Unless Congress clearly states otherwise, it is presumed not to have waived sovereign immunity.  This clear statement rule requires either an express statement that Congress is stripping away sovereign immunity or a statute that creates a cause of action and explicitly authorizes suit against a government entity on that cause of action.  The FCRA waives sovereign immunity by the latter approach.  The FCRA defines “person” as including government agencies and then grants a consumer a claim against a person who violates the FCRA by, among other things, failing to correct inaccurate information it furnished after the consumer disputes that information through a credit reporting agency.