Excerpted from a Consumer Financial Protection Post
On July 7, the Consumer Financial Protection Bureau (CFPB) issued a legal interpretation to ensure that companies that use and share credit reports and background reports have a permissible purpose under the Fair Credit Reporting Act. The CFPB’s new advisory opinion makes clear that credit reporting companies and users of credit reports have specific obligations to protect the public’s data privacy. The advisory also reminds covered entities of potential criminal liability for certain misconduct.
“Americans are now subject to round-the-clock surveillance by large commercial firms seeking to monetize their personal data,” said CFPB Director Rohit Chopra. “The CFPB will be taking steps to use the Fair Credit Reporting Act to combat misuse and abuse of personal data on background screening and credit reports.”
Congress enacted the Fair Credit Reporting Act in 1970 to ensure companies “exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer’s right to privacy.” The Fair Credit Reporting Act regulates companies that assemble dossiers on consumers, including credit reporting companies and tenant screeners.
Permissible Purposes
Among other things, the Fair Credit Reporting Act ensures fair and accurate reporting, and it requires users who buy these dossiers to have a legally permissible purpose. This ensures that companies cannot check an individual’s personal information, including their credit history, without a bona fide reason. Common permissible purposes include using consumer reports for credit, housing or employment decisions.
The new advisory opinion will hold responsible any company that violates the permissible purpose provisions of the Fair Credit Reporting Act. The advisory opinion makes clear:
- • Insufficient matching procedures can result in credit reporting companies providing reports to entities without a permissible purpose: For example, when a credit reporting company uses name-only matching procedures, the items of information appearing on a credit report may not correspond to a single individual. That means the user of a credit report could be provided a report about a person for whom the user does not have permissible purpose.
• It is unlawful to provide credit reports of multiple people as “possible matches”: Credit reporting companies may not provide reports on multiple individuals where the requester only has a permissible purpose to obtain a report on one individual.
• Users of credit reports must ensure that they do not violate a person’s privacy by obtaining a credit report when they lack a permissible purpose for doing so: The Fair Credit Reporting Act strictly prohibits anyone from using or obtaining credit reports without a permissible purpose.
Criminal Liability
The advisory opinion outlines some of the criminal liability provisions in the Fair Credit Reporting Act. Covered entities can face criminal liability for obtaining a background report on an individual under false pretenses or by providing a background report to an unauthorized individual. Violators can face criminal penalties and imprisonment.
The CFPB will continue to take steps to ensure credit reporting companies and other relevant entities adhere to the Fair Credit Reporting Act. In addition, the CFPB has:
- • Highlighted the experiences of military families with medical billing, credit reporting, and debt collection. The CFPB’s report showed that nationwide credit reporting companies are failing to correct mistakes and inaccuracies, fueled by allegedly unpaid medical bills, on servicemembers’ credit reports.
• Spotlighted medical billing challenges faced by millions of American consumers. The CFPB’s report found that many consumers reported their credit reports being used as weapons to force payments of allegedly unpaid medical bills and that the bills are surreptitiously and unlawfully placed on their credit reports.
• Identified credit reporting companies the public can hold accountable. The CFPB released its annual list of credit reporting companies. Using the list, people can exercise their right to see what personal information these companies have, dispute inaccuracies, and take action if a firm is violating the Fair Credit Reporting Act.
For the full story, please click here.