Brenda Thornton sued a credit reporting agency, Equifax, Inc., under the Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq. (FCRA), for defamation and failure to comply with the Act's requirements. She also filed a common law count of libel. Appellant Equifax now appeals from the jury verdict awarding Brenda $5,000 compensatory and $250,000 punitive damages. We reverse and remand for a new trial.

At the time of trial, Brenda Thornton was twenty-nine years of age, divorced and the mother of one child. She first became aware of a credit report containing the statement that she had been "for the past four months * * * living without benefit of matrimony with male companion," when her local car insurance agent called her requesting information on this male companion. Although Brenda's insurance coverage was effective when she filed the application, this was not immediately realized by her. She was upset with the information in the report and requested its source. Referred to appellant, Equifax, as the compiler of the report, Brenda wrote the investigator denying the report and threatening to sue. The letter was forwarded to the regional office of Equifax in Memphis by the investigator, Ben Metheny.

Equifax offered to discuss the report, sent Brenda a brochure outlining the procedures for disclosure under the FCRA, read the information concerning the male companion to appellee, and ordered a reinvestigation. Brenda requested the report be taken from her record and the sources revealed. Metheny, upon reinvestigation, contacted his original two sources, four other sources, and appellee herself. Two of the new sources did not know of anyone in the household other than appellee and her child. Not all of the sources supported Metheny's testimony concerning these conversations at the time of trial.

After reinvestigation, Metheny prepared an alternate report deleting the objectionable information. He testified that he felt the submission of this report was a management decision and sent this report to the regional office. Mr. C. A. Grobe, regional manager, did not send this new report to the insurance company as he decided the first report was accurate. Eventually, Grobe, Brenda, Metheny and appellant's attorney met in Blytheville, Arkansas, in the office of appellee's counsel and Brenda was shown a copy of the report, the names of the sources being covered. She refused to sign a "consumers statement"1 which indicated her denial of the information and her request for an apology and monetary compensation because, as she testified, the sources were not disclosed. Grobe did write the insurance company that appellee emphatically denied the information in the report and described the results of all investigating efforts.

This factual situation was submitted to the jury with instructions provided by the trial court. These instructions included a recitation of the provisions of the FCRA as well as separate instructions on punitive and exemplary damages, malice, the state's "conditional privilege" given to mercantile reporting agencies, and the Arkansas statute providing that unmarried cohabitation constitutes a misdemeanor. A charge of the latter misdemeanor was instructed to constitute libel per se. We find these instructions to be confusing and erroneous and remand the case for a new trial.

The FCRA became effective in 1971. Its provisions provide for the protection of the reputation of the consumer while recognizing the legitimacy of credit reports as a necessary adjunct of commerce for consumer credit, personnel matters, insurance and other needed information. The Act provides for civil liability when a consumer reporting agency fails to comply with any of its requirements (15 U.S.C. §§ 1681n and 1681o ). In addition to costs and attorney fees, if such noncompliance is "willful" the damages can be both actual and punitive; if merely "negligent," the damages are restricted to actual damages. Sections 1681n and 1681o create liability only upon the violation of some other section of the Act. In other words, only noncompliance with a requirement so listed in other sections of the Act will trigger these liability sections. Hansen v. Morgan, 405 F. Supp. 1318, 1319 (D.Idaho 1976), rev'd on other grounds, 582 F.2d 1214 (9th Cir. 1978).

Actions or proceedings in the nature of defamation, invasion of privacy, or negligence with respect to the reporting of information, however, are specifically provided for in the Act and are limited by the Act in section 1681h(e). If such actions are based on information disclosed pursuant to requirements of the Act, a consumer may not bring any such action or proceeding unless the relevant information is false and furnished "with malice or willful intent to injure such consumer."2 Section 1681h(e) is recognized as providing qualified immunity for consumer reporting agencies with an exception from such qualified immunity being made for actions pursuant to sections 1681n and 1681o (the liability sections providing for failure to comply with provisions or requirements of the Act). Such an exception was not meant to lessen the standard necessary to overcome this qualified immunity in defamation actions. "It is clear that the qualified immunity provided for by the FCRA is meant by Congress to be the 'quid pro quo for full disclosure.' " Retail Credit Co. v. Dade County, 393 F. Supp. 577, 584 (S.D.Fla.1975).

The limitation of section 1681h(e) is actually twofold. First, no defamation or like actions are allowed under the Act unless malice or willful intent is alleged. Peller v. Retail Credit Co., 359 F. Supp. 1235, 1237 (N.D.Ga.1973), aff'd, 505 F.2d 733 (5th Cir. 1974), or proved, Thomas v. Equifax, Inc., 142 Ga.App. 422, 236 S.E.2d 154, 155 (1977). Brenda Thornton did allege malice in this action.

Secondly, if the information is or has been disclosed to the person being investigated pursuant to the Act, consumer actions are not allowed unless within the qualifications of section 1681h(e). "(T)he Act does not preclude an action at common law except where information that would give rise to a cause of action is obtained by the complainant pursuant to the provisions of the Act." Hood v. Dun & Bradstreet, Inc., 486 F.2d 25, 32 (5th Cir. 1973), cert. denied, 415 U.S. 985, 94 S. Ct. 1580, 39 L. Ed. 2d 882 (1974) (emphasis added).

Under the facts of this case as previously related, Brenda Thornton was notified of the existence of the credit report when the insurance agent called her to obtain driving information on this new potential driver. Upon her request, the agency which compiled the report, Equifax, disclosed to her the contents of the report and provided her with information concerning the disclosure requirements under the FCRA. (The issue of whether or not the sources of such information should have been revealed will be discussed later in this opinion.) The fact that Brenda was originally notified of the existence of the information by the insurance company, the procurer of the report, does not make the conditional privilege of the Act inapplicable. Before Equifax has the obligation of disclosure, the consumer must make such a request.3 In all likelihood, such a request will not be made unless a consumer is aware of the existence of such a report containing unfavorable information. So that the consumer is notified, the Act itself requires notification of the consumer in some circumstances by the user of the consumer report. Section 1681m provides in relevant part:

(a) Whenever credit or insurance for personal, family, or household purposes, or employment involving a consumer is denied or the charge for such credit or insurance is increased either wholly or partly because of information contained in a consumer report from a consumer reporting agency, the user of the consumer report shall so advise the consumer against whom such adverse action has been taken and supply the name and addresses of the consumer reporting agency making the report.

The evidence showed that the insurance company in this case inquired as to this potential driver because such additional driver would be material to the risk that they would assume. The agent's call to Brenda in which she first became aware of the existence of the report was thus for the purpose of checking out this information considered to be relevant to this insurance coverage. Upon request, the insurance company quite properly referred Brenda to Equifax so that disclosure under the Act could proceed.4

In her amended complaint, Brenda charged that the material in the report was defamatory under the FCRA and that she had a cause of action under this Act for libel. As the information upon which Brenda bases this action was obtained by her pursuant to the provisions of the FCRA, she is required in her defamation action to prove "false information furnished with malice or willful intent to injure" as provided in section 1681h(e). Equifax by its disclosure is entitled to qualified immunity subject to the proof required by the statute. In a defamation action pursuant to proper disclosure under the Act, the Act can be said to preempt the state's common law at least to the extent that a qualified immunity exists and the standard of "malice or willful intent to injure" must be met by complainant to overcome this immunity.5

While Arkansas recognizes a conditional privilege of communication for mercantile reporting agencies, Dun & Bradstreet, Inc. v. Robinson, 233 Ark. 168, 345 S.W.2d 34, 38 (1961), the standard of proof required to overcome this privilege as provided in the trial court's instructions was not identical to that required in the applicable section of the FCRA. The jury instructions defined malice as both the doing of an act actuated by spite, grudge, hatred, or ill will and the doing of an act without just cause or excuse with conscious indifference or reckless disregard as to its results as to constitute ill will. However, the instruction went on to broaden the standard by adding maliciously, or wantonly or oppressively to the adjectives describing the act proximately causing the damage for which Equifax could be found liable. Oppressive was further defined as "an act or a failure to act * * * if done in a way or manner which injures, or damages, or otherwise violates the rights of another person with unnecessary harshness or severity, as by misuse or abuse of authority or power, or by taking advantage of some weakness * * *." The latter description is considerably wider than the Act's standard of "malice or willful intent to injure." Such general instructions were given for all allegations made and thus any distinction made by the Act for qualified immunity in defamation actions and damages for noncompliance complaints could easily have been confused by the jury.

Furthermore, local law applies only to matters of practice and procedure, but substantive rights created by the Act are controlled by federal law and are not subject to 50 different rules of interpretation. Emerson v. J. F. Shea Co., 76 Cal. App. 3d 579, 143 Cal. Rptr. 170, 176 (1978). The inclusion of the Arkansas statute instruction stating that unmarried cohabitation between a man and a woman was a misdemeanor in Arkansas and libelous per se was irrelevant to this action and could only have served to confuse the jury. We therefore believe that jurors deliberating on defamation actions under the FCRA should receive clear and concise instructions that fully direct their attention to the Act's qualified immunity section of 1681h(e) and its burden of proof standard requiring "malice or willful intent to injure" only.

While the Act itself does not define these terms, the Supreme Court in New York Times v. Sullivan, 376 U.S. 254, 84 S. Ct. 710, 11 L. Ed. 2d 686 (1964) did define the malice necessary to overcome a conditional privilege under the first amendment as "with knowledge that it was false or with reckless disregard of whether it was false or not." Id. at 279-280, 84 S.Ct. at 726. The qualified immunity under the Act, however, is not based upon a constitutional privilege as in New York Times nor has such protection been extended to credit reporting agencies in states lacking conditional privileges for such agencies. See Grove v. Dun & Bradstreet, Inc., 438 F.2d 433 (3d Cir. 1971), cert. denied, 404 U.S. 898, 92 S. Ct. 204, 30 L. Ed. 2d 175 (1971) and Hood v. Dun & Bradstreet, Inc., 486 F.2d 25, 29 (5th Cir. 1973), cert. denied, 415 U.S. 985, 94 S. Ct. 1580, 39 L. Ed. 2d 882 (1974). The qualified privilege under the Act is purely statutory and, as previously stated, is the "quid pro quo" for full disclosure. We cite the New York Times standard as an example of a type of malice necessary to overcome a qualified privilege. The instructions should define malice and willful intent to injure in terms which explain what is necessary to overcome the qualified privilege given by the statute.

The same standard of proof as required in section 1681h(e), however, is not required for allegations of noncompliance with the provisions and requirements of the Act (sections 1681n and 1681o ). Punitive damages awarded under section 1681n are within the discretion of the court and malice or evil motive need not be found for such award, but the violation must have been willful. Punitive damages are not permitted under section 1681o (negligent failure to comply). The jury instructions in this case did not make such distinctions. Attention should have been drawn to the different standards of proof required for the different allegations of defamation and noncompliance so as not to void the effect of the qualified immunity section of the Act. The instructions should have further defined what constituted noncompliance together with a proper definition of "willful" as it is used in section 1681n of the Act.

In a strictly noncompliance charge the failure to "follow reasonable procedures to assure maximum possible accuracy of the information" (section 1681e) will be subject to the liability of sections 1681n or 1681o ; but in a defamation action, any "negligence with respect to the reporting of information" will be subject to the higher requirement of proof of malice or willful intent to injure. No distinction in the charges were made here to guide the jury in reaching a verdict under the applicable law.

We, therefore, remand this case to the trial court for a new trial with instructions to separate any future jury instructions under the FCRA as to the allegations and standard of proof appropriate to a defamation action under the Act from those complaints of noncompliance as treated under the civil liability sections of the Act. We also agree with the Wyoming district court's opinion that "(t)he remedies provided by the Act are of a federal statutory nature, and thus defendant's contention that any right to relief in the form of damages is to be determined by state court decisions is ill-taken." Ackerley v. Credit Bureau of Sheridan, Inc., 385 F. Supp. 658, 661 (D.Wyo.1974).

As we remand for a new trial, we have no need to pass judgment on appellant's contention that the verdict was excessive. We do find, however, no error in the trial court's determination that appellant could only examine Brenda or the male companion of the report with reference to their sexual relationship during the four-month period mentioned in the initial report. Likewise, we cannot say that the trial court erred in the manner in which it provided appellant the opportunity to make an offer of proof regarding the excluded sexual testimony.

We do find error in the trial court allowing repeated questioning concerning appellant's failure to reveal to Brenda the sources of the information reported. The FCRA provides in section 1681g as follows:

(a) Every consumer reporting agency shall, upon request and proper identification of any consumer, clearly and accurately disclose to the consumer:

(1) The nature and substance of all information (except medical information) in its files on the consumer at the time of the request.

(2) The sources of information; except that the sources of information acquired solely for use in preparing an investigative consumer report and actually used for no other purpose need not be disclosed : Provided, That in the event an action is brought under this subchapter, such sources shall be available to the plaintiff under appropriate discovery procedures in the court in which the action is brought.

(Emphasis added.)

As Equifax's report was an "investigative consumer report" within the definition of the Act, appellant had no obligation to reveal such sources to Brenda prior to appropriate discovery procedures. The trial court allowed such questioning on the basis that the question reached into the area of damages. However, if the appellant by provision of the Act was not required to disclose its sources, appellee could not legally have been damaged by appellant refusing to make this disclosure prior to discovery. That this line of questioning was used by appellee's counsel to prejudice the jury is illustrated in his closing argument to the jury in which upon commenting on the provisions of disclosure he remarked: "In other words, the law doesn't say they have to do it. It says they need not do it in some instances. In all other instances, they're supposed to do it." Appellant need not defend a practice which under the Act is proper.

Reversed and remanded for a new trial consistent with the views expressed in this opinion.