.svg)
The Consumer Financial Protection Bureau (CFPB) tells businesses to take purpose-based data use seriously or face criminal liability.
In an advisory opinion issued last week, the CFPB reminded companies that use and share credit reports and background reports that they can do so only if they have a legally permissible purpose under the Fair Credit Reporting Act (FCRA).
“Americans are now subject to round-the-clock surveillance by large commercial firms seeking to monetize their personal data,” said CFPB director Rohit Chopra.
“While Congress and regulators must do more to protect our privacy, the CFPB will be taking steps to use the Fair Credit Reporting Act to combat misuse and abuse of personal data on background screening and credit reports.”
Adopted in 1970, the FCRA is one of the two federal financial laws that lay down rules for personal financial privacy, with the other one being the Gramm-Leach-Bliley Act (GLBA), which mostly centres around what information financial institutions should disclose to consumers regarding their data management practices.
The FCRA, however, includes a stricter provision concerning data protection and establishes that consumer reporting agencies such as credit bureaus, tenant screeners and other data brokers, can share dossiers with third parties only for legally permissible purposes.
This ensures that companies cannot check an individual’s personal information, including their credit history, without a “bona fide” reason.
In the advisory opinion, the agency details what it considers permissible purposes under the FCRA and what it does not, and reminds market players that those who “knowingly” and “willfully” provide information concerning an individual to an unauthorised person can face criminal penalties and imprisonment.
Permissible purposes
According to the advisory, those that provide reports to entities based on insufficient matching procedures would violate consumers’ privacy rights.
For instance, some consumer reporting agencies obtain information from sources that identify consumers only by names, without taking additional steps to ensure the subject of the report matches the actual consumer.
The agency stresses that it is also unlawful to provide credit reports of multiple people as “possible matches” when the requester seeks to obtain a report on one individual.
The CFPB states that disclaimers do not shield companies against liability.
A disclaimer warning of potential failures in matching “does not change the fact that the consumer reporting company has failed to satisfy the requirements of [Section] 604(a)(3) and has provided a consumer report about a consumer to a person lacking a permissible purpose with respect to that consumer”, the advisory says.
Finally, the interpretive rule reaffirms that liability passes on to the users of credit reports.
Federal law provides that consumer report users are strictly prohibited from using or obtaining consumer reports without a permissible purpose, according to the new rule.
Use of soft tools
The CFPB issued its interpretation of the FCRA under the Dodd-Frank Wall Street Reform Act in the form of an advisory opinion, which does not require the agency to post a notice of a draft rule and open it up to public comments.
Although Chopra has intensified the agency’s work in every possible aspect, from enforcement to supervision and rulemaking, there has been a notable increase in the use of soft tools, such as advisory opinions, in recent months.
Whereas the agency issued three advisory opinions during the whole era of the Trump administration, the CFPB, under Chopra’s leadership, has already released five of these rules since November.
The agency confirmed that it is currently working on another such rule regarding highly disputed earned wage access products that some firms offer, allowing employees to access part of their salary before the due date.
“Markets work best when rules are simple, easy to understand, and easy to enforce,” Chopra said in a blog post last month when he revealed that the bureau will dramatically increase the amount of guidance.
He emphasised that the CFPB “is seeking to move away from highly complicated rules that have long been a staple of consumer financial regulation and towards simpler and clearer rules”.
