CFPB Targets Consumer Report Protections With An Advisory Opinion – Privacy Protection

On July 7, 2022, the Client Monetary Safety Bureau
(“CFPB”) issued an advisory opinion, “Permissible Functions
for Furnishing, Utilizing, and Acquiring Client Studies” (the
“Opinion”) to stipulate sure privateness obligations of
client reporting companies (“Reporting Businesses”) and
client report customers (“Customers”) beneath part 604 of the
Truthful Credit score Reporting Act (“FCRA“). This new Opinion can be
necessary for any firm within the client reporting area or any
firm that makes use of client studies in its enterprise operations.

The Opinion highlights that (a) the permissible functions for
reporting are client particular; (b) Reporting Businesses could solely
present client studies in the event that they has “purpose to imagine”
that every one the buyer report info pertains to the topic of
the person’s request; (c) disclaimers won’t treatment a failure to
have a “purpose to imagine” {that a} Person has permissible
goal; and (d) Customers should make sure that they don’t violate a
particular person’s privateness by acquiring a credit score report after they lack a
permissible goal for doing so.

Previously, the CFPB and the Federal Commerce Fee have
introduced enforcement actions to handle violation of the FCRA’s
permissible goal. This Opinion underscores the CFPB’s
efforts to make sure that corporations that use and share credit score studies
and/or background studies have a permissible goal beneath the FCRA
and highlights that Reporting Businesses and Customers have particular
obligations to guard the buyer’s knowledge privateness. The Opinion
additionally reminds coated entities of potential legal legal responsibility for
sure misconduct.

Firms that generate client studies or Reporting Businesses
should rigorously make sure that the report is generated beneath its
permissible goal. Customers or these requesting the buyer should
additionally make sure that the request is made for a permissible goal.

Background

Reporting Businesses accumulate and assemble an exorbitant quantity
of details about shoppers together with such shoppers’
credit score, legal, employment and rental histories. This info
is packaged into client studies (“Client Studies”).
In flip, collectors, landlords, employers and different Customers make the most of
the Client Studies to make eligibility determinations. Some
widespread permissible functions embrace utilizing Client Studies for
credit score, insurance coverage, housing, or employment selections. For instance, a
financial institution, as a Person, could request a Client Report so as to
decide the phrases on which it’s going to provide a person a line of
credit score. In the identical vein, a landlord, as a Person, could request a
Client Report so as to decide the phrases on which it’s going to
provide somebody a tenancy.

With the intention to maintain such info confidential, in 1970,
Congress enacted the FCRA to control corporations that assemble
Client Studies, together with credit score reporting corporations, tenant
screeners, and different knowledge brokers. Amongst different issues, the FCRA
ensures honest and correct reporting, and it requires customers who purchase
such Client Studies to have a legally permissible goal. This
ensures that corporations won’t test a person’s private
info, resembling their credit score historical past, with out a bona fide
purpose.

The Opinion

The Opinion and its accompanying press release additional underscore the
significance of adequately defending “the general public’s knowledge
privateness” and remind companies of the potential of legal
legal responsibility. Beneath are choose takeaways from the Opinion:

Permissible goal and inadequate identifiers as matching
standards. FCRA part 604(a)(3) enumerates the permissible
functions for which Reporting Businesses could present Client Studies
to a Person resembling for credit score, employment and rental housing. A
Reporting Company could present the Client Report when it has
“purpose to imagine” that the Person requesting the report
has a permissible goal with respect to the buyer (FCRA
part 604(a)(3)). The CFPB interprets this to imply that part
604(a)(3) applies solely to that client who’s topic of the
request, quite than anytime a Person, resembling a financial institution or a landlord,
makes a request.

• Permissible goal and inadequate identifiers as
  matching standards. FCRA part 604(a)(3) enumerates the
  permissible functions for which Reporting Businesses could present
  Client Studies to a Person resembling for credit score, employment and
  rental housing. A Reporting Company could present the Client Report
  when it has “purpose to imagine” that the Person requesting
  the report has a permissible goal with respect to the buyer
  (FCRA part 604(a)(3)). The CFPB interprets this to imply that
  part 604(a)(3) applies solely to that client who’s topic of
  the request, quite than anytime a Person, resembling a financial institution or a
  landlord, makes a request.

  The CFPB notes that some Reporting Businesses use inadequate
  matching resembling name-only matching. Because of this a Person might
  be supplied a report about an individual for whom the Person doesn’t have
  a permissible goal to view the report for the only real goal that
  the title matches. For instance, when a Reporting Company conducts a
  public information search utilizing name-only matching and identifies one
  or extra people with the identical title as the buyer who’s the
  topic of the Person’s request, it generally would possibly present the
  Person with a report containing a doable match or listing of doable
  matches. If the Client Report consists of info that
  identifies (even when not by title) shoppers who’re solely doable
  matches and data that bears on the credit score worthiness, credit score
  standing, credit score capability, character, common status, private
  traits, or mode of dwelling of these shoppers, the
  Reporting Company could have unlawfully supplied Client Studies
  about these shoppers to a Person that doesn’t have a permissible
  goal for them.




• Disclaimers won’t suffice. The Opinion
  states that disclaimers resembling “[t]his file is matched by
  First Title, Final Title ONLY and should not belong to your topic. Your
  additional evaluation of the State Intercourse Offender Registry is required in
  order to find out if that is your topic” are inadequate.
  Such a disclaimer doesn’t change the truth that the Reporting
  Company has didn’t fulfill the necessities of 604(a)(3) by
  offering a Client Report a couple of client to an individual missing a
  permissible goal with respect to that client.




• Customers of Client Studies should have permissible goal.
  Lastly, the CFPB interprets the FCRA (part 604(f)) to offer
  that Customers are additionally strictly prohibited from utilizing or acquiring
  Client Studies with out a permissible goal. In different phrases,
  Customers are additionally accountable and that the usual of
  “permissible goal” extends past Reporting Businesses
  to Customers.

  By means of background dialogue, the CFPB additionally mentions (and
  reminds companies) of the potential for legal legal responsibility beneath
  FCRA part 619 and part 620 arising from violations of the
  FCRA’s permissible goal requirement. The Opinion highlights
  that the CFPB will proceed to take steps to make sure that Reporting
  Businesses, Customers and different related entities adhere to the FCRA and
  different client monetary safety legal guidelines.

The content material of this text is meant to offer a common
information to the subject material. Specialist recommendation ought to be sought
about your particular circumstances.