Credit report errors in Pennsylvania: what the law says

What the statute says

Small claims limit

$12,000

Two Pennsylvania courts hear small civil claims. A magisterial district judge has jurisdiction of civil claims 'wherein the sum demanded does not exceed $12,000, exclusive of interest and costs' in three classes: assumpsit ('except cases of real contract where the title to real estate may be in question'), trespass, and 'fines and penalties by any government agency' (42 Pa.C.S.

Read the full rule

§ 1515(a)(3)). The Philadelphia Municipal Court has the same $12,000 civil ceiling and the same three classes, except that its assumpsit class carries no real-estate-title exception (42 Pa.C.S. § 1123(a)(4)); there the statute's stated purpose is 'to establish an expeditious small claims procedure whereby it shall not be necessary for the litigants to obtain counsel', and the defendant has 'no right of trial by jury in the municipal court, but shall have the right to appeal for trial de novo, including the right of trial by jury, to the court of common pleas'. In both courts a plaintiff 'may waive a portion of his claim of more than $12,000' to stay within the limit, but that waiver 'shall be revoked automatically if the defendant appeals'. Claims against a Commonwealth party are excluded from both. Before filing a credit-reporting case there, note what these two jurisdiction statutes do and do not say: both list only assumpsit, trespass, and government fines and penalties, and neither says a federal statutory claim may be brought; whether a magisterial district judge or the Philadelphia Municipal Court will hear a Fair Credit Reporting Act claim is unsettled in Pennsylvania. The dependable forum for an FCRA claim is federal court: 15 U.S.C. § 1681p allows the action 'in any appropriate United States district court, without regard to the amount in controversy, or in any other court of competent jurisdiction'.

Code section

Credit Reporting Agency Act, Act of Nov. 29, 2006, P.L. 1463, No. 163, §§ 1–11. Pennsylvania enacted and publishes this law as a session act rather than as a numbered code section, so it is cited by its official act designation.

Read the full rule

Related but not credit-reporting statutes: the Fair Credit Extension Uniformity Act, Act of Mar. 28, 2000, P.L. 23, No. 7, § 4(b)(5)(viii) (unfair debt-collection practices by creditors and debt collectors), with its § 5(b) two-year limitation and § 5(d) bona fide error defense; the Breach of Personal Information Notification Act, the act of December 22, 2005 (P.L.474, No.94), § 5.4, added by the Act of Jun. 28, 2024, P.L. 427, No. 33; and the Unfair Trade Practices and Consumer Protection Law, the act of December 17, 1968 (P.L.1224, No.387). No Pennsylvania statute sets a dispute or reinvestigation procedure for consumer reporting agencies.

Statutory damages

No Pennsylvania overlay — federal 15 U.S.C. §§ 1681n and 1681o govern, and neither promises a consumer $1,000. For a willful failure to comply, § 1681n(a)(1)(A) makes the violator liable for 'any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000'.

Read the full rule

That is a range offered as an alternative to actual damages, not a fixed or automatic $1,000; the statute states it once, as one component of a single sum, and contains no per-item multiplier, so it cannot be turned into a total by counting disputed entries. The same subsection adds 'such amount of punitive damages as the court may allow', which is discretionary with the court, and, under § 1681n(a)(3), the costs of a successful action together with reasonable attorney's fees as determined by the court. The section does use a 'whichever is greater' $1,000 in two places, and neither is an ordinary dispute-handling failure by a consumer reporting agency: § 1681n(a)(1)(B) applies 'in the case of liability of a natural person for obtaining a consumer report under false pretenses or knowingly without a permissible purpose', while § 1681n(b) provides that 'Any person who obtains a consumer report from a consumer reporting agency under false pretenses or knowingly without a permissible purpose shall be liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or $1,000, whichever is greater' — a liability that runs to the agency rather than to the consumer, that is not confined to natural persons, and that turns on obtaining the report from a consumer reporting agency. For a negligent failure, § 1681o(a) gives 'any actual damages sustained by the consumer as a result of the failure' and, 'in the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court' — with no statutory minimum at all: a negligent violation the consumer cannot tie to a provable loss, and does not sue on successfully, can be worth nothing. The common-law routes are largely closed as well: 15 U.S.C. § 1681h(e) provides that, except as provided in §§ 1681n and 1681o, 'no consumer may bring any action or proceeding in the nature of defamation, invasion of privacy, or negligence with respect to the reporting of information against any consumer reporting agency, any user of information, or any person who furnishes information to a consumer reporting agency, based on information disclosed pursuant to section 1681g, 1681h, or 1681m of this title', 'except as to false information furnished with malice or willful intent to injure such consumer'. Pennsylvania's own Credit Reporting Agency Act § 10 creates no private damages: a violation 'shall be deemed to be an unfair or deceptive act or practice' under the UTPCPL, but 'The Office of Attorney General shall have exclusive authority to bring an action' for it. UTPCPL § 9.2 (actual damages or $100, discretionary trebling, fees) is therefore not available to a consumer for a freeze violation, and for credit-reporting conduct by a furnisher the Eastern District of Pennsylvania held it preempted by § 1681t(b)(1)(F) in Levy-Tatum v. Navient — the decision of a single district judge, not binding Third Circuit precedent. UTPCPL § 8(b) civil penalties (up to $1,000 per willful violation; $3,000 where the victim is 60 or older) are recoverable only by the Attorney General or a District Attorney.

When it can be extended

No Pennsylvania overlay — federal 15 U.S.C. § 1681i(a)(1)(B) governs. The 30-day reinvestigation period 'may be extended for not more than 15 additional days if the consumer reporting agency receives information from the consumer during that 30-day period that is relevant to the reinvestigation'.

Read the full rule

The extension is conditional rather than automatic: it depends on the consumer supplying relevant information inside the original 30 days, and under § 1681i(a)(1)(C) it 'shall not apply to any reinvestigation in which, during the 30-day period described in subparagraph (A), the information that is the subject of the reinvestigation is found to be inaccurate or incomplete or the consumer reporting agency determines that the information cannot be verified'. By its terms § 1681i(a)(1)(B) extends only 'the 30-day period described in subparagraph (A)', and § 1681j(a)(3) sets its 45-day period 'Notwithstanding the time periods specified in section 1681i(a)(1) of this title' — text that points away from stacking the 15-day extension on top of the 45 days, though neither section says so outright.

What the bureau must do

No Pennsylvania overlay on dispute handling — federal 15 U.S.C. § 1681i governs a consumer reporting agency's duty to reinvestigate.

Read the full rule

Section 1681i(a)(1)(A), which is stated "Subject to subsection (f) and except as provided in subsection (g)" (the reseller rules and the veteran's-medical-debt process), requires the agency, on notice of a dispute from the consumer or a reseller, to "conduct a reasonable reinvestigation", free of charge, "before the end of the 30-day period beginning on the date on which the agency receives the notice of the dispute from the consumer or reseller". Section 1681i(a)(1)(B) allows that period to be extended "for not more than 15 additional days" if the consumer supplies relevant information during it — except that under § 1681i(a)(1)(C) no extension is available where, during the 30-day period, the disputed information "is found to be inaccurate or incomplete or the consumer reporting agency determines that the information cannot be verified". Section 1681i(a)(6)(A) then requires written notice of the results "not later than 5 business days after the completion of the reinvestigation". One situation carries a different deadline: where the consumer asks for a reinvestigation after receiving a consumer report under § 1681j(a), the subsection headed "Free annual disclosure", § 1681j(a)(3) gives the agency 45 days from the date the request is received. That 45-day period comes from § 1681j(a)(3) and not from § 1681i, and it does not reach reports obtained under the other subsections of § 1681j. Pennsylvania's Credit Reporting Agency Act imposes duties on consumer reporting agencies only as to security freezes: placement (§ 3(a)(3)), written confirmation providing "a unique personal identification number or password" (§ 4), a replacement number or password on request (§ 5), telling a person who requests a consumer report that a freeze is in effect (§ 6), temporary lift and removal (§ 7), fees and fee exceptions (§ 9(a)–(b)), and written confirmation of a change to a consumer's name, date of birth, Social Security number or address while a freeze is in place (§ 9(c)). It sets no accuracy, reinvestigation, disclosure, adverse-action or obsolescence duty, and § 10 reserves enforcement of what it does require to the Attorney General.

Under the Credit Reporting Agency Act § 3(a)(3) a consumer reporting agency "shall place a security freeze on a consumer report no later than five business days after receiving a request"; § 4 requires a written confirmation providing "a unique personal identification number or password" "no later than ten business…

Read the full rule

days" after the agency receives the request; § 7(b) requires a temporary lift or removal "no later than three business days after receiving the request"; and § 9(c) requires written confirmation, within 30 days of the change being posted, of a change to a consumer's name, date of birth, Social Security number or address while a freeze is in place. Section 9(c) carries its own carve-out: "Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings or transposition of numbers or letters", and an address change must be confirmed "to both the new address and to the former address". On the points federal law also covers, Pennsylvania is slower or the same. At the agencies 15 U.S.C. § 1681c-1(i) reaches — "a consumer reporting agency described in section 1681a(p)", § 1681c-1(i)(1)(A) — § 1681c-1(i)(2)(A) requires placement free of charge within 1 business day of a toll-free telephone or secure electronic request and 3 business days of a mailed request, and § 1681c-1(i)(3)(C) requires removal free of charge within 1 hour of an electronic request and 3 business days of a mailed request. The confirmation duties are not strictly comparable: § 1681c-1(i)(2)(B) gives the agency 5 business days after placing the freeze to "send confirmation of the placement to the consumer" and to explain the removal process "including a mechanism to authenticate the consumer", where the Pennsylvania section gives ten business days but measures them from receipt of the request and requires a personal identification number or password as such. Section 9(c) is the genuine Pennsylvania-only requirement: no counterpart appears in § 1681c-1(i) or (j). It is not a consumer remedy — § 10 gives the Office of Attorney General "exclusive authority to bring an action" for any violation of the act — and because § 1681t(b)(1)(J) preempts state law on the subject matter of § 1681c-1(i) and (j), a consumer reporting agency can be expected to raise preemption against a Pennsylvania-only freeze demand as well. In practice, at the nationwide agencies where a consumer actually places a freeze, the operative deadlines for a Pennsylvania consumer are the federal ones. The act's reach is narrow in a second way: it covers only "security freeze" conduct, and contains no reinvestigation, accuracy, disclosure, adverse-action or obsolescence duty. Section 3(a)(4) also relieves a pure reseller that "does not maintain a permanent database of credit information from which new credit reports are produced", a check-services or fraud-prevention services company, and a deposit account information service company of the duty to place a freeze — though a reseller "shall honor any security freeze placed on a credit report by another credit reporting agency".

What the furnisher must do

No usable Pennsylvania overlay — federal 15 U.S.C. § 1681s-2(b) governs. On receiving notice of a dispute from a consumer reporting agency under § 1681i(a)(2), a furnisher must "conduct an investigation with respect to the disputed information", review the information the agency provided, "report the results of the…

Read the full rule

investigation to the consumer reporting agency", report an incomplete or inaccurate finding to the other nationwide agencies it furnished the information to, and — "for purposes of reporting to a consumer reporting agency only" — promptly modify, delete or permanently block the reporting of an item found inaccurate, incomplete or unverifiable; § 1681s-2(b)(2) ties the furnisher's deadline to the § 1681i(a)(1) period running against the agency. That subsection (b) duty is what a consumer can sue on: § 1681s-2(c) provides that §§ 1681n and 1681o "do not apply to any violation of" subsection (a), the furnisher's general accuracy duties, so a private damages claim ordinarily requires that the dispute have been routed through a consumer reporting agency first. The only Pennsylvania text touching furnisher conduct is Fair Credit Extension Uniformity Act § 4(b)(5)(viii), which makes it an unfair debt-collection practice to communicate "credit information which is known or which should be known to be false, including the failure to communicate that a debt is disputed". That clause sits in the subsection that applies "With respect to debt collection activities of creditors in this Commonwealth" (§ 4(b)), and it reaches only a "debt" arising from a consumer purchase, lease or loan (§ 3) — not landlords, utilities or other furnishers as such; the act's liability and defense provisions speak of "a debt collector or creditor" (§ 5(a), (d)), but the clause quoted above sits in the subsection addressed to creditors. It is enforceable only through the UTPCPL private-action section, which requires a purchase or lease of goods or services and an "ascertainable loss of money or property"; it carries a bona fide error defense (§ 5(d)) and a two-year limitation (§ 5(b)). A federal district court in Pennsylvania has held such a claim preempted: Levy-Tatum v. Navient (E.D. Pa. No. 15-3794, Jan. 7, 2016) concluded that the FCRA "preempts any claim under Pennsylvania’s FCEUA, as brought through the UTPCPL, based upon conduct related to furnishing information to a credit reporting agency", following Grossman v. Trans Union (E.D. Pa. 2014) and Jaramillo v. Experian (E.D. Pa. 2001). That is the ruling of a single district judge rather than a Third Circuit holding, and it is framed around conduct related to furnishing information to a consumer reporting agency; no Pennsylvania appellate decision settles the point. Its practical effect is that a furnisher has a ready preemption defense to an FCEUA theory, while a claim built on § 1681s-2(b) does not depend on state law at all.

Your right to free reports

No general Pennsylvania overlay — federal 15 U.S.C. § 1681j governs free annual and dispute-related reports. Under § 1681j(a)(1)(A) a nationwide agency must make all disclosures 'once during any 12-month period upon request of the consumer and without charge to the consumer', and § 1681j(a)(1)(B) makes that free annual report turn on the request being made through the centralized source established for the purpose.

Read the full rule

The one Pennsylvania-specific right is narrow, and it runs against a business that suffered a data breach rather than against a credit bureau: Breach of Personal Information Notification Act § 5.4, added by Act 33 of 2024, which took effect 90 days after that act was approved on June 28, 2024 (September 26, 2024). No such duty existed in Pennsylvania before that date. Two conditions set its reach. First, the entity must be one that 'provides notification under section 5'; § 5, as amended by the same act, applies 'When an entity provides notification under this act to more than 500 persons at one time'. That 500 measures how many people the entity had to notify — it is not a test the individual consumer has to satisfy, and § 5.4 sets no threshold measured by the individual at all. Second, under § 5.4(b) the entity must have determined that a breach occurred and must 'reasonably believe' that a first and last name (or first initial and last name) was accessed in combination with a Social Security number, a bank account number, or a driver's license or State ID number. What the entity owes is narrower than paying for everything. Section 5.4(a)(1) makes the entity 'assume all costs and fees' of access to 'one independent credit report', but only 'if the individual is not eligible to obtain an independent credit report from a consumer reporting agency for free' under federal law — which, for a nationwide agency's report, is normally the case under § 1681j(a), so this half will usually cost the entity nothing. Section 5.4(a)(2) covers 'Access to credit monitoring services for a period of 12 months following notification', but the same paragraph adds that 'An entity may satisfy the requirements of this paragraph by providing notice to the individual of the availability of monitoring services for a period of 12 months at no cost to the individual.' On the monitoring half, then, an entity can discharge the duty by telling the consumer where 12 months of no-cost monitoring is available rather than by buying a service for them; that option is written into paragraph (2) only and does not reach the credit report in paragraph (1). Section 5.4(c) separately requires the entity to inform the affected individual of the availability of the no-cost services when it gives breach notice. This is a post-breach duty on the breached entity: it is not a dispute right, and it imposes nothing on a consumer reporting agency.

Governing law

Pennsylvania has no general consumer credit reporting act. As of September 2026 its only credit-reporting statute is the Credit Reporting Agency Act (Act of Nov. 29, 2006, P.L. 1463, No.

Read the full rule

163), a security-freeze-only law that gives a consumer no private right of action: under its § 10 the Office of Attorney General has exclusive authority to bring an action for a violation. Disputes, reinvestigation deadlines, furnisher duties, damages and free security freezes are governed in Pennsylvania by the federal Fair Credit Reporting Act (Public Law 91-508, 15 U.S.C. § 1681 et seq.), and so are free credit reports, with one narrow state exception: after a data breach, the Breach of Personal Information Notification Act § 5.4 puts a free-report and 12-month monitoring duty on the breached entity, not on a consumer reporting agency.

Attorney's fees

No Pennsylvania overlay — federal 15 U.S.C. §§ 1681n(a)(3) and 1681o(a)(2) govern, and both are conditional. Fees are recoverable only 'in the case of any successful action to enforce any liability under this section', and what is recovered is 'the costs of the action together with reasonable attorney's fees as determined by the court' — there is no fee award for sending a demand letter, for a settlement reached before suit, or for an action that does not succeed, and the amount is set by the court rather than by the consumer.

Read the full rule

Fee-shifting also runs the other way: under § 1681n(c) and § 1681o(b), where the court finds that an unsuccessful pleading, motion or other paper 'was filed in bad faith or for purposes of harassment, the court shall award to the prevailing party attorney's fees reasonable in relation to the work expended in responding' to it. Pennsylvania adds nothing: the Credit Reporting Agency Act contains no fee-shifting provision and no private action, and the UTPCPL § 9.2(a) award of costs and reasonable attorney fees is reachable only in a UTPCPL private action, which the Credit Reporting Agency Act § 10 forecloses for freeze violations and which federal district courts in Pennsylvania have held preempted by § 1681t(b)(1)(F) for furnisher credit-reporting conduct — district-court decisions, not binding Third Circuit precedent.

Outer limit (discovery rule)

5

Who handles complaints

Pennsylvania Office of Attorney General. Its authority over consumer reporting agencies comes from Credit Reporting Agency Act § 10, which makes a violation of that act an unfair or deceptive act or practice under the Unfair Trade Practices and Consumer Protection Law and gives that office exclusive authority to sue for it.

Read the full rule

Separately, and under a different statute, the Breach of Personal Information Notification Act § 3(c.1) (added by the Act of Jun. 28, 2024, P.L. 427, No. 33, § 1.1) requires an entity to notify the Attorney General concurrently when breach notice must be given to more than 500 affected individuals in this Commonwealth; an entity subject to 40 Pa.C.S. Ch. 45 (insurance data security) is exempt from that notice under § 3(c.2). The Credit Reporting Agency Act creates no licensing, registration or examination program, and as of September 2026 Pennsylvania has enacted no statute giving any state agency the power to supervise consumer reporting agencies or to police the accuracy of consumer reports.

Scope limits

Credit Reporting Agency Act: takes effect January 1, 2007 (§ 11) and reaches security freezes only — it imposes no reinvestigation, accuracy, disclosure, adverse-action or obsolescence duty.

Read the full rule

§ 3(a)(4) does not require a reseller that keeps no permanent database, a check-services or fraud-prevention company, or a deposit-account information service company to place a freeze (a reseller must still honor a freeze placed by another agency). § 3(e) lets twelve categories of recipient receive a report notwithstanding a freeze, including government entities and courts, a private collection agency 'for the sole purpose of assisting in the collection of an existing debt', existing creditors and their assignees reviewing or collecting the account, prescreening under the Fair Credit Reporting Act, child-support enforcement agencies, property-and-casualty insurance underwriting, and a credit-monitoring service the consumer subscribed to. § 3(d) lets a freeze lapse 'seven years from the date that the security freeze was put in place' unless the consumer removes it earlier; federal law has no such lapse. § 7(c)(2) lets an agency remove a freeze placed 'due to a material misrepresentation of fact', after written notice to the consumer. § 9 permits charges of up to $10 to place and $10 per temporary lift, never to remove — waived for an identity-theft victim who supplies a police report, and, for placement only, for a consumer 65 or older — but 15 U.S.C. § 1681c-1(i) requires the nationwide agencies it covers ('a consumer reporting agency described in section 1681a(p)', § 1681c-1(i)(1)(A)) to place and remove a freeze 'free of charge' for every consumer, so no consumer should be paying these Pennsylvania fees to a nationwide agency today; as to any other Pennsylvania consumer reporting agency the answer runs through § 1681t(b)(1)(J) preemption rather than through the federal free-freeze duty. Act 2024-33 § 5.4 (post-breach free report and monitoring): § 5.4(b) states the trigger directly — 'Notwithstanding any other provision of law, an entity shall be subject to the requirements of this section' where the entity determines that a breach of the security of the system has occurred and reasonably believes a first and last name, or first initial and last name, was accessed in combination with a Social Security number, bank account number, or driver's license or State ID number. Section 5.4(a) opens by placing the cost duty on 'An entity that provides notification under section 5 and meets the requirements of subsection (b)', and § 5, as amended by the same act, requires an entity notifying 'more than [1,000] 500 persons at one time' to notify the nationwide consumer reporting agencies; whether that 500-person figure is thereby carried into § 5.4 as a limit on an individual's entitlement is not settled by the statutory text, and § 5.4(b)'s 'notwithstanding' clause cuts against reading it that way. The 500-person figures are in any event counts of how many people an entity notified, not measures of how badly any one person was harmed; a separate one, notice to 'more than 500 affected individuals in this Commonwealth', triggers concurrent notice to the Attorney General under § 3(c.1). The free report is owed only 'if the individual is not eligible to obtain an independent credit report from a consumer reporting agency for free' under federal law, and the entity 'may satisfy' the 12-month monitoring duty 'by providing notice to the individual of the availability of monitoring services for a period of 12 months at no cost to the individual' — so this is not a promise that the entity will buy monitoring for you. The section takes effect 90 days after the act's approval on June 28, 2024 (September 26, 2024) and does not reach earlier breaches. Fair Credit Extension Uniformity Act § 4(b)(5)(viii): reaches creditors and debt collectors collecting a consumer debt only; it is enforced through the Unfair Trade Practices and Consumer Protection Law with that law's ascertainable-loss and purchase-or-lease standing requirements, carries a bona fide error defense and a two-year limitation, and the Eastern District of Pennsylvania has held the credit-reporting theory preempted by 15 U.S.C. § 1681t(b)(1)(F) — the decision of a single district judge in Levy-Tatum v. Navient rather than binding appellate precedent, but enough that a furnisher can be expected to raise the defense, which leaves the federal claim on the firmer footing.

Defeasible rules

Security-freeze fee waivers under the Credit Reporting Agency Act § 9(b) are not uniform. Section 9(b)(1) waives the charge for both placing and temporarily lifting a freeze where the consumer "is a victim of identity theft and provides, or has provided, the consumer reporting agency with a copy of a police report"; § 9(b)(2) waives only the placement charge where the consumer "is 65 years of age or older", leaving the up-to-$10 temporary-lift charge in § 9(a) intact for age alone.

Read the full rule

The fee scheme is in any event a dead letter in practice at the agencies federal § 1681c-1(i) covers — "a consumer reporting agency described in section 1681a(p)" (§ 1681c-1(i)(1)(A)) — because that subsection requires those agencies to place and to remove a freeze "free of charge"; as to any other Pennsylvania consumer reporting agency the § 9 charges are displaced, if at all, through § 1681t(b)(1)(J) preemption rather than through the federal free-freeze duty. A freeze may be lifted or removed without the consumer's request where the report "was frozen due to a material misrepresentation of fact by the consumer or other person", after prior written notice (§ 7(c)(2)). The § 9(c) confirmation duty has its own carve-out: "Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings or transposition of numbers or letters." The Attorney General's UTPCPL action under § 10 is discretionary; a consumer cannot compel it and has no private substitute. FCEUA liability is defeated where the creditor or debt collector "shows by a preponderance of the evidence that the violation was both not intentional and" resulted from "a bona fide error, notwithstanding the maintenance of procedures reasonably adapted to avoid any such error" or from "good faith reliance upon incorrect information offered by any person other than an agent, servant or employee" (§ 5(d)); and an FCEUA/UTPCPL credit-reporting claim faces a § 1681t(b)(1)(F) preemption defense that the Eastern District of Pennsylvania accepted in Levy-Tatum v. Navient — the decision of a single district judge rather than binding Third Circuit precedent, and framed around conduct related to furnishing information to a consumer reporting agency. Under federal law, a private damages claim against a furnisher fails if it rests on the general accuracy duties of 15 U.S.C. § 1681s-2(a), because § 1681s-2(c) provides that §§ 1681n and 1681o "do not apply to any violation of" subsection (a); the claim must rest on subsection (b). A common-law defamation, invasion-of-privacy or negligence claim about the reporting of information is defeated by § 1681h(e) where it is based on information disclosed under §§ 1681g, 1681h or 1681m, or disclosed by a user of a report to or for a consumer against whom the user took adverse action — except as provided in §§ 1681n and 1681o — unless the consumer shows "false information furnished with malice or willful intent to injure such consumer". The post-breach duties in Act 2024-33 § 5.4 are conditional in several ways. Section 5.4(b) sets the trigger directly: "Notwithstanding any other provision of law, an entity shall be subject to the requirements of this section" where the entity determines that a breach of the security of the system has occurred and "reasonably believes" a consumer's name was accessed together with a Social Security number, bank account number, or driver's license or State ID number. The more-than-500 figure is a threshold in two other sections, not in § 5.4(b): § 5, as amended by Act 33, requires an entity notifying "more than [1,000] 500 persons at one time" to notify the nationwide consumer reporting agencies, and § 3(c.1) requires concurrent notice to the Office of Attorney General when notice must be given to "more than 500 affected individuals in this Commonwealth". Whether § 5.4(a)'s opening reference to "An entity that provides notification under section 5" carries that 500-person threshold into § 5.4 is not settled by the statutory text, and § 5.4(b)'s "notwithstanding" clause cuts against reading it that way. The free credit report is owed only "if the individual is not eligible to obtain an independent credit report from a consumer reporting agency for free" under federal law (§ 5.4(a)(1)); and the entity "may satisfy the requirements of this paragraph by providing notice to the individual of the availability of monitoring services for a period of 12 months at no cost to the individual" (§ 5.4(a)(2)), so it need not purchase the service or reimburse the consumer for one. Act 33 "shall take effect in 90 days" from its approval on June 28, 2024 — September 26, 2024 — so § 5.4 imposed no duty before that date.

Enforcement agency

Pennsylvania Office of Attorney General — consumer complaints are submitted at https://www.attorneygeneral.gov/submit-a-complaint/consumer-en/.

Read the full rule

Its authority under the Credit Reporting Agency Act reaches only violations of that act — security freezes — and § 10 gives that office 'exclusive authority to bring an action' for them; that section does not describe the office's separate powers under the Unfair Trade Practices and Consumer Protection Law generally. A complaint asks the Attorney General to act; it does not start a case of your own and does not itself produce money for you. No Pennsylvania agency enforces credit-report accuracy or reinvestigation deadlines, because Pennsylvania has not legislated on them: those rights are federal, are enforced privately in court under the FCRA, and are also handled at the federal level by the Consumer Financial Protection Bureau.

Medical debt rules

No Pennsylvania overlay. As of September 2026, Pennsylvania has no statute restricting the reporting of medical debt to consumer reporting agencies: no waiting period, no dollar threshold, no ban. What may appear on a consumer report is governed instead by federal law — 15 U.S.C.

Read the full rule

§ 1681c is the provision § 1681t(b)(1)(E) describes as 'relating to information contained in consumer reports' — and, beyond the statute, by the nationwide agencies' own reporting policies, which are not Pennsylvania law and give a Pennsylvania consumer no state-law claim. Claims that 'Pennsylvania prohibits reporting medical debt' are not supported by any enacted Pennsylvania statute. The nearest pending measure is HB 79 of 2025 ('Pennsylvania Medical Debt Relief Program'), which passed the House 187-16 on May 13, 2025 and was referred to the Senate Health and Human Services Committee on May 22, 2025; it is not law, and as passed it sets hospital financial-assistance requirements rather than credit-reporting rules.

Relationship to fcra

Pennsylvania supplements the FCRA only with (a) a 2006 security-freeze statute and (b) a 2024 duty on breached entities to provide a credit report and credit monitoring after a data breach. On the terms the freeze statute and federal 15 U.S.C.

Read the full rule

§ 1681c-1(i) (2018) address in the same way — placement, temporary lift, removal and fees — the state law is slower, costlier or the same, and § 1681t(b)(1)(J) preempts state law on that subject matter. Two terms are not like-for-like. Pennsylvania § 4 requires a unique personal identification number or password within ten business days of the request, while federal § 1681c-1(i)(2)(B) requires confirmation of the placement and an authentication mechanism within 5 business days of placing the freeze. And the Pennsylvania freeze lapses seven years after it is placed (§ 3(d)), where federal § 1681c-1(i)(3)(C) provides that, except where the freeze was placed due to a material misrepresentation of fact by the consumer, "a security freeze shall remain in place until the consumer directly requests that the security freeze be removed". One Pennsylvania requirement has no federal counterpart: § 9(c)'s written confirmation, within 30 days, of a change to a consumer's name, date of birth, Social Security number or address while a freeze is in place — a duty that does not reach "technical modifications of a consumer's official information, including name and street abbreviations, complete spellings or transposition of numbers or letters". It is not a consumer remedy — § 10 gives the Attorney General "exclusive authority to bring an action" — and it faces the same preemption question. Pennsylvania has no protected-consumer freeze at all; that route exists only under federal § 1681c-1(j), which defines a protected consumer as an individual "under the age of 16 years at the time a request for the placement of a security freeze is made" or "an incapacitated person or a protected person for whom a guardian or conservator has been appointed" — so a 16- or 17-year-old is outside it, and it is not a general minors' provision. Pennsylvania does not regulate reinvestigation, accuracy, disclosures, adverse action, obsolescence, medical debt, employment use, or damages, and the one provision touching furnisher conduct — FCEUA § 4(b)(5)(viii) — was held preempted by § 1681t(b)(1)(F) in Levy-Tatum v. Navient, the decision of a single Eastern District of Pennsylvania judge rather than binding Third Circuit precedent. Federal law is the ceiling in a second sense as well: where the claim is based on information disclosed under §§ 1681g, 1681h or 1681m, or on information a user of a report disclosed to or for a consumer against whom the user took adverse action based in whole or in part on the report, § 1681h(e) bars common-law defamation, invasion-of-privacy and negligence claims about the reporting of information against consumer reporting agencies, users of reports and furnishers — except as provided in §§ 1681n and 1681o, and except as to false information furnished with malice or willful intent to injure the consumer. For a Pennsylvania consumer the FCRA is therefore both the floor and, in practice, the ceiling of credit-reporting rights.

Security freeze rules

Pennsylvania Credit Reporting Agency Act (Act 2006-163, never amended): the request goes to the agency by certified mail at an address it designates or through a secure Internet connection (§ 3(a)(1)); the agency must place the freeze 'no later than five business days after receiving a request' (§ 3(a)(3)); it must…

Read the full rule

send written confirmation with a unique PIN or password 'no later than ten business days' after the request (§ 4); it must act on a temporary lift or a removal 'no later than three business days after receiving the request' (§ 7(b)); and the freeze lapses at 'seven years from the date that the security freeze was put in place' unless the consumer removes it sooner (§ 3(d)). Enforcement belongs to the Attorney General alone: a violation is deemed an unfair or deceptive act or practice, but 'The Office of Attorney General shall have exclusive authority to bring an action' for it (§ 10), so a consumer has no private action for a freeze violation. On fees, § 9 has to be read together with the federal rule. Section 9(a) says an agency 'may impose' a charge of up to $10 to place a freeze and up to $10 per temporary lift, and may never charge to remove one. The § 9(b) waivers are not the same for the two groups the statute names: an identity-theft victim who gives the agency a copy of a police report is charged nothing to place a freeze and nothing to temporarily lift it, while a consumer '65 years of age or older' is exempt only from the placement charge — on the face of § 9(b)(2) the temporary-lift charge is not waived for that consumer. In practice, though, neither charge should be reaching a consumer who places a freeze at one of the nationwide agencies. Since 2018, 15 U.S.C. § 1681c-1(i) has required a consumer reporting agency covered by that subsection — a nationwide agency, as § 1681c-1(i)(1)(A) defines the term there — to place a freeze 'free of charge' within 1 business day of a toll-free telephone or secure electronic request and 3 business days of a mailed one, and to remove a freeze 'free of charge' within 1 hour of an electronic request or 3 business days of a mailed one; a temporary removal for the period the consumer specifies is carried out under that same free-of-charge removal provision (§ 1681c-1(i)(3)(E)). Section 1681t(b)(1)(J) preempts state law on the subject matter of § 1681c-1(i) and (j). The Pennsylvania fee schedule, including the gap left by § 9(b)(2), is a dead letter at the nationwide agencies where a consumer actually places a freeze: a consumer 65 or older who is asked there for $10 to lift a freeze is being charged for something federal law makes free. Federal law is also faster on the deadlines that matter most, and it puts no seven-year lapse on a freeze. It is not more protective on every term. Act 163 § 9(c) requires an agency, while a freeze is in place, to send written confirmation of a change to the consumer's name, date of birth, Social Security number or address 'within 30 days of the change being posted', and an address change must be confirmed to both the new and the former address; § 1681c-1(i) contains no equivalent duty. Three things limit what that duty is worth. It does not reach 'technical modifications of a consumer's official information, including name and street abbreviations, complete spellings or transposition of numbers or letters'. Only the Attorney General may enforce it (§ 10). And because it governs what an agency must do while a security freeze is in place, whether § 1681t(b)(1)(J) preempts it as state law on the subject matter of § 1681c-1(i) and (j) is an open question, not a settled point in the consumer's favor. Note also that the federal and Pennsylvania confirmation duties are not the same duty: § 1681c-1(i)(2)(B) gives the agency 5 business days after it places the freeze to confirm the placement and tell the consumer how to remove it, while Act 163 § 4 gives ten business days from the request to send a PIN or password. The Pennsylvania act also has no freeze for children or for adults under guardianship. That gap is covered federally by 15 U.S.C. § 1681c-1(j), which requires an agency to place a freeze 'free of charge' within 1 business day (toll-free telephone or secure electronic means) or 3 business days (mail) for a 'protected consumer' — defined as an individual 'under the age of 16 years at the time a request for the placement of a security freeze is made' or 'an incapacitated person or a protected person for whom a guardian or conservator has been appointed'. The request is made by the protected consumer's representative with sufficient proof of identification and of authority, and § 1681c-1(j)(1)(F) counts a court order, a valid power of attorney, a government document showing proof of parentage 'including a birth certificate', or a foster-care certification as sufficient proof of authority, so a parent generally does not need a guardianship order. The age line matters: a 16- or 17-year-old is not a 'protected consumer' under that definition, and the statute does not say how an agency must handle a freeze request made for one. For a Pennsylvania consumer dealing with a nationwide agency, the freeze deadlines that actually govern are therefore the federal ones in § 1681c-1(i) and (j) rather than the Pennsylvania ones.

Reinvestigation days note

No Pennsylvania overlay — Pennsylvania has no reinvestigation deadline of its own, so the only deadline a Pennsylvania consumer can hold a consumer reporting agency to is the federal one. Under 15 U.S.C.

Read the full rule

§ 1681i(a)(1)(A) the agency must complete a reasonable reinvestigation 'before the end of the 30-day period beginning on the date on which the agency receives the notice of the dispute from the consumer or reseller' — calendar days, not business days: where the statute means business days it says so, as in the '5-business-day period' for notifying the furnisher under § 1681i(a)(2)(A). That period 'may be extended for not more than 15 additional days' under § 1681i(a)(1)(B) if the agency receives relevant information from the consumer during it, subject to the limits in § 1681i(a)(1)(C). Where the consumer disputes after obtaining a consumer report under § 1681j(a) — the free disclosure available once in any 12-month period — a different deadline applies: § 1681j(a)(3) requires that reinvestigation to be 'completed not later than 45 days after the date on which the request is received'. No such state deadline has ever been enacted here: HB 2251 of 1991 was referred to the House Consumer Affairs Committee on Dec. 9, 1991 and never advanced.

Who is liable scope limit

Under Pennsylvania's Credit Reporting Agency Act only a "consumer reporting agency" — defined in § 2 as "Any person who, for monetary fees, dues or on a cooperative basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties" — bears any duty, and § 10 gives the Office of Attorney General "exclusive authority to bring an action" for a violation.

Read the full rule

A consumer has no private action under that act and cannot substitute one through the UTPCPL. Furnishers, creditors, landlords, employers and users of reports have no duty under it at all. The FCEUA reaches further but not usefully: § 4(b) applies "With respect to debt collection activities of creditors in this Commonwealth", and only to a "debt" arising out of a consumer purchase, lease or loan (§ 3). Apart from that FCEUA/UTPCPL route — which the Eastern District of Pennsylvania held preempted by § 1681t(b)(1)(F) in Levy-Tatum v. Navient, the decision of a single district judge rather than binding Third Circuit precedent, so that a furnisher has a ready defense rather than a certainty — no Pennsylvania statute gives a consumer a private claim against any party for credit-reporting conduct. A Pennsylvania consumer's claim therefore arises under federal law: § 1681o(a) makes a person who "is negligent in failing to comply" with the FCRA liable for "any actual damages sustained by the consumer as a result of the failure" plus costs and reasonable attorney's fees, and § 1681n(a) makes a person who "willfully fails to comply" liable for actual damages or, in the court's discretion within the statutory range, "damages of not less than $100 and not more than $1,000", together with "such amount of punitive damages as the court may allow" and fees. That range is awarded by a court on proof of willfulness and is framed by the statute as liability "with respect to any consumer"; it is not a fixed or guaranteed $1,000, and the section states no per-item multiplier. Two federal limits narrow the field further: against a furnisher, § 1681s-2(c) provides that §§ 1681n and 1681o "do not apply to any violation of" § 1681s-2(a), so private liability runs on the subsection (b) duty triggered by a dispute routed through a consumer reporting agency; and § 1681h(e), except as provided in §§ 1681n and 1681o, bars common-law defamation, invasion-of-privacy and negligence claims about the reporting of information against agencies, users and furnishers where the claim is based on information disclosed under §§ 1681g, 1681h or 1681m, or disclosed by a user of a report to or for a consumer against whom the user took adverse action, except as to "false information furnished with malice or willful intent to injure such consumer".

Federal preemption analysis

(1) Reinvestigation timing: 15 U.S.C. § 1681t(b)(1)(B) bars any state requirement on the subject matter of § 1681i, "relating to the time by which a consumer reporting agency must take any action, including the provision of notification to a consumer or other person, in any procedure related to the disputed accuracy of information in a consumer's file, except that this subparagraph shall not apply to any State law in effect on September 30, 1996".

Read the full rule

Pennsylvania had no such law on that date and has none now, so the only reinvestigation deadline available to a Pennsylvania consumer is the federal one. (2) Contents of reports / adverse or obsolete information: § 1681t(b)(1)(E) preempts state law on "information contained in consumer reports", again saving only laws in effect on September 30, 1996. Pennsylvania has no such law — no medical-debt reporting ban, no shorter obsolescence period. (3) Furnisher duties: § 1681t(b)(1)(F) preempts state law on "the responsibilities of persons who furnish information to consumer reporting agencies", saving only Mass. Gen. Laws ch. 93 § 54A(a) and Cal. Civ. Code § 1785.25(a). Pennsylvania's FCEUA § 4(b)(5)(viii) is not saved, and the Eastern District of Pennsylvania held in Levy-Tatum v. Navient (Jan. 7, 2016) that the FCRA "preempts any claim under Pennsylvania’s FCEUA, as brought through the UTPCPL, based upon conduct related to furnishing information to a credit reporting agency", following Grossman v. Trans Union (2014) and Jaramillo v. Experian (2001). These are district-court decisions, not binding Third Circuit precedent, and Levy-Tatum's holding is framed around furnishing information to a consumer reporting agency rather than around the FCEUA generally. The practical consequence is that a furnisher defendant has a well-supported preemption argument, and a Pennsylvania consumer's furnisher claim stands on firmer ground under § 1681s-2(b) than under the FCEUA. (4) Security freezes: § 1681t(b)(1)(J) preempts state law on the subject matter of subsections (i) and (j) of § 1681c-1, "relating to security freezes". The 2006 Credit Reporting Agency Act (up to $10 to place and $10 per temporary lift, five-business-day placement, three-business-day lift or removal, seven-year expiry, certified-mail request) is on that subject matter and has never been amended to conform, so a consumer reporting agency has a real preemption argument against a Pennsylvania-only freeze demand — and the federal rule is in any event more favorable (free of charge, 1 business day electronic placement, 1 hour electronic removal, no lapse while the consumer wants it). One Pennsylvania requirement, § 9(c)'s written confirmation within 30 days of a change to a consumer's name, date of birth, Social Security number or address, has no counterpart in § 1681c-1(i) or (j); whether it falls outside the preempted subject matter for that reason is not settled by the statutory text, and in any case only the Attorney General may sue on it under § 10. (5) UTPCPL generally: § 1681t(b) preempts by subject matter, so a UTPCPL claim against a consumer reporting agency about dispute handling or report contents meets the same (b)(1)(B) and (E) arguments, and the Credit Reporting Agency Act § 10 independently forecloses a private UTPCPL action for a freeze violation. (6) Common-law claims: separately from § 1681t, 15 U.S.C. § 1681h(e) provides that "Except as provided in sections 1681n and 1681o of this title", no consumer may bring an action "in the nature of defamation, invasion of privacy, or negligence with respect to the reporting of information" against a consumer reporting agency, a user of information or a furnisher, where the claim is "based on information disclosed pursuant to section 1681g, 1681h, or 1681m of this title" or on information "disclosed by a user of a consumer report to or for a consumer against whom the user has taken adverse action, based in whole or in part on the report" — and even then the bar does not apply "as to false information furnished with malice or willful intent to injure such consumer". Within that scope a Pennsylvania defamation or invasion-of-privacy theory against a bureau, a user or a furnisher fails unless malice or willful intent to injure can be shown; outside it, § 1681h(e) is not the obstacle. Net result: for a Pennsylvania consumer the enforceable footing is federal — §§ 1681i, 1681s-2(b), 1681n, 1681o and 1681c-1(i) — while Pennsylvania law adds no enforceable consumer right and one preemption trap in the FCEUA.

Reinvestigation days detail

Pennsylvania could not fix this by legislating today. 15 U.S.C. § 1681t(b)(1)(B) preempts state law on the subject matter of § 1681i, 'relating to the time by which a consumer reporting agency must take any action, including the provision of notification to a consumer or other person, in any procedure related to the disputed accuracy of information in a consumer's file, except that this subparagraph shall not apply to any State law in effect on September 30, 1996'.

Read the full rule

Pennsylvania had no such law in effect on that date, so nothing is grandfathered and there is no state deadline to set against a consumer reporting agency. The deadline a Pennsylvania consumer can actually enforce is therefore the federal one: 30 calendar days under § 1681i(a)(1)(A); up to 15 additional days under § 1681i(a)(1)(B), subject to the limits in § 1681i(a)(1)(C); and 45 days under § 1681j(a)(3) where the dispute followed a consumer report obtained under § 1681j(a). None of these periods is expressed in business days — where the statute means business days it says so, as in the '5-business-day period' for notifying the furnisher under § 1681i(a)(2)(A). The clock runs from the agency's receipt of the notice of the dispute, not from the date the consumer sent it, and the deadline has not been missed until the applicable period — plus any extension the agency is entitled to under § 1681i(a)(1)(B) — has actually run.

Statute of limitations detail

No Pennsylvania overlay — Pennsylvania has no private cause of action for credit-reporting violations to which a state limitation period could attach, so the deadline is the federal one in 15 U.S.C. § 1681p.

Read the full rule

An action to enforce FCRA liability 'may be brought in any appropriate United States district court, without regard to the amount in controversy, or in any other court of competent jurisdiction, not later than the earlier of' '2 years after the date of discovery by the plaintiff of the violation that is the basis for such liability' or '5 years after the date on which the violation that is the basis for such liability occurs'. Because the statute takes the earlier of the two dates, the 2-year discovery period is the one that expires first in the ordinary case, and the 5-year period is an outer ceiling rather than an extension: a consumer who learns of a violation four and a half years after it happened has about six months left, not two years. Two Pennsylvania periods are sometimes quoted and neither is the deadline for a consumer's credit-reporting claim: a UTPCPL action — which the Credit Reporting Agency Act § 10 reserves to the Attorney General for freeze violations — falls under the six-year catch-all in 42 Pa.C.S. § 5527(b), and a Fair Credit Extension Uniformity Act action carries a two-year period under FCEUA § 5(b), but federal district courts in Pennsylvania have held the FCEUA credit-reporting theory preempted by 15 U.S.C. § 1681t(b)(1)(F) — district-court decisions, not binding Third Circuit precedent.

Read it yourself

Official sources. If a number below matters to your case, open the statute and read it — laws get amended, and cities often stack stricter local rules on top.

• Credit Reporting Agency Act, Act of Nov. 29, 2006, P.L. 1463, No. 163, title and § 1
• Credit Reporting Agency Act § 2 (definition of consumer reporting agency)
• Credit Reporting Agency Act § 3(a)(1), (a)(3), (d)
• Credit Reporting Agency Act § 3(a)(4) (entities not required to place a freeze)
• Credit Reporting Agency Act § 4 (confirmation and PIN within ten business days)
• Credit Reporting Agency Act § 7(b), (c)
• Credit Reporting Agency Act § 9(a), (b) (fees and fee exceptions)
• Credit Reporting Agency Act § 9(c) (written confirmation of identity-data changes)
• Credit Reporting Agency Act § 10 (civil relief — Attorney General exclusive) and § 11 (effective date)
• palegis.us law-information page for Act No. 163 of 2006 (amendment history)
• HB 2251 of 1991 (Consumer Credit Report Disclosure and Reinvestigation Act) — bill history
• Fair Credit Extension Uniformity Act, Act of Mar. 28, 2000, P.L. 23, No. 7, § 4(b)(5)(viii)
• Fair Credit Extension Uniformity Act § 4(b) (creditor scope) and § 3 (definition of debt)
• Fair Credit Extension Uniformity Act § 5(a), (b), (d) (UTPCPL remedy, two-year limit, bona fide error defense)
• Unfair Trade Practices and Consumer Protection Law, Act of Dec. 17, 1968, P.L. 1224, No. 387, § 9.2(a) (private actions)
• Unfair Trade Practices and Consumer Protection Law § 8(b) (civil penalties, Attorney General / District Attorney only)
• Breach of Personal Information Notification Act § 5.4 (added by Act of Jun. 28, 2024, P.L. 427, No. 33, § 3) and § 4 (effective date)
• 42 Pa.C.S. § 1515(a)(3) (magisterial district judge civil jurisdiction)
• 42 Pa.C.S. § 5527(b) (six-year catch-all limitation)
• 18 Pa.C.S. § 4120(a) (identity theft — criminal, not a credit-reporting right)
• 15 U.S.C. § 1681t(b)(1)(B), (E), (F), (J)
• Levy-Tatum v. Navient and Sallie Mae Bank, No. 15-3794 (E.D. Pa. Jan. 7, 2016) (Dalzell, J.), memorandum at 19–20 (FCEUA credit-reporting claim preempted by § 1681t(b)(1)(F))
• HB 79 of 2025 (Pennsylvania Medical Debt Relief Program) — bill history, not law
• Pennsylvania Office of Attorney General — consumer complaint page
• 15 U.S.C. § 1681i(a)(1)(A), (B), (C) (30-day reinvestigation period; 15-day extension; limits on the extension)
• 15 U.S.C. § 1681i(a)(2)(A) (notice to the furnisher within the '5-business-day period' — the business-day form the statute uses where it means business days, in contrast with the 30-day period in (a)(1)(A))
• 15 U.S.C. § 1681j(a)(3) (45-day reinvestigation period where the request follows a consumer report obtained under § 1681j(a); set 'Notwithstanding the time periods specified in section 1681i(a)(1)')
• 15 U.S.C. § 1681p (jurisdiction of courts; limitation of actions — the earlier of 2 years from discovery or 5 years from the violation)
• 15 U.S.C. § 1681n(a) (civil liability for willful noncompliance — actual damages or $100 to $1,000, punitive damages, costs and fees)
• 15 U.S.C. § 1681n(b) (the section's second 'whichever is greater' $1,000 — liability to the consumer reporting agency, not to the consumer)
• 15 U.S.C. § 1681n(c) (fees awarded against a party whose paper was filed in bad faith or for harassment)
• 15 U.S.C. § 1681o(a), (b) (civil liability for negligent noncompliance — actual damages plus costs and fees on a successful action; reverse fee-shifting)
• 15 U.S.C. § 1681h(e) (limitation of liability — common-law defamation, invasion-of-privacy and negligence actions barred except for false information furnished with malice or willful intent to injure)
• 15 U.S.C. § 1681c-1(i)(1)(A) (the national security freeze subsection covers nationwide consumer reporting agencies)
• 15 U.S.C. § 1681c-1(i)(2)(A) (free placement of a security freeze, 1 business day electronic / 3 business days by mail)
• 15 U.S.C. § 1681c-1(i)(3)(C) (free removal of a security freeze, opening exception clause included)
• 15 U.S.C. § 1681c-1(i)(3)(E) (temporary removal is carried out under the free-of-charge removal provision)
• 15 U.S.C. § 1681c-1(i)(2)(B) (federal confirmation of freeze placement within 5 business days)
• 15 U.S.C. § 1681c-1(j)(1)(B) (definition of protected consumer)
• 15 U.S.C. § 1681c-1(j)(1)(F) (sufficient proof of authority)
• 15 U.S.C. § 1681c-1(j)(2)(A) (free placement of a protected-consumer security freeze)
• Credit Reporting Agency Act § 9(c), closing paragraph (technical modifications excepted; address change confirmed to both addresses)
• Breach of Personal Information Notification Act § 5, as amended by Act of Jun. 28, 2024, P.L. 427, No. 33, § 2 (500-person notification threshold cross-referenced by § 5.4(a))
• Breach of Personal Information Notification Act § 5.4(c) (duty to inform the individual of the no-cost services), added by Act of Jun. 28, 2024, P.L. 427, No. 33, § 3
• 15 U.S.C. § 1681j(a)(1)(A) (free annual disclosure from nationwide consumer reporting agencies)
• 15 U.S.C. § 1681j(a)(1)(B) (free annual disclosure conditioned on use of the centralized source)
• 15 U.S.C. § 1681i(a)(1)(A) (30-day reinvestigation)
• 15 U.S.C. § 1681i(a)(1)(B) (15-day extension)
• 15 U.S.C. § 1681i(a)(1)(C) (no extension where the information is found inaccurate, incomplete or unverifiable)
• 15 U.S.C. § 1681i(a)(6)(A) (written notice of results within 5 business days)
• 15 U.S.C. § 1681j(a)(1)(A) (free annual disclosure)
• 15 U.S.C. § 1681j(a)(3) (45-day reinvestigation after a free annual disclosure)
• 15 U.S.C. § 1681c-1(i)(2)(B) (confirmation of freeze placement within 5 business days)
• 15 U.S.C. § 1681c-1(i)(3)(C) (federal freeze remains in place until the consumer asks for removal)
• 15 U.S.C. § 1681h(e) (limitation of liability — scope of the common-law bar)
• 15 U.S.C. § 1681h(e) (malice / willful intent to injure exception)
• 15 U.S.C. § 1681s-2(b)(1) (furnisher duties on notice of dispute)
• 15 U.S.C. § 1681s-2(b)(1)(D), (E) (report to other nationwide agencies; modify, delete or block — for reporting purposes only)
• 15 U.S.C. § 1681s-2(b)(2) (furnisher deadline tied to § 1681i(a)(1))
• 15 U.S.C. § 1681s-2(c) (no private damages for § 1681s-2(a) violations)
• 15 U.S.C. § 1681n(a) intro and (a)(1)(A) (willful noncompliance: actual damages or $100–$1,000)
• 15 U.S.C. § 1681n(a)(2), (a)(3) (punitive damages at the court's discretion; costs and fees)
• 15 U.S.C. § 1681o(a) (negligent noncompliance: actual damages plus costs and fees)
• Credit Reporting Agency Act, Act of Nov. 29, 2006, P.L. 1463, No. 163, § 9(c) (technical-modification carve-out; address-change confirmation)
• Breach of Personal Information Notification Act § 5.4(b) as added by Act of Jun. 28, 2024, P.L. 427, No. 33, § 3 (trigger for the credit-reporting and monitoring duty)
• Breach of Personal Information Notification Act § 5 as amended by Act of Jun. 28, 2024, P.L. 427, No. 33, § 2 (more-than-500 trigger for notification of consumer reporting agencies)
• Breach of Personal Information Notification Act § 3(c.1) as added by Act of Jun. 28, 2024, P.L. 427, No. 33, § 1.1 (more-than-500 trigger for notice to the Attorney General)
• Credit Reporting Agency Act — official act designation, long title and § 1 (short title), Act of Nov. 29, 2006, P.L. 1463, No. 163
• Credit Reporting Agency Act § 3(e) (twelve categories that may receive a report notwithstanding a security freeze)
• Act of Jun. 28, 2024, P.L. 427, No. 33, § 1 (identifying the act it amends: Breach of Personal Information Notification Act, act of December 22, 2005, P.L.474, No.94)
• Breach of Personal Information Notification Act § 3(c.1) and § 3(c.2) (notice to the Attorney General when more than 500 affected individuals must be notified; insurance-data-security exemption), added by Act of Jun. 28, 2024, P.L. 427, No. 33, § 1.1
• Breach of Personal Information Notification Act § 5 as amended by Act of Jun. 28, 2024, P.L. 427, No. 33, § 2 (500-person threshold for notifying nationwide consumer reporting agencies)
• 42 Pa.C.S. § 1123(a)(4) (Philadelphia Municipal Court civil jurisdiction — $12,000 ceiling, three classes of action, waiver of excess, no jury trial, appeal de novo, small-claims purpose) — complete paragraph, replacing the truncated entry
• 15 U.S.C. § 1681p (jurisdiction of courts; limitation of actions)
• 15 U.S.C. § 1681c-1(i)(1)(A) (the agencies the federal free-freeze duty covers) and § 1681c-1(i)(2)(A) (free-of-charge placement)

Last checked: 2026-09-07