Plaintiff-appellant Deborah Northrop appeals from a ruling of the United States District Court for the District of Connecticut (Alfred V. Covello, Judge), dismissing her complaint for failure to state a claim for relief under the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (1994) (“FCRA” or the “Act”). For the reasons set forth below, we vacate the ruling of the district court and remand the ease for further proceedings.
I.
In reviewing the dismissal of a complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure for failure to state a claim upon which relief can be granted, we must accept as true the facts alleged in the complaint and draw all reasonable inferences in the plaintiff’s favor. See McEvoy v. Spencer,
On or about September 25, 1995, Northrop was in the process of obtaining a mortgage to
As a result of Hoffman’s request for Northrop’s consumer credit report, Mortgage Master demanded that Northrop explain the basis for the inquiry by Hoffman. On or about October 3, 1995, Northrop contacted Hoffman to find out who had requested her consumer credit report and the reason for that request, but was given no answer. On or about October 5, 1995, Northrop was told by a Hoffman employee that Hoffman’s computerized records had been destroyed. Northrop’s subsequent telephone calls to Hoffman have not been returned.
Plaintiff claims that these actions interfered with her efforts to obtain a mortgage and inflicted emotional distress. She brings this action based on alleged violations of the FCRA and the Connecticut Unfair Trade Practices Act, Conn.Gen.Stat. § 42-110a et seq., seeking actual and punitive damages, costs, and attorney’s fees as well as equitable relief in the form of an injunction, enjoining all defendants from using or disclosing the contents of her credit report. The district court granted defendants’ motion to dismiss
II.
We review de novo the grant of a motion to dismiss under Rule 12(b)(6) for failure to state a claim upon which relief can be granted. See Allen v. WestPoint-Pepperell, Inc.,
Plaintiff-appellant’s Second Amended Complaint claimed that defendants violated 15 U.S.C. §§ 1681b, c, and/or e,
The district court, in dismissing plaintiff-appellant’s complaint, found that the defendants were not “consumer reporting agencies.” Although the only sections specifically alleged in plaintiff-appellant’s Second Amended Complaint to have been violated were sections relating to “consumer reporting agencies,” the district court recognized that the FCRA also imposes liability upon “users of information.” It found, however, that the only obligations placed upon “users” by the FCRA, and therefore the only basis for liability against them under § 1681n, are the disclosure obligations imposed by § 1681m “[w]henever credit ... is denied or the charge for such credit ... is increased.” 15 U.S.C. § 1681m.
On appeal, appellant does not contest the conclusion that defendants are not “consumer reporting agencies,” nor does she contest the fact that defendants did not deny her credit or increase the charge for credit. Rather, she argues that defendants can be held liable under § 1681n because they willfully violated the “requirement” imposed by § 1681q, a criminal provision of the FCRA that imposes penalties upon “[a]ny person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses.” (emphasis supplied). While the district court indicated that users of information can be held liable under § 1681n solely for violating the disclosure obligations of § 1681m, which apply only when “credit ... is denied or the charge for such credit ... is increased,” appellant argues that users of information may also be held civilly liable under § 1681n for violating § 1681q, which is incorporated into § 1681n. That is, appellant argues that § 1681q, prohibiting “any person” from procuring credit information under false pretenses, is among the FCRA “requirements” whose willful violation by users of information supports civil liability under § 1681n.
III.
As a preliminary matter, we must decide whether appellant is foreclosed from seeking relief under § 1681n pursuant to a violation of § 1681q by her failure to cite § 1681q in her Second Amended Complaint. We recognize that appellant’s failure to cite § 1681q as a potential basis for liability under § 1681n gave the district court little or no reason or opportunity to address this theory of liability. Nevertheless, appellant’s failure to cite the correct section of the
Northrop’s Second Amended Complaint did allege that defendants received her consumer credit report from a credit reporting agency while they were conducting no business with her of any kind, the natural implication of which is that they did so “under false pretenses.”
IV.
Defendants rely on DiGianni v. Stern’s,
In DiGianni, we held that the defendants in that case (department stores that had provided information to consumer reporting agencies regarding accounts that had been opened under plaintiff’s social security number) were not “consumer reporting agencies,” and therefore could not, under the particular circumstances of that case, be held liable under the FCRA.
also imposes certain obligations on “users” of consumer reports that deny credit or increase the charge for credit to consumers based on information contained in consumer reports issued by consumer reporting agencies, [15 U.S.C.] § 1681m_
*47 While [plaintiff] suggests on appeal that [defendants] are liable under the FCRA as users, she does not allege that either of them denied credit or increased the charge for credit to her on the basis of information supplied by reporting agencies. Accordingly, the only remaining issue is whether the appellees can be held liable under the provisions of the FCRA governing consumer reporting agencies.
Id. at 348.
In stating that the defendants in that case could not be held liable as “users” because they had not denied credit to plaintiff or increased the charge for credit, DiGianni cited § 1681m and clearly considered only that section. This is understandable, inasmuch as this is the only provision of the FCRA that explicitly imposes specific obligations upon “users.” However, neither § 1681m nor DiGianni (nor any other section of the FCRA, for that matter), define the term “user of information” under the Act. DiGianni did not restrict the definition of the term “user” to those situations governed by § 1681m — and therefore did not delimit the imposition of liability against “users” under § 1681n — but merely concluded that the defendants in that case did not fall within § 1681m. Not at issue in DiGianni, however, was § 1681q, a provision that imposes criminal liability upon “any person” who willfully obtains credit information under false pretenses. Inasmuch as there was no issue of any party procuring credit information under false pretenses in DiGianni, we had no reason to consider whether a “user of information” who violates § 1681q might be held liable under § 1681n. If in fact the “requirements” of the FCRA, the willful violation of which supports civil liability under § 1681n, include the requirement under § 1681q not to obtain credit information using false pretenses, then willful violation of this requirement also provides a basis for liability against “users of information.”
While we have not previously had occasion to rule on the question whether § 1681q states a “requirement” under the FCRA supporting liability under § 1681n, a number of other circuits have addressed the issue, and all have agreed that a civil cause of action is available. See Yohay v. City of Alexandria Employees Credit Union, Inc.,
We join the other Courts of Appeals that have ruled on the question in holding that § 1681n incorporates § 1681q. The plain language of § 1681n, imposing liability upon “user[s] of information which willfully fail[] to comply with any requirement imposed under [the FCRA],” appears on its face to encompass the “requirement” imposed by § 1681q not to obtain credit information under false pretenses. “Phrasing the ‘requirement’ as a thing prohibited or required not to be done rather than as an affirmative obligation does not deprive Section 1681q of its status as a requirement. Nor does imposition of criminal penalties for violation of Section 1681q rob it of its enforceability through Section 1681n.” Kennedy,
y.
Under the terms of § 1681n, defendants may only be held liable if they are “users of information,”
Courts have not ventured to offer any overarching definition or understanding of “users of information” for purposes of the FCRA. Indeed, some courts, apparently not troubled by the possibility that “users of information” might have any particularly restrictive meaning under § 1681n, have approved the imposition of liability under § 1681n pursuant to violations of § 1681q without even pausing to consider whether the defendants in those cases were “users of information.” See, e.g., Zamora,
Hoffman — an automobile dealership — is clearly a party that in the ordinary course of business would have occasion to request and receive credit reports from consumer reporting agencies for the permissible purposes described in § 1681b. It is therefore precisely the sort of party that would be expected to “use” credit reports under the Act. Presumably, it was by virtue of Hoffman’s being in this position that the individual defendants were able to obtain plaintiffs credit report from a consumer reporting agency. Whatever other types of parties Congress had in mind when it included the term “users of information” in § 1681n, we are convinced that Hoffman — a prototypical “user” of credit reports — qualifies.
The situation of the individual defendants in this case is somewhat more complicated. Whether an employee may be held hable as a “user of information” under § 1681n for violating § 1681q depends on whether the employee impermissibly obtained credit information for personal purposes, or merely in the ordinary course of employment. See Austin v. BankAmerica Service Corp.,
Accordingly, it may be possible for Northrop to prove that the individual defendants in this case qualify as “users,” either because they had personal, non-employment-related reasons for obtaining her report, or because they requested others to obtain the report on their behalf.
With regard to defendants John Doe # 1 and John Doe # 2, we are aware that they are alleged in plaintiffs Second Amended Complaint to have requested plaintiffs credit report “in the performance of his or their duties as employees of Hoffman” — a fact that, if proven, will shield these defendants from liability. Nonetheless, the fact that a eomplaint alleges facts that constitute a defense to plaintiffs claim does not in all cases require dismissal of the complaint. See 5 Charles Alan Wright & Arthur R. Miller,
YI.
For the reasons stated above, we vacate the district court’s dismissal of Northrop’s complaint, and remand the ease to the district court for further proceedings consistent with this opinion.
Notes
. The other defendants in this case are implicated by the following facts, alleged in plaintiff’s complaint “on information and belief.” Defendants John Doe # 1 and/or John Doe # 2, in the performance of his or their duties as Hoffman employees, utilized Hoffman’s facilities to obtain plaintiff’s credit report. Defendant XYZ Corporation and/or its employee, defendant-appellee Larry F. Katzke, utilizing his position with XYZ Corporation, requested John Doe # 1 and/or John Doe # 2 to obtain the report. Defendant Richard Roe requested XYZ Corporation and/or Katzke, and/or John Doe # 1 and/or John Doe # 2, to utilize Hoffman’s facilities to obtain the report.
. Northrop claims on appeal that "the Motion to Dismiss was granted despite Defendant Katzke’s acknowledgement that, as material outside the pleadings was presented, the motion should have been treated as one for summary judgment.” It is true that “[i]n considering a motion to dismiss for failure to state a claim under Fed.R.Civ.P. 12(b)(6), a district court must limit itself to facts stated in the complaint or in documents attached to the complaint as exhibits or incorporated in the complaint by reference,” and that ”[i]f a district court wishes to consider additional material, Rule 12(b) requires it to treat the motion as one for summary judgment under Rule 56.” Kramer v. Time Warner Inc.,
.Elsewhere in her complaint Northrop refers generally to violations of "15 U.S.C. § 1681a et seq.,” but after the substance of her factual allegations are detailed, the only sections expressly asserted to have been violated are "§§ 1681b, c, and/or e.”
. Section 1681m was amended after the events giving rise to this case. The new version of this provision imposes disclosure obligations when a party takes an "adverse action” based on the receipt of credit information, rather than simply when it denies credit or increases the charge for credit. See Consumer Credit Reporting Reform Act of 1996, Pub.L. No. 104-208, Div. A, Title II, § 2411, 110 Stat. 3009, *3009-443 to -446 (1996). This subsequent amendment (which is effective 365 days after Sept. 30, 1996, unless any person or entity complies with any provision before that date, see id. at § 2420, 110 Stat. at *3009-454) does not apply to the instant case. In any event, as discussed below, we do not believe that § 1681m governs this dispute, and therefore need not speculate as to what this amendment suggests regarding the original intent of § 1681m. Other amendments to § 1681m, as well as to § 1681n, are more directly relevant to this case and are described infra notes 5 and 9, although they likewise do not ultimately influence our analysis.
. As discussed supra, note 4, the FCRA was amended subsequent to the events in this case, which amended version does not govern the present dispute. The amended version of 15 U.S.C. § 1681n expressly recognizes a civil cause of action against a party for "obtaining a consumer report under false pretenses or knowingly without a permissible purpose." Consumer Credit Reporting Reform Act of 1996, Pub.L. No. 104-208, Div. A, Title II, § 2412, 110 Stat. 3009, at *3009-446. This amendment appears to codify the interpretation of the pre-amended statute adopted in the cases cited below that found a civil cause of action to be available under § 168In based on the receipt of credit information under false pretenses. Inasmuch as we cannot be certain whether this amendment clarifies Congress’s original intent, or simply reflects Congress’s belief that such a civil cause of action should be available (whatever the pre-amended version may have intended), we do not allow the amendment to affect our interpretation of the pre-amendment statute.
. However mistaken the statutory basis (as opposed to the underlying claim) of her complaint, appellant may have intended to support her "false pretenses” argument by citing § 1681b, which lists the exclusive circumstances under which a consumer reporting agency may furnish a credit report. Other courts have in fact read the "false pretenses” prohibition of § 1681q in light of § 1681b. See, e.g., Hansen v. Morgan,
. Not before us is the question whether § 1681q states a "requirement” enforceable under § 1681o, which unlike § 1681n imposes liability for "negligent,” rather than "willful,” failure to comply with any of the "requirements” of the FCRA. We note that while some courts have assumed that § 1681 q is incorporated into § 1681o as well as § 1681n, see Yohay,
. It should be understood that because a private right of action is expressly authorized by § 168 In, the issue here is not whether a private right of action should be "implied” from the criminal provision set forth in § 1681q. See Kennedy,
.The amended version of § 168In, see supra note 5, replaced the reference to "[a]ny consumer reporting agency or user of information” with “any person.” Consumer Credit Reporting Reform Act of 1996, Pub.L. No. 104-208, Div. A, Title II, § 2412, 110 Stat. 3009, at *3009-446. Section 1681m was also amended at the same time by replacing the word "user” with "any person” and "a person,” although “user” continues to appear in the heading and in new subheadings. Id. at § 2411, 110 Stat. at *3009-443 to *3009-446. Cf. supra, note 4 (describing other amendments to § 1681m).
It is unclear what conclusions we can draw from these amendments with respect to the meaning of "user” in the pre-amended version of the statute. On the one hand, it might be argued that the amendments reflect Congress's intent to expand the FCRA beyond its initial scope and to permit it to apply to previously excluded defendants. (Of course, even if this were true it would not mandate any particular conclusion regarding which defendants are and are not “users” under the old statute.) It might just as easily be argued, however, that these amendments were intended simply to clarify that Congress never intended to employ "users” in § 1681m and (more importantly here) § 1681n as a restrictive term. In any event, inasmuch as we find no convincing reason to favor one interpretation of the amendments over another, our analysis of the pre-amended statute is not influenced by them.
. Indeed, accepting, as we do, that § 1681n incorporates § 1681q, it would make little sense to limit “users of information" under § 168In to those parties who actually deny credit or increase the charge for credit. Inasmuch as parties who regularly would have occasion to deny credit, increase the charge for credit, or otherwise engage in credit transactions are precisely the type of party to whom credit reports are permitted to be distributed, see 15 U.S.C. § 168 lb(a)(3)(A), a party who actually obtained credit information for these permissible purposes would in all likelihood not have done so "under false pretenses." See Hansen,
. Apart from those cases, at least one court has apparently taken the express position that a party who requests and obtains a credit report need not put it to any particular "use” in order to qualify as a "user of information” under § 1681n. See Zeller v. Samia,
. Defendant XYZ Corporation may also fall into the latter category, inasmuch as it is alleged "on information and belief" that this defendant "and/or its employee, Defendant Larry F. Katz-ke,” requested Hoffman employees to obtain Northrop’s credit report. We express no conclusions regarding any liability that may be imposed upon any of the corporate or individual defendants based not on their own status as "users of information" but on their responsibility for any violations by other defendants.