On September 15, 2023, the Consumer Financial Protection Bureau (CFPB) published an outline of rulemaking proposals to modernize the Fair Credit Reporting Act “FCRA” to include data brokers, data aggregators, data furnishers, and other entities that act as consumer reporting agencies but are not currently covered under FCRA. The outline was published by the CFPB following remarks from CFPB Director Rohit Chopra on August 15, 2023, at a roundtable on Protecting Americans from Harmful Data Broker Practices which was hosted by the White House.
FCRA was designed to regulate the consumer reporting market by creating accuracy requirements, giving customers the right to see their data, and due process rights to dispute inaccurate or incomplete information in their files. FCRA also includes privacy laws around how consumer reporting data could be used and shared.
This proposal relates to the definitions of consumer reporting agency and consumer report. It also would address how newer entities such as data brokers and certain marketing and advertising practices should be covered under FCRA.
Data brokers collect, aggregate, and sell public and private data collected. This information is often provided without the consumer’s knowledge or consent. The CFPB’s proposal provides that: ”consumer information provided to a user who uses it for a permissible purpose is a “consumer report” regardless of whether the data broker knew or should have known the user would use it for that purpose, or intended the user to use it for that purpose; data brokers that sell certain types of consumer data (e.g., data typically used for credit and employment eligibility determinations) are selling consumer reports; a data broker that collects consumer information for permissible purposes may not sell it for non-permissible purposes; and a data broker may not obtain consumer report information from a consumer reporting agency without a permissible purpose or sell such information to a user unless the user has a permissible purpose.”
Proposals also under consideration would state that data brokers who qualify as a consumer reporting agency would also be subject to following the permissible purpose provision. Marketing and advertising are not generally considered a FCRA permissible purpose of consumer reporting agencies. Targeted marketing and aggregated data collected and used by third parties would be clarified as a violation under this proposal. There must be a “permissible purpose” such as a legitimate business need or the written instruction of the consumer.
As part of the broader changes under FCRA, the CFPB is also seeking to clarify the circumstances in which data breaches may result in a violation of the permissible purpose provision.
As well as proposals for an update to how a consumer reporting agency must handle a dispute and the ability to correct systemic issues on behalf of many consumers. The CFPB is also considering whether to provide a rubric or template that consumers could use to submit disputes relating to systemic issues affecting multiple consumers, to facilitate the submission of such disputes.
Regarding medical debt, the CFPB is considering proposals to modify or exempt medical debt from the information used to make a determination of a consumer’s credit worthiness or continued eligibility.
DocMagic will continue to provide CFPB updates as they become available. If you have additional questions about this topic, please contact DocMagic’s Compliance Department.
