The CFPB has issued an opinion to make it clear using information from credit reports to market debt relief services is off-limits.
A. Background
Consumer reporting agencies collect and assemble or evaluate information about, among other things, the credit, criminal, employment, and rental histories of hundreds of millions of Americans. They package this information into consumer reports, which are used by creditors, insurers, landlords, employers, and others to make eligibility and other decisions about consumers. This collection, assembly, evaluation, dissemination, and use of vast quantities of often highly sensitive personal and financial information about consumers poses significant risks to consumer privacy.
The FCRA regulates consumer reporting. Congress enacted the statute “to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy.”
One of the problems with the credit reporting industry that Congress recognized and sought to remedy with the FCRA was that “information in a person’s credit file [was] not always kept strictly confidential.” The statute was enacted to “prevent an undue invasion of the individual’s right of privacy in the collection and dissemination of credit information.” As courts have recognized, “[a] major purpose of the [FCRA] is the privacy” of consumer data.
The FCRA protects consumer privacy in multiple ways, including by limiting the circumstances under which consumer reporting agencies may disclose consumer information.
For example, FCRA section 604, entitled “Permissible purposes of consumer reports,” identifies an exclusive list of “permissible purposes” for which consumer reporting agencies may provide consumer reports, including in accordance with the written instructions of the consumer to whom the report relates and for purposes relating to credit, employment, and insurance.
The statute states that a consumer reporting agency may provide consumer reports under these circumstances “and no other.” In addition, FCRA section 607(a) requires that “[e]very consumer reporting agency shall maintain reasonable procedures designed to . . . limit the furnishing of consumer reports to the purposes listed under section 604.” And FCRA section 620 imposes criminal liability on any officer or employee of a consumer reporting agency who knowingly and willfully provides information concerning an individual from the agency’s files to an unauthorized person.
In addition to imposing permissible purpose limitations on consumer reporting agencies, the FCRA limits the circumstances under which third parties may obtain and use consumer report information from consumer reporting agencies.
FCRA section 604(f) provides that “a person shall not use or obtain a consumer report for any purpose unless” the consumer report “is obtained for a purpose for which the consumer report is authorized to be furnished under [FCRA section 604]” and “the purpose is certified in accordance with FCRA section 607 by a prospective user of the report through a general or specific certification.” FCRA section 619 imposes criminal liability on any person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses.
The FCRA’s permissible purpose provisions are thus central to the statute’s protection of consumer privacy. Consumers suffer harm when consumer reporting agencies provide consumer reports to persons who are not authorized to receive the information or when recipients of consumer reports obtain or use such reports for purposes other than permissible purposes.
These harms include the invasion of consumers’ privacy, as well as reputational, emotional, physical, and economic harms.
The Bureau and the Federal Trade Commission (FTC) have collectively brought numerous enforcement actions to address violations of the FCRA’s permissible purpose provisions.
For example, in a case that resulted in a 2006 settlement with a consumer reporting agency, the FTC alleged that the agency violated the FCRA’s permissible purpose provisions by providing consumer reports to persons without a permissible purpose, resulting in at least 800 cases of identity theft.
More recently, in 2020, a group of companies and individuals settled Bureau allegations that they obtained consumer reports without a permissible purpose when they obtained consumer reports for use in marketing debt relief services.
Also in 2020, a mortgage broker settled FTC allegations that it used consumer reports for other than a permissible purpose when, in response to negative reviews on a website, it publicly posted information it had obtained from a consumer report about the reviewer.
In light of the importance of the FCRA’s permissible purpose provisions to the protection of consumer privacy, the Bureau is issuing this advisory opinion to affirm that consumer reporting agencies may not provide a consumer report pursuant to FCRA section 604(a) under any circumstance not expressly permitted by this section.
In particular, the permissible purposes identified in FCRA section 604(a)(3) are consumer specific—that is, they apply only with respect to the consumer who is the subject of the user’s request—and a consumer reporting company may not provide a consumer report to a user under FCRA section 604(a)(3) unless it has reason to believe that all of the consumer report information it includes pertains to the consumer who is the subject of the user’s request.
For example, consumer reporting agencies violate the FCRA’s permissible purpose provisions if they provide consumer reports on multiple consumers (e.g., consumers with the same name) in response to a request where the user only has a permissible purpose to obtain a report on a single individual because that would inherently involve providing at least one consumer report on an individual with respect to whom the user did not have a permissible purpose.
The Bureau notes that disclaimers will not cure a failure to have a reason to believe that a user has a permissible purpose for a consumer report provided pursuant to FCRA section 604(a)(3).
The Bureau also is issuing this advisory opinion to highlight that FCRA section 604(f) strictly prohibits a person who uses or obtains a consumer report from doing so without a permissible purpose.
B. Coverage
Section C.1 of this advisory opinion applies to all “consumer reporting agencies,” as that term is defined in FCRA section 603(f). Section C.2 of this advisory opinion applies to all persons that obtain or use, or seek to obtain or use, “consumer reports,” as that term is defined in FCRA section 603(d).
C. Legal Analysis
1. FCRA Section 604(a)(3)
Section 604(a) of the FCRA identifies a limited set of “permissible purposes” for which a consumer reporting company may provide a consumer report to a user.
The Bureau is aware that some consumer reporting agencies use insufficient identifiers in matching procedures, such as name-only matching, which can result in the provision of consumer reports to persons without a permissible purpose to receive them.
The permissible purposes for which consumer reports are most commonly sought are those identified in FCRA section 604(a)(3), including for purposes related to credit, employment, insurance, and rental housing. Under section 604(a)(3), a consumer reporting company may provide a consumer report when it has “reason to believe” that the user requesting the report has one of the permissible purposes specified therein with respect to the consumer who is the subject of the user’s request. The Bureau interprets the permissible purposes in FCRA section 604(a)(3) to apply only with respect to the consumer who is the subject of the user’s request.
The Bureau’s interpretation is based on the plain language of FCRA section 604(a)(3) itself, which makes clear that whether a user has a permissible purpose under that section is analyzed on a consumer-by-consumer basis.
For example, FCRA section 604(a)(3)(A) permits a consumer reporting company to provide a consumer report “to a person which it has reason to believe . . . intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer.”
Similarly, FCRA section 604(a)(3)(F) permits a consumer reporting company to provide a consumer report “to a person which it has reason to believe . . . has a legitimate business need for the information . . . in connection with a business transaction that is initiated by the consumer or to review an account to determine whether the consumer continues to meet the terms of the account.”
The Bureau’s interpretation also is consistent with the FCRA’s purpose and structure.
As explained in part I.A, Congress enacted the FCRA in part to address “a need to insure that consumer reporting agencies exercise their grave responsibilities with . . . a respect for the consumer’s right to privacy.” The FCRA achieves this by, among other things, narrowly limiting the circumstances under which a consumer reporting company may provide consumer report information to third parties.
The statute is structured so that the permissible purposes in section 604(a) function as exceptions to the general rule that a consumer reporting company may not provide consumer reports to third parties.
Interpreting FCRA section 604(a)(3) to allow a consumer reporting company to provide consumer report information to a third party about a consumer with respect to whom the third party does not have a permissible purpose would undermine the statutory scheme and threaten consumer privacy with respect to the often highly sensitive information collected by consumer reporting agencies.
A consumer reporting company may not provide a consumer report under FCRA section 604(a)(3) unless it has reason to believe that the user has a permissible purpose with respect to the consumer about whom the report is requested.
A user’s request to a consumer reporting company for a report about a consumer does not give the consumer reporting company a reason to believe that the user has a permissible purpose to obtain a consumer report about other consumers.
Accordingly, a consumer reporting company may not provide a consumer report under FCRA section 604(a)(3) unless it has reason to believe that all of the consumer report information it includes pertains to the consumer who is the subject of the user’s request.
The use of poor matching procedures, such as name-only matching, can lead to violations of the FCRA’s permissible purpose provisions.
As the Bureau has observed, some consumer reporting agencies obtain information from sources that do not have or use identifying information other than consumer names, and they include such information in consumer reports without taking additional steps to match the information to the consumer who is the subject of the report.
The Bureau has recently affirmed that, “[i]n preparing consumer reports, it is not a reasonable procedure to assure maximum possible accuracy to use insufficient identifiers to match information to the consumer who is the subject of the report.”
In addition to running afoul of the FCRA’s accuracy provisions, a consumer reporting company that uses insufficient identifiers in its matching procedures, such as name-only matching, cannot rely on these procedures to form a reason to believe that all of the information it includes in a consumer report pertains to the consumer who is the subject of the user’s request.
For example, when a consumer reporting company conducts a public records search using name-only matching and identifies one or more individuals with the same name as the consumer who is the subject of the user’s request, it sometimes might provide the user with a report containing a possible match or list of possible matches instead of taking further steps to match the information to the specific consumer who is the subject of the request.
Under these circumstances, a consumer reporting company has not formed a reason to believe that all of the information it includes in a consumer report pertains to the consumer who is the subject of the user’s request.
If the report includes information that identifies (even if not by name) consumers who are possible matches and information that bears on the credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living of those consumers, the consumer reporting company will have provided consumer reports about those consumers to a user that does not have a permissible purpose for them.
The Bureau is aware that some consumer reporting agencies that use inadequate matching procedures include disclaimers with their consumer reports.
For example, one consumer reporting company stated when providing a consumer report: “This record is matched by First Name, Last Name ONLY and may not belong to your subject. Your further review of the State Sex Offender Registry is required in order to determine if this is your subject.”
Disclaimers will not cure a failure to have a reason to believe that a user has a permissible purpose for a consumer report provided pursuant to FCRA section 604(a)(3). A disclaimer does not change the fact that the consumer reporting company has failed to satisfy the requirements of 604(a)(3) and has provided a consumer report about a consumer to a person lacking a permissible purpose with respect to that consumer.
2. FCRA Section 604(f)
FCRA section 604(f) prohibits a person from using or obtaining a consumer report “unless . . . the consumer report is obtained for a purpose for which the consumer report is authorized to be furnished under [FCRA section 604]” and “the purpose is certified in accordance with FCRA section 607 by a prospective user of the report through a general or specific certification.”
Congress amended the FCRA to include section 604(f) in September 1996. Before the 1996 amendments, FCRA section 604 did not impose limitations on users of consumer reports, only on consumer reporting agencies.
The Bureau interprets FCRA section 604(f) to provide that consumer report users are strictly prohibited from using or obtaining consumer reports without a permissible purpose.
Although some courts have applied a “reason to believe” standard for persons using or obtaining a consumer report, as at least one court has noted, the opinion most commonly cited in support of this standard was decided before the 1996 amendments.
Based on its plain language, the 1996 addition of FCRA section 604(f) clearly imposes a strict prohibition on using or obtaining a consumer report without a permissible purpose.
Users of consumer reports must ensure that they do not violate consumer privacy by obtaining consumer reports when they lack a permissible purpose for doing so.
For example, in 2018 a company settled Bureau allegations that it violated FCRA section 604(f) when its agents obtained consumer reports for consumers who were not seeking an extension of credit from the company and the company had no other permissible purpose for the consumer reports it obtained.
In some instances, for example, the company’s agents initiated credit applications for the wrong consumer by incorrectly inputting consumer information into the company’s application system or by selecting the wrong consumer from a list of possible consumers identified in the system.
When these applications were initiated in error, the company obtained a consumer report for a consumer with respect to which it had no permissible purpose, violating the FCRA’s permissible purpose provisions and the privacy of the consumers that were the subject of those reports, and also generating an inquiry on the consumers’ credit reports. – Source
- Who Knew TitleMax Sucked This Bad? - February 23, 2023
- Litigation Practice Group Lawsuit by Business Partner All Service Financial – We Want Our Money - January 24, 2023
- HomeAdvisor and Angi to Pay Up To $7.2 Million and Stop Deceptively Marketing its Leads for Home Improvement Projects - January 23, 2023