national preserve to protect users from inconsistent legislation that, taken to its most extreme, could paralyze developments of the Internet altogether."  Id.at 169.

Additionally, reauthorization of federal preemption under the FCRA preserves advantages of simplicity and uniformity.  The worse scenario for credit agencies and consumers would be for fifty different states to each have its own law.  There is little doubt that without federal preemption, reporting agencies, their information providers and consumers would struggle to comply with different, overlapping, and inconsistent state laws.  This could result in higher costs to creditors, confusion of borrowers due to excess documentation, disparity of regulation, and even the possibility of double recovery by consumers entitled to both state and federal remedies.

Yet, with all eyes focused on the efforts of the legislative and executive branches, many are blind to the fact that the future of the FCRA may lie with the U.S. Supreme Court.

The Court is set to rule this term in Nike, Inc. v. Kasky (No. 02-575), a First Amendment case that could provide a clear distinction between what constitutes commercial and noncommercial speech and the level of protection afforded commercial speech under the First Amendment.  For background information about the Nike case, click here.

Federal courts have yet to reach a consensus on whether credit reports count as commercial speech.  The Supreme Court failed to answer this question in Dun & Bradstreet, Inc. v. Greenmoss Builders, Inc., 472 U.S. 749 (1985), a credit bureau defamation case, and then declined review in Trans Union LLC v. FTC, cert. denied, 122 S. Ct. 2383 (2002), which concerns whether credit reports constituted commercial speech.

The treatment of public statements at issue in the Nike case may be telling for credit reports.  The level of protection afforded credit reports, whether designated as commercial or noncommercial speech, would significantly affect whether credit bureaus can overcome tort and FCRA liability by raising a First Amendment defense.  This may ultimately affect the extent to which legislators may protect consumers from dissemination of credit reports.  Although the Supreme Court has had little opportunity to rule on the issue of data protection as a constitutional right, the Court did note in Whalen v. Roe, 429 U.S. 589, 605 (1977), that there is a "threat to privacy implicit in the accumulation of vast amounts of personal information in computerized data banks or other massive government files."

Professor Eugene Volokh of UCLA Law School makes a learned argument that broader information privacy rules will place a heavy burden on existing free speech law.  In his article, Cyberspace and Privacy: A New Legal Paradigm? Freedom of Speech and Information Privacy: The Troubling Implications of a Right to Stop People From Speaking About You, 52 Stan. L. Rev. 1049, 1122-23 (2000), Professor Volokh cautions that "[t]he analogies between the arguments used to support information privacy speech restrictions and the arguments used to support the other restrictions are direct and powerful. And accepting the principles that the government should enforce a right to stop others from speaking about us and that it's the government's job to create 'codes of fair information practices' controlling private parties' speech may shift courts and the public to an attitude that is more accepting of government policing of speech generally."

Government attempts to protect information privacy thus presents quite a conundrum for the credit reporting industry, consumers and legislators. If credit reports are deemed to deserve greater First Amendment protection than traditional forms of commercial speech, then some restrictions on commercial speech may be impermissible when applied to credit reports.  This strategic business related issue will eventually demand attention from all branches of government.