CFPB Continues Focus on Consumer Reporting and the FCRA With New “Guidance” on Background Checks and Consumer Disclosures

On January 11, the Consumer Financial Protection Bureau (CFPB or Bureau) issued two “advisory opinions” addressing the CFPB’s views of the obligations of consumer reporting agencies (CRAs) under the Fair Credit Reporting Act (FCRA). The advisory opinions are interpretive rules issued under the Bureau’s authority to interpret the FCRA pursuant to § 1022(b)(1) of the Consumer Financial Protection Act of 2010.

First, the CFPB advised that in order to assure “maximum possible accuracy” under § 607(b) of the FCRA, a CRA that provides background check reports must have procedures in place that: (1) prevent reporting public record information that is duplicative or that has been expunged, sealed, or otherwise legally restricted from public access; and (2) include any existing disposition information if it reports arrests, criminal charges, eviction proceedings, or other court filings.

Second, the CFPB advised that under § 609(a) of the FCRA, CRAs responding to file disclosure requests must also disclose to a consumer “the sources” of information, including both the original source and any intermediary or vendor sources.

In its first advisory opinion, the CFPB addressed FCRA § 607(b), which provides that “[w]henever a [CRA] prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” The CFPB advised of its view that, to comply with this section, CRAs must:

• Identify information that is duplicative to ensure that a report does not give the impression that a single event occurred more than once.
  
  
• Have procedures in place to ensure that information regarding the stages of a court proceeding (such as an arrest followed by a conviction) is presented in a way that makes clear the stages all relate to the same proceeding or case.
  
  
• Have reasonable procedures in place to check for any available disposition information in criminal and court proceedings.
  
  -  For example, the CFPB advised that it would be misleading to report that an individual has been arrested for the charges without also reporting that the charges have been dismissed.
  
  -  Similarly, the CFPB advised it would be misleading to report a bankruptcy filing without also reporting the result.
  
  
• Once a conviction has been sealed, expunged, or otherwise legally restricted from public access, the CFPB advised that it is misleading and inaccurate to include it in a consumer report because there is no longer any public record of the matter.

Relatedly, the CFPB addressed § 1681c, which generally prohibits the reporting of “[a]ny . . . adverse item of information . . . which antedates the report by more than seven years.” The CFPB advised that, to comply with this provision, CRAs generally should not report an adverse event that antedates the report by more than seven years and that each adverse item of information is subject to its own seven-year reporting period. The CFPB also stated that such reporting period is not restarted or reopened by the occurrence of subsequent events.

In the press release announcing the release of the advisory opinions, CFPB Director Rohit Chopra stated: “Background check and other consumer reporting companies do not get to create flawed reputational dossiers that are then hidden from consumer view … Background check reports, and all other consumer reports, must be accurate, up to date, and available to the people that the reports are about.”

In its second advisory opinion, the CFPB addressed FCRA § 609(a), which provides that “[e]very [CRA] shall, upon request . . . clearly and accurately disclose to the consumer, among other things: (1) All information in the consumer’s file at the time of the request . . .; and (2) The sources of the information.” The CFPB advised of its view that, to obtain a file disclosure, a consumer is not required to use any specific language, but may simply make a “request” and provide proper identification. Specifically, the CFPB advised that a consumer need not request “[a]ll information in the consumer’s file” or request a “complete file” or even use the word “file.” Instead, a consumer’s request for a “report” or “credit report” or “consumer report” or “file” or “record,” along with proper identification, triggers a CRA’s FCRA obligation. Further, the CFPB advised of its view that a CRA must:

• Disclose all information in the consumer’s file at the time of the request, including all information provided to a user.
  
  -  For example, the CFPB advised that a CRA must provide a file that allows a consumer to see criminal history information in the format that users see it, so that the consumer can check for any inaccuracies.
  
  
• Provide the information that formed the basis of any summary.
  
  -  For example, when a credit score or a tenant screening recommendation is provided to a user, the CFPB advised that the FCRA requires the CRA to include information that formed the basis for the score or recommendation.
  
  
• Disclose both the original source and any intermediary or vendor sources.
  
  -  For example, the CFPB advised that if a CRA discloses to a consumer only the vendor and does not also disclose the original source of the information, the consumer may not be able to correct any erroneous public records information that could be included in their files at all of the CRAs that receive data from the original source.

In both advisories, the CFPB concluded by warning CRAs of liability for a “willful” violation of the FCRA if they fail to heed the provided guidance. According to the press release, “the CFPB has taken action against consumer reporting companies when they have broken the law, as well as affirmed the ability of states to police credit reporting markets.”

Troutman's Take:

The CFPB’s advisory opinions reflect the Bureau’s strategy of leveraging the FCRA to maximize the scope of its regulatory authority pertaining to consumers. The opinions also continue the CFPB’s use of every arrow in its quiver in an attempt to expand the reach of the FCRA. Other tools are “lawmaking” through enforcement actions, various guidance statements and formal rulemaking — all of which the CFPB has used aggressively for the FCRA.

On the specifics, the common theme here is a goal of limiting the data that can pass through the consumer reporting ecosystem about consumers, either by raising the compliance bar of having to report subsequent history on public records, or explicitly requiring CRAs to purge data about public records that have been expunged, and expanding the rights of consumers to contest data in the system. The CFPB continues to assume that less information about consumers is a net benefit for consumers, but this conclusion is highly debatable. In other words, these pronouncements are par for the course from the CFPB, but whether they will actually make a lasting change in the law is yet to be seen as, ultimately, the CFPB’s positions will have to pass through litigation in court to become real. After all, the CFPB’s advisory opinions are not the law.