Informative article about car dealers pulling your credit report

Jeff Blyskal with http://www.consumerreports.org/ wrote an interesting article about car dealers not needing your SSN to pull your credit report.  Here's the article:

Considering all the time we spend fretting about protecting our Social Security numbers, this may come as a shock: Your SSN isn’t necessary for a car salesperson to surreptitiously peek at your credit report. He or she has the technological ability to unlock your file using only the information on your driver’s license.

“An auto dealership checking a consumer’s credit through TransUnion is not required to have the individual’s social security number (SSN) in order to submit the request,” says Steven Katz, a TU spokesman. Does the dealer need your permission to do that? “The dealer does not need ‘permission’; rather, it needs only certify a permissible purpose (such as extension of credit),” says Katz.

Equifax told us the same thing about the ability to get your credit report without your SSN, but stressed that anyone who pulls your file must get your permission to do so.

Experian did not respond to our query.

TransUnion prefers to get the SSN, because it more reliably helps locate your exact credit file, but it’s not absolutely necessary. The credit report access keys on the license are your name, address, and date of birth, all of which are essentially public information. The driver’s license number itself is not relevant, since the credit bureaus don’t use that as an identifier.

Car dealers commonly ask for and photocopy your driver’s license before they’ll let you take one of their cars out for a test drive, says Charles Cyrill, a spokesman for the National Automobile Dealers Association. If you encounter this situation and are worried that your privacy may be compromised, explicitly tell the salesperson that you are not authorizing use of your license to pull your credit report.

Under the federal Fair Credit Reporting Act, a car dealer must always get your permission to look at your credit report. He or she can get that permission in writing—when you sign a release or a loan application—or by implication, without your signature, if there is a “legitimate business need.”

What does that mean? According to the FTC, simply shopping around, checking deals, and even taking test drives does not constitute a legitimate business need by itself. Rather, it’s only when you’ve gone further along into an obvious purchase transaction that your actions qualify as business that possibly involves a need to check your credit, according to a 1998 FTC staff opinion letter.

“Only in those circumstances where it is clear both to the consumer and to the dealer that the consumer is actually initiating the purchase or lease of a specific vehicle and, in addition, the dealer has a legitimate business need for consumer report information may the dealer obtain a report without written permission,” says the FTC opinion.

Whoever Jeff Blyskal spoke to at Equifax was completely misinformed or being untruthful.  Equifax allows companies to pull consumers' credit reports all the time without their express permission.  This is allowed by the FCRA as long as there is a permissible purpose, as laid out in 15 U.S.C. 1681b. 

Car dealers are the worst about not following the law in multiple ways, the FCRA being but one of them.  While all car dealers know that they can not pull your credit report without either your permission or a permissible purpose such as you actually applying for financing to purchase the vehicle, many pull your report anyway. 

Not having a permissible purpose arise until the consumer actually applies for financing makes sense.  For instance, what if the buyer is paying cash?  In that instance, his or her credit history matters not so there's no permissible reason for the car buyer to pull the credit report.  Or if the potential buyer is just test driving or walking the lot "kicking tires".  At that point, there is no legitimate need to pull the person's credit report.  But it is all too easy for the car dealer to simply indicate either consent or a "legitimate business need" even when one does not exist yet (and may never exist).  The credit bureaus simply "trust" their customers, whether they are credit card companies, banks, car dealers or bottom feeding collection agencies.  The CRAs even trust them after being informed of a pattern of impermissibly pulling credit reports.  But why should the CRAs care when they make more money by turning a blind eye to impermissible pulls (i.e. sales of credit reports)?  Selling your credit information is what CRAs do best.  Why let a little thing like 15 U.S.C. 1681b get in the way of that?!