FCRA Rulemaking: Key Proposals

The Consumer Financial Protection Bureau (CFPB) has kicked off a process to update Fair Credit Reporting Act (FCRA) rules and cut off harmful data broker practices. Some key proposals are explained below.

‘ASSEMBLING OR EVALUATING’ CONSUMER INFORMATION

The CFPB may clarify that data brokers accessing and transmitting consumer information to third parties with consumers’ consent are still engaged in “assembling or evaluating” consumer information—ensuring that many such brokers comply with FCRA.

CREDIT HEADER DATA

Credit header data includes certain identifying information like names, addresses, and Social Security numbers. Some companies sell this data for marketing or law enforcement purposes, arguing that credit header data is exempt from the FCRA’s prohibition on such sales. The CFPB may clarify that this data is covered by the FCRA, limiting businesses’ ability to sell or disclose it.

TARGETED MARKETING AND AGGREGATED DATA

The FCRA generally prohibits credit reporting agencies from furnishing consumer reports to third parties except for specific permissible purposes (which excludes marketing and advertising). Sometimes credit reporting agencies combine consumer reports with third-party data to deliver marketing materials on behalf of the third party. The CFPB may clarify that, even though such a credit reporting agency has not transferred consumer information to a third party, the credit agency has still furnished a consumer report to a user without a permissible purpose.

The CFPB is also considering proposals to clarify when aggregated or anonymized consumer report information constitutes a consumer report.

PERMISSIBLE PURPOSES

The CFPB is considering proposals to clarify the scope of the “written instructions of the consumer” and “legitimate business need” permissible purposes.

DISPUTES

The FCRA empowers consumers to dispute the completeness and accuracy of their consumer reports. The CFPB is considering proposals as to how credit reporting agencies and furnishers must respond to and investigate certain types of consumer disputes, including when the dispute involves a systemic issue (such as outdated software or deficiencies in a furnisher’s procedures).

MEDICAL DEBT INFO

The CFPB is proposing to ban creditors from using or obtaining medical debt collection information to make credit eligibility decisions and to ban credit reporting agencies from including medical debt collection tradelines on consumer reports.

DATA SECURITY AND DATA BREACHES

The CFPB is considering a proposal strengthening credit reporting agencies’ obligations to protect consumer reports from data breaches or unauthorized access.

WORKS CITED

• CFPB Kicks Off Rulemaking to Remove Medical Bills from Credit Reports, CFPB (Sept. 21, 2023), https://www.consumerfinance.gov/about- us/newsroom/cfpb-kicks-off-rulemaking-to-remove-medical-bills-from- credit-reports/.
• Small Business Advisory Review Panel for Consumer Reporting Rulemaking: Outline of Proposals and Alternatives Under Consideration, CFPB (Sept. 15, 2023), https://files.consumerfinance.gov/f/documents/cfpb_consumer- reporting-rule-sbrefa_outline-of-proposals.pdf.