Shah said that before 2014, the FCRA system “was entangled in files and procedures and was beyond proper oversight”