July 15, 2022

CFPB Reaffirms Privacy Requirements of FCRA for Credit Reporting Agencies and Users

Bernard Nash

Cozen O'Connor

+ Follow Contact

Facebook

Send

Embed

Cozen O'Connor

The CFPB released an Advisory Opinion and an accompanying press release affirming the agency’s interpretation of the application of the Fair Credit Reporting Act (FCRA) to the provision and use of credit and background reports, with a specific focus on the data privacy implications of the Act’s “permissible purpose” requirement.
Specifically, the Advisory addressed the requirement that consumer reporting agencies have a bona fide reason to provide credit reports and background reports, including for credit, insurance, housing or employment decisions. The Advisory Opinion also noted that the plain language of FCRA also limits the provision or use of information only to circumstances expressly permitted by the regulation, and that these limitations are consumer-specific. Consumer reporting companies may not provide information to a user unless there is reason to believe it pertains to the specific consumer who is the subject of a request.
The Advisory detailed circumstances under which the permissible purpose provision might be violated. These include name-only matching and “possible matches” including multiple consumers with the same name, and went on to note that disclaimers do not cure a failure of a consumer reporting agency to determine that a user has a permissible purpose for obtaining information. The Advisory also reminds covered entities of potential criminal liability for certain misconduct.

Send Print Report

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.