Companies may not establish a credit record of any consumer for the first time, or exchange it with any member or company without the consumer's consent.