Amidst its increased activity in many different areas, the CFPB recently focused on credit reporting responsibilities under the Fair Credit Reporting Act (FCRA) by issuing an advisory opinion. The CFPB highlighted and set out some specific key points regarding credit reporting responsibilities and prohibitions, and offered a reminder about criminal liability under various provisions in the FCRA.  The advisory opinion can be found here and the CFPB’s press release can be found here.

In issuing the advisory opinion, Director Chopra stated:

Americans are now subject to round-the-clock surveillance by large commercial firms seeking to monetize their personal data, While Congress and regulators must do more to protect our privacy, the CFPB will be taking steps to use the Fair Credit Reporting Act to combat misuse and abuse of personal data on background screening and credit reports.

In the advisory opinion, the CFPB outlined some key points related to credit reporting:

• Reminding parties of the potential criminal liability for an FRCA violation.
• Affirming that a reporting agency may not provide a consumer report to a user under FCRA section 604(a)(3) unless it has reason to believe that all of the consumer report information it includes pertains to the consumer who is the subject of the user’s request.
• Noting that disclaimers will not cure a failure to have a reason to believe that a user has a permissible purpose for a consumer report provided pursuant to FCRA section 604(a)(3).
• Reminding consumer report users that FCRA section 604(f) strictly prohibits a person who uses or obtains a consumer report from doing so without a permissible purpose.

Specific Explanations and Reminders

Specifically, the CFPB stated that the advisory opinion makes clear:

• Insufficient matching procedures can result in credit reporting companies providing reports to entities without a permissible purpose, which would violate consumers’ privacy rights, such as where insufficient matching procedures cause the items of information appearing on a credit report to not all correspond to a single individual.
• It is unlawful to provide credit reports of multiple people as “possible matches”.

• Disclaimers about insufficient matching procedures do not cure permissible purpose violations.
• Users of credit reports must ensure that they do not violate a person’s privacy by obtaining a credit report when they lack a permissible purpose for doing so.

 Reminder of Criminal Liability

The advisory opinion reminded parties of criminal liability provisions, including imprisonment, in the FCRA. Specifically, the CFPB noted that covered entities can face criminal liability for obtaining a background report on an individual under false pretenses or by providing a background report to an unauthorized individual, citing as an example that “Section 620 of the Fair Credit Reporting Act . . . imposes criminal liability on any officer or employee of a consumer reporting agency who knowingly and willfully provides information concerning an individual from the agency’s files to an unauthorized person.”

Buchalter is a leading nationally recognized financial services law firm, having served large, medium and small financial institutions for over 90 years. Our Financial Services Regulatory Industry Group provides counseling and analysis across the wide range of regulatory and compliance issues facing banks and other financial institutions, and the Groups’ seasoned attorneys are experienced in the regulatory, compliance and risk management issues raised by the above issues.