Here is my situation. The bank has a dealer paper contract with an auto dealership. What can the bank disclose to the auto dealership about a customer the bank pulls a credit report on? The customer actually goes to the dealership and the dealership contacts the bank. The bank pulls a credit report on the customer and sends information about that customer to the dealership. The dealership (sometimes) already has a credit report pulled. What can we disclose to the dealership about that customer? The problem I have is that the bank sends this information via e-mail, fax, or courier. If someone, who is not related to the loan, picks up this information they might get that information. Any advice?

You can't tell the dealership anything about the customer. If the bank pulls the credit report, then the bank is obligated to keep that information confidential & for their own use only. That's like telling a realtor about a customer that the realtor referred.

Not necessarily - You can communicate your decision on whether or not the customer is approved for the loan or not without turning yourself into a credit reporting agency. This however, is only as long as the dealer has previously informed the customer that their application was going to be specifically forwarded to your bank (this is why dealer agreements are so important)

According to the old FCRA commentary - The exemption is not limited to a simple "yes'' or "no'' response, but includes the information constituting the basis for the credit denial, because it applies to "any report."

As far as how is any of this communicated - I would make sure that it is only over secure channels.