Say a credit bureau hands your file to the wrong person. Maybe it was a stranger, or an employer who had no business seeing it. Federal law gives you real tools here, though the public sources are thin on what to do about the recipient. This piece covers what the law says, what you can ask for, and how to push back.

Soft daylight on a kitchen table with a partly open folder of papers, a pen and a cup of coffee, suggesting a quiet moment of reviewing personal documents.
A folder, a pen and a cup of coffee at the kitchen table: the setting where most people sit down to read their own file.

Why a file can only be shared for a permissible purpose

The Fair Credit Reporting Act is the main federal law on how consumer reporting companies use and share credit and background reports. A company needs a permissible purpose to share one. A request alone is not enough. The Federal Trade Commission publishes the statute.

The CFPB has said the same thing in plain terms. Its July 2022 advisory opinion states that credit reporting companies and the users of reports have specific duties to protect data privacy. It also reminds covered entities of potential criminal liability for certain misconduct, as described in the CFPB advisory opinion. That is a statement of what companies owe. It does not promise any outcome for you.

A wrong-person disclosure often traces back to a mixed file. The CFPB's January 2024 advisory says background reports must be complete and accurate. They should be free of duplicate, outdated, expunged or sealed information. The CFPB file disclosure advisory covers this. The sources do not say whether a mismatch caused any particular disclosure, so treat that as a question to ask, not a conclusion.

Your right to see your file and its sources

You can ask a reporting company for everything in your file. The January 2024 advisory says you are entitled to all of it at the time you ask. That includes the source of the information, whether original or an intermediary or vendor, per the same CFPB advisory.

Asking for your file is not a dispute. It is a way to read what the company holds. Look for accounts that are not yours, a name or address that does not fit, and entries that seem outdated or duplicated. The sources do not give exact request steps, forms or contact methods, so the bureau's own instructions and the CFPB and FTC sites are the places to start.

Here is a short checklist to bring to that review:

  1. Did the company give you everything in the file, with the source of each item?
  2. Is any item incomplete, inaccurate, outdated, or about someone else?

Disputing what you find

You have the right to dispute incomplete or inaccurate information. Once you notify the company, it must investigate unless it decides the dispute is frivolous, according to the CFPB guidance on dispute results.

You can dispute with the reporting company and with the business that supplied the information. The CFPB advises disputing with both, not relying on one. Disputes are generally free and usually resolved within 30 days, as the CFPB dispute guidelines explain.

If the item came from identity theft, or simply is not about you, you can dispute it, and the companies should remove it. That word is "should." The sources do not call it an absolute guarantee. Write down the date of each contact and keep copies of what you send.

If the response is not good enough

An investigation can end without fixing the problem. If the company does not respond adequately, you can add a brief statement of the dispute to your file. That right applies only to disputes you sent to the reporting company, not to ones sent only to the furnisher.

You can also sue. Violators can be liable for damages and attorney fees. A company that willfully fails to comply can face actual or statutory damages and punitive damages. Time limits apply to these suits, but the sources do not say how long you have. Find the deadline early, and consider asking a lawyer or a legal aid group.

You can also submit a complaint to the CFPB about a credit reporting company or credit repair problem. The CFPB forwards it to the company.

  1. Dispute with both the reporting company and the company that gave it the wrong information.
  2. Keep track of any lawsuit deadline, because time limits apply.

Red flags and what the sources leave out

Be wary of anyone who says they can remove current, accurate, negative information for a fee. The CFPB says that is probably a credit repair scam. Most negative information stays on a report for seven years, with some types remaining longer. Paying someone to dispute errors is unnecessary, since you can do it yourself for free.

The public sources leave real gaps. They do not explain how to learn who received your file, or how to report an unauthorized disclosure. They do not cover state laws, security freezes or fraud alerts. They do not say how to check who has accessed your file. Nor do they say what remedies apply to a permissible-purpose violation beyond general liability.

So the practical path is narrow but real. Get your full file with its sources. Dispute every error with both companies. Complain to the CFPB if the response falls short. For the question of who saw your file, ask the bureau in writing and consider legal help.

Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.