This chapter governs certain registration requirements and business operations of consumer reporting agencies who collect credit information and furnish consumer reports on residents of this State. The provisions of this chapter are to promote accuracy in consumer reports. In this chapter, the following terms have the meanings indicated. Terms Defined. “Breach of the security of a system” has the meaning stated in Commercial Law Article, §14-3504, Annotated Code of Maryland. “Business customer” means a person who supplies to a consumer reporting agency information for inclusion in a consumer report. “Collection agency” has the meaning stated in Business Regulation Article, §7-101, Annotated Code of Maryland. “Commissioner” has the meaning stated in Commercial Law Article, §14-1201, Annotated Code of Maryland. “Consumer” means an individual who resides in Maryland. “Consumer report” has the meaning stated in Commercial Law Article, §14-1201, Annotated Code of Maryland. Consumer Reporting Agency. “Consumer reporting agency” has the meaning stated in Commercial Law Article, §14-1201, Annotated Code of Maryland. “Consumer reporting agency” does not include a person who regularly extends credit to consumers and is: Licensed to extend credit by the Commissioner; or A financial institution chartered under the laws of this State or the laws of the United States, the lending operators of which are subject to supervision, examination, and regulation by a State or federal agency. “Control person” means a person who has the power, directly or indirectly, to direct the management or policies of a consumer reporting agency, whether through ownership of securities, by contract, or otherwise. “File” has the meaning stated in Commercial Law Article, §14-1201, Annotated Code of Maryland. “Nationwide Mortgage Licensing System and Registry” or “NMLS” has the meaning stated in Financial Institutions Article, §11-501, Annotated Code of Maryland. “Person” has the meaning stated in Commercial Law Article, §14-1201, Annotated Code of Maryland. “Personal information” has the meaning stated in Commercial Law Article, §14-3501, Annotated Code of Maryland. “Simple and easy to understand” has the meaning stated in 16 CFR §642.2. “Specialty consumer reporting agency” means a consumer reporting agency that prepares and retains files for one or more of the following: Residential history; Tenant history; or Employment history. During the time period established by the Commissioner under §B of this regulation, each consumer reporting agency shall: Obtain and maintain a valid unique identifier issued by NMLS when an account is created with NMLS; and Transfer registration information to NMLS. The Commissioner shall establish a time period that is not less than 2 months after the effective date of these regulations within which a registrant must transfer registration information to NMLS. At least 30 days before the transfer period begins, the Commissioner shall: Notify all registrants of the transfer period; and Provide instructions for the transfer of registration information to NMLS. Subject to §A of this regulation, a consumer credit reporting agency submitting an initial registration or a registration renewal shall apply for the initial registration or registration renewal through NMLS on or after November 1 of the year in which these regulations are effective and annually thereafter. To register, the consumer reporting agency shall provide all information required by the Commissioner through NMLS, including: The address of the principal executive office; The name of a responsible official of the consumer reporting agency who is available to respond expeditiously to inquiries or complaints referred by the Commissioner or the Commissioner's designee; A toll-free telephone number for use by the Commissioner or the Commissioner's designee, at which the responsible official required to be identified in this section may be reached; A toll-free telephone number or numbers maintained by the consumer reporting agency which is available to all Maryland residents for making inquiries; A certification by a control person that the consumer reporting agency has trained personnel sufficient to promptly and properly investigate and respond to consumer complaints and inquiries available; The mailing address or addresses to which a consumer may correspond with the consumer reporting agency in order to: Obtain a copy of their consumer report, and File written complaints or disputes about the accuracy of information contained in their consumer report; A certification by a control person who has primary oversight responsibility for the consumer reporting agency’s technology system that the consumer reporting agency is in compliance with all applicable data security requirements, including the requirements of the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) and, if applicable, the Gramm-Leach-Bliley Act (15 U.S.C. §6801 et seq.) and their respective implementing regulations; A copy of the declaration page, certificate of liability, or similarly summarized coverage page of the consumer reporting agency’s cyber risk insurance policy, if applicable; A list of all websites and web applications where there is consumer access to a service offered by the consumer reporting agency; The total number of consumer reports the consumer reporting agency assembled or evaluated over the previous 12 months; and The name of any third-party technology vendor that the consumer reporting agency utilizes to assemble, evaluate, or store consumer reports prepared by the consumer reporting agency. If, except for the information required in §E(10) and (11) of this regulation, the information supplied in a consumer reporting agency's registration becomes inaccurate at any time during the calendar year, the consumer reporting agency shall immediately submit the changes to the Commissioner through NMLS. The amount of a consumer reporting agency surety bond shall be determined as follows based on the number of consumer reports that the consumer reporting agency assembled, evaluated, or sold during the prior calendar year: Less than or equal to 10 percent of the total population of Maryland as published by the United States Census Bureau and listed on the Commissioner’s website shall file through NMLS a $100,000 bond; More than 10 percent but less than or equal to 25 percent of the total population of Maryland as published by the United States Census Bureau and listed on the Commissioner’s website shall file through NMLS a $250,000 bond; More than 25 percent but less than or equal to 50 percent of the total population of Maryland as published by the United States Census Bureau and listed on the Commissioner’s website shall file through NMLS a $500,000 bond; More than 50 percent but less than or equal to 75 percent of the total population of Maryland as published by the United States Census Bureau and listed on the Commissioner’s website shall file through NMLS a $750,000 bond; or More than 75 percent of the total population of Maryland as published by the United States Census Bureau and listed on the Commissioner’s website shall file through NMLS a $1,000,000 bond. In considering a request to grant an exemption to the requirement for a consumer reporting agency to file a surety bond with the Commissioner at the time of registration or registration renewal, the Commissioner may grant to a consumer reporting agency an exemption from the surety bond required under §A of this regulation if the Commissioner determines that the following conditions are met: The granting of an exemption is not detrimental to the public interest; The consumer reporting agency has conducted its business in a lawful manner; The consumer reporting agency has complied, and has the capability and systems in place to continue to comply, with the provisions of the Maryland Personal Information Protection Act, Commercial Law Article, §14-3501, et seq., Annotated Code of Maryland; and The consumer reporting agency demonstrates the financial ability to pay potential claims by establishing any of the following: The tangible net worth of the consumer reporting agency, as reported on an unconsolidated basis and certified by a control person, is equal to or greater than twice the amount of the surety bond required under §A of this regulation or this section; The consumer reporting agency’s short-term credit rating by a nationally recognized rating agency is at least equal to P2, A2, or F2 or an equivalent rating; The consumer reporting agency has regularly maintained and, during the registration period shall maintain, liquid assets, in form acceptable to the Commissioner, and in an amount that is at least equal to or greater than twice the amount of the surety bond required under §A of this regulation or this section; or In the case of a specialty consumer reporting agency, the consumer reporting agency maintains a current accreditation by the Professional Background Screening Association or any similar accreditation program approved by the Commissioner. A consumer reporting agency shall devise procedures to identify inaccurate information in consumer credit information submitted to it by a person who furnishes information to a consumer reporting agency. As a part of the procedures required in §A of this regulation, a consumer reporting agency: Shall comply with 15 U.S.C. §1681i; May not include in a consumer’s file any loan, regardless of the date of the loan, that has been determined to be usurious or otherwise void or unenforceable under Maryland law pursuant to a court order or final order issued by the Commissioner and for which the credit reporting agency received said order from a court, the Commissioner, a consumer or consumer’s representative to which the information relates, or identified through any other process instituted by the credit reporting agency that would notify them of such a determination; and Shall use personal information and publicly available information to match tax liens and judgments to the appropriate consumer report, except that this requirement does not apply to a consumer reporting agency that is acting as a “reseller” as defined under 15 U.S.C. §1681a(u) with respect to that consumer report. Complaints — General. This section does not apply to a report of information made to a consumer reporting agency before the effective date of this chapter. A consumer reporting agency may not list information which was received from a collection agency in a consumer's file unless there is also included in the consumer's file information sufficient to enable the consumer to identify the creditor who referred the debt to the collection agency. Complaints — Specific Types. This section does not apply: If the consumer reporting agency has reason to believe that the consumer complaint: Is fraudulent; or Has been previously investigated by the consumer reporting agency and found to be without merit; Unless the consumer complaint contains the consumer's: Full name; Date of birth; Social Security number; Home addresses for the preceding 3 years; and Signature; If the complaint is filed by or with the assistance of a credit repair agency that is required to be licensed, but is not licensed, by the Commissioner under Commercial Law Article, Title 14, Subtitle 19, Annotated Code of Maryland. Except as provided in §D(1) of this regulation, this section applies to a written complaint submitted to a consumer reporting agency in which the consumer alleges that there is false information contained in the consumer report attributable to the: Consumer having been the victim of credit fraud; or Mixing of the information in the consumer's file with that of another person. There is a rebuttable presumption that a consumer complaint to which this section is applicable, and which is submitted to a consumer reporting agency, is: Legitimate; and Not frivolous. The presumption established by this section is rebutted if the consumer reporting agency receives verification from the source of the disputed information in the consumer report that the information pertains to the consumer. Complaints subject to the presumption established by this section shall receive expedited handling by the consumer reporting agency. The consumer reporting agency shall include in its investigation of a consumer complaint to which this section is applicable, an attempt to verify the disputed information using the consumer's Social Security number. If the presumption established by this section is: Rebutted, the consumer reporting agency shall mail a written notice to the consumer stating: That the information was verified; and The rights of the consumer under Commercial Law Article, Title 14, Subtitle 12, Annotated Code of Maryland; Not rebutted, the consumer reporting agency shall delete the information from the consumer's file and mail: Written notice of the correction to the consumer and to each person designated by the consumer to receive a copy of the correction in accordance with Commercial Law Article, §14-1208, Annotated Code of Maryland; and A statement of the rights of the consumer under Commercial Law Article, Title 14, Subtitle 12, Annotated Code of Maryland. Costs. A consumer reporting agency shall pay the actual cost per day for each investigator engaged in an investigation by the Commissioner. If the Commissioner finds that a person is in the business of making loans that are usurious or otherwise void or unenforceable under Maryland law or can use information in credit reports in connection with the making of loans that are usurious or otherwise void or unenforceable under Maryland law, and issues a written order to a consumer reporting agency not to furnish credit reports to that person, the consumer reporting agency shall comply with the order within 30 days of receipt of the written order. If the Commissioner finds that a loan is usurious or otherwise void or unenforceable under Maryland law or that a person is in the business of making loans that are usurious or otherwise void under Maryland law, and issues a written order to a consumer reporting agency prohibiting the consumer reporting agency from including the loan in a consumer’s file, the consumer reporting agency shall comply with the written order within 30 days of receipt of the written order. The Commissioner shall make available to the public a current listing of the names, addresses, and telephone numbers of registered consumer reporting agencies through the NMLS Consumer Access portal. Business Regulation Article, §2-105; Commercial Law Article, §§14-1216(b) and (e), 14-1217(b)(9) and (10) and (d), 14-1218(e), and 14-1226(f) and (g); Financial Institutions Article, §2-105.1(b) and (c); Annotated Code of Maryland Effective date: June 6, 1994 (21:11 Md. R. 950) Chapter recodified from COMAR 09.04.07 to COMAR 09.03.07, April, 1998 Chapter revised effective October 19, 2020 (47:21 Md. R. 903)