Letter to CFPB Re: Request for Release of Notice of Proposed Rulemaking in Fair Credit Reporting Act Rulemaking Proceeding

October 30, 2024 

The Honorable Rohit Chopra 

Director, Consumer Financial Protection Bureau 

1700 G Street, NW 

Washington, DC 20552 

Re: Request for Release of Notice of Proposed Rulemaking in Fair Credit Reporting Act Rulemaking Proceeding 

Dear Director Chopra, 

The undersigned organizations write to urge the Consumer Financial Protection Bureau (CFPB) to move ahead with its Consumer Reporting Rulemaking by releasing a Notice of Proposed Rulemaking (NPRM) as soon as possible. We are heartened by the recent steps the CFPB has taken to strengthen Fair Credit Reporting Act (FCRA), including gathering information on how data brokers harm consumers,¹ laying out potential rule updates that would better protect consumers from data brokers,² releasing a proposed rule to remove medical debt from Americans’ credit reports,³ and promulgating guidance to highlight the ways that FCRA restricts worker surveillance.⁴ Now, the CFPB must take the crucial step of publishing a proposed Consumer Reporting Rule that will clarify the application of FCRA to data brokers, better regulate the use of personal information in consumer reporting, and carry forward the text and Congressional purpose of FCRA into an era of rapid technological change. 

As the CFPB knows, data brokers cause and facilitate wide-ranging harms to consumers, particularly to vulnerable and marginalized populations. For example, data brokers: 

• Degrade consumer privacy by collecting millions of data points about individuals, typically without their affirmative express consent, and combining that data with other datasets; mining it for insights (often using AI tools); and selling raw data, inferences, and other data-driven products to third parties;⁵  
• Exacerbate domestic violence and other forms of abuse by enabling abusive individuals to locate, stalk, harass, and physically harm people, which especially harms women, people of color, LGBTQ+ individuals, and children;⁶
• Jeopardize reproductive rights by enabling people to find and threaten abortion providers and to criminalize the personal decision to seek reproductive healthcare;⁷ 
• Make personal information available that can be used to target immigrants with deportation, predatory marketing, and criminal prosecution;⁸ 
• Enable criminals to target individuals for fraud and scams, which particularly impacts elderly populations, as well as target businesses for fraud and hacking;⁹ and 
• Threaten national security by selling data that can be used to target military personnel, reveal sensitive information like patrol routes around military bases, and blackmail military and national security personnel to obtain state secrets.¹⁰ 

The CFPB has already taken crucial steps to protect consumers from these harms, but the systemic threats that data brokers pose demand a systemic regulatory response. We urge the CFPB to release an NPRM clarifying—among other things—that data brokers which collect and sell certain types of consumer information are consumer reporting agencies (CRAs) that must comply with FCRA. If such a rule is adopted, data brokers will no longer be able to evade the accuracy, confidentiality, and dispute resolution requirements of FCRA or flout the permissible purpose limitations that Congress has established. By strictly regulating the personal information that brokers can amass and sell, the CFPB would breathe new life into FCRA and strike a decisive blow against the harmful data practices that flourish in the data broker industry today. 

We also urge the CFPB to prohibit consumer reporting agencies from selling “credit header” information without a permissible purpose as defined by FCRA. Credit header data generally refers to identifying information like a consumer’s name, current and former addresses, telephone number, and Social Security number (SSN), and this term may also refer to other information like current and prior employers, mother’s maiden name, and age/date of birth. Credit header data on its face may appear to consist of basic information, but this data can reveal sensitive facts about individuals and contribute to harm.¹¹ For example, a recent lawsuit against ChexSystems, a credit reporting agency, alleges that ChexSystems reported the plaintiff, a consumer, as deceased, which prevented him from opening a bank account.¹² In response, ChexSystems claimed that it was not obligated to correct the information because the information was credit header data not covered by FCRA.¹³ The CFPB must make it clear that credit header data is covered by FCRA to prevent abuse like this by credit reporting agencies against consumers. 

In addition, we urge the CFPB to address the dysfunctions in the FCRA-mandated dispute systems at the nationwide CRAs and other CRAs. These problems widespread and systemic and are documented in reports from the National Consumer Law Center,¹⁴ as well as the NCLC treatise Fair Credit Reporting.¹⁵ We urge the CFPB to include in the proposed FCRA rule a codification of its interpretation that the FCRA does not distinguish between legal and factual disputes and does not exempt CRAs or furnishers from reasonably investigating so-called legal disputes. This was a proposal that was included in the CFPB’s September 2023 Outline of Proposals. We also urge the CFPB to include in the proposed rule a specific process that would allow consumers to address systemic consumer reporting issues that affect other similarly situated consumers, which was another idea discussed in the September 2023 Outline of Proposals. Such processes might include injunctive relief or a CFPB Ombuds Office for consumer reporting.   

For all of these reasons, we urge the CFPB to promptly release a proposed FCRA rule that will protect consumers from harms caused by data brokers, the unregulated sale of credit header data, and the dysfunction of present-day FCRA dispute resolution systems. If you have any questions, please contact Caroline Kraczon, Law Fellow at the Electronic Privacy information Center (EPIC), at [email protected].

Sincerely,

Electronic Privacy Information Center (EPIC)
National Consumer Law Center (on behalf of its low-income clients)
Brennan Center for Justice
Center for Democracy & Technology
Consumer Action
Demand Progress
Just Futures Law
Justin Sherman, Adjunct Professor and Senior Fellow, Duke University; Nonresident Senior
Fellow, Atlantic Council
U.S. Public Interest Research Group

1. Request for Information Regarding Data Brokers and Other Business Practices Involving the Collection and Sale of Consumer Information, 88 Fed. Reg. 16,951 (June 13, 2023), https://www.federalregister.gov/documents/2023/03/21/2023-05670/request-for-information-regarding-databrokers-and-other-business-practices-involving-the-collection. ↩︎
2. Small Business Advisory Review Panel for Consumer Reporting Rulemaking Outline of Proposals and Alternatives Under Consideration, Consumer Financial Protection Bureau (Sept. 15, 2023). ↩︎
3. Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V), 88 Fed. Reg. 51,682 (June 18, 2024), https://www.federalregister.gov/documents/2024/06/18/2024-13208/prohibition-on-creditors-and-consumer-reporting-agencies-concerning-medical-information-regulation-v. ↩︎
4. Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V), 88 Fed. Reg. 51,682 (June 18, 2024), https://www.federalregister.gov/documents/2024/06/18/2024-13208/prohibition-on-creditors-and-consumer-reporting-agencies-concerning-medical-information-regulation-v. ↩︎
5. See EPIC, Comments on CFPB Request for Information Regarding Data Brokers and Other Business Practices Involving the Collection and Sale of Consumer Information, 88 Fed. Reg. 16, 951 (Jul. 14, 2023), https://epic.org/wp-content/uploads/2023/07/EPIC-CFPB-data-brokers-RFI-comments-071423.pdf. ↩︎
6. See, e.g. Office on Violence Against Women’s Grant Funds Used to Address Stalking: 2022 Report to Congress, Department of Justice (2022), https://www.justice.gov/d9/2023-06/2022%20Report%20to%20Congress%20on%20Stalking.pdf; Data Brokers: What They Are and What You Can Do About Them, National Network to End Domestic Violence (2022), https://static1.squarespace.com/static/51dc541ce4b03ebab8c5c88c/t/63349056c51b4f6c68a6a4ba/1664389207608/NNEDV_Data-Brokers_2022.pdf; Justin Sherman, People Search Data Brokers, Stalking, and ‘Publicly Available Information’ Carve-Outs, Lawfare (Oct. 30, 2023), https://www.lawfaremedia.org/article/people-search-data-brokers-stalking-and-publicly-available-information-carve-outs. ↩︎
7. See Ashley Emery, Data Privacy & Reproductive Freedom: How Digital Surveillance Increases the Risk of Pregnancy Criminalization Post-Dobbs, National Partnership for Women & Families (Oct. 2024), https://nationalpartnership.org/report/data-privacy-reproductive-freedom/. ↩︎
8. See, e.g. Fighting Back Data Brokers, Just Futures Law, https://www.justfutureslaw.org/fighting-data-brokers (last visited Aug. 15, 2024); Sonia Lin, Protecting immigrant access to fair credit opportunities, Consumer Financial Protection Bureau (Oct. 12, 2023), https://www.consumerfinance.gov/about-us/blog/protecting-immigrant-access-to-fair-credit-opportunities/#:~:text=ECOA%20does%20not%20prohibit%20lenders,based%20on%20national%20origin%2C%20race; The Data Broker Loophole is Being Exploited to Target Immigrant Communities, National Association of Criminal Defense Lawyers (May 22, 2024), https://www.nacdl.org/getattachment/567b4c71-b702-47d7-a59c-1e42f39b065a/immigration-and-data-purchases.pdf. ↩︎
9. See Protecting Older Consumers 2023-2024, Federal Trade Commission (Oct. 18, 2024), https://www.ftc.gov/system/files/ftc_gov/pdf/federal-trade-commission-protecting-older-adults-report_102024.pdf. ↩︎
10. See, e.g. Exec. Order No. 14117, 28 C.F.R. 202 (Mar. 1, 2024), https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related; Prepared Remarks of CFPB Director Rohit Chopra at the White House on Data Protection and National Security, CFPB (Apr. 2, 2024), https://www.consumerfinance.gov/about-us/newsroom/prepared-remarks-of-cfpb-director-rohit-chopra-at-the-white-house-on-data-protection-and-national-security/; Justin Sherman, Hayley Barton, Aden Klein, Brady Kruse, and Anushka Srinivasan; Data Brokers and the Sale of Data on U.S. Military Personnel (Nov. 2023); https://techpolicy.sanford.duke.edu/data-brokers-and-the-sale-of-data-on-us-military-personnel/; Johnny Ryan & Wolfie Christl, America’s Hidden Security Crisis, Irish Council for Civil Liberties (2023), https://www.iccl.ie/wp-content/uploads/2023/11/Americas-hidden-security-crisis.pdf. ↩︎
11. Coalition Letter to CFPB Requesting Broad Consumer Financial Market Correction, Beginning with an Advisory Opinion Regarding Credit Header Data (Feb. 8, 2023), https://epic.org/wp-content/uploads/2023/02/2023-02-08-Coalition-Letter-to-CFPB.pdf. ↩︎
12. Lass v. Chex Systems, No.: 3:24-CV-0741-LL-MMP (S.D. Cal. Filed Sept. 19, 2024). ↩︎
13. Lass v. Chex Systems, No. 3:24-cv-00741-LL-MMP (S.D. Cal. Oct. 15, 2024) (motion to dismiss). ↩︎
14. See Chi Chi Wu, Michael Best & Sarah Mancini, National Consumer Law Center, Automated Injustice Redux: Ten Years after a Key Report, Consumers Are Still Frustrated Trying to Fix Credit Reporting Errors, at 14 (Feb. 25, 2019), available at www.nclc.org [“Automated Injustice Redux”]; Chi Chi Wu, National Consumer Law Center, Automated Injustice: How a Mechanized Dispute System Frustrates Consumers Seeking to Fix Errors in Their Credit Reports, at 7-9 (Jan. 2009), available at www.nclc.org [“Automated Injustice 2009”]. See also Broken Records Redux; Persis Yu, National Consumer Law Center, Broken Records: How Errors by Criminal Background Checking Companies Harm Workers and Businesses (Apr. 11, 2012), available at www.nclc.org [“Broken Records 2012”]. ↩︎
15. NCLC, Fair Credit Reporting (10th ed. 2022). ↩︎