CFPB Issues Three FCRA Interpretations with Widespread Implications

The Consumer Financial Protection Bureau (CFPB) has recently issued three interpretations of the Fair Credit Reporting Act (FCRA) with widespread implications, affecting tenant screening, background checks, medical debt, language access, and other reporting issues.  Two of the interpretations, CFPB advisory opinions issued on July 12, 2022, and November 10, 2021, focus on the too-common practice of a consumer reporting agency (CRA) using only a name or other inadequate procedures to match information to a specific consumer.  The two advisory opinions suggest significant FCRA liability for CRAs with inadequate matching procedures.

The third interpretation, a CFPB interpretive rule issued on July 11, 2022, explains important limits on FCRA preemption of state law, indicating that states have an important role in limiting the reporting of medical debt, evictions, rental debt, and criminal records.  More generally, the interpretive rule opens other avenues for state credit reporting legislation and buttresses the viability of existing state legislation.

This article reviews these interpretations.  For more information on related credit reporting issues, see NCLC’s just-released Fair Credit Reporting (10th ed. July 2022).

Consumer Reporting Agency Liability for Name-Only and Other Insufficient Matching

The earliest of the three interpretations, effective November 10, 2021, and published at 86 Fed. Reg. 62,468 (Nov. 10, 2021), indicates that a CRA using name-only matching or other insufficient identifiers violates 15 U.S.C. § 1681e(b).  That FCRA provision requires that a CRA follow reasonable procedures to assure maximum possible accuracy about the information it reports. 

The CFPB advisory opinion indicates that CRA matching procedures are critical in determining if the CRA meets this statutory requirement. Specifically, the CFPB states that name-only matching procedures are inadequate and violate § 1681e(b). See 86 Fed. Reg. 62,468, 62,471 (Nov. 10, 2022).  If a CRA obtains information from a data broker, database, or other source that uses name-only matching, it is not a reasonable procedure for that CRA to include information from that source without taking additional steps to insure there is a proper match between the individual listed on the information and a consumer’s file at the CRA.  See 86 Fed. Reg. 62,468, 62,472 (Nov. 10, 2022). 

A CRA faces significant liability for inadequate identifier procedures because, unlike violations of § 1681i, consumers may bring actions under § 1681e(b) without first disputing with the CRA the accuracy of information in a report and waiting to see if the disputed information is corrected.  The consumer instead simply shows that a CRA uses name-only matching and that the individual or class members are injured by the CRA’s inadequate procedures.

Prevalence and Injury Involved with Name-Only Matching

Name-only matching occurs when a CRA matches information to a particular consumer based only on whether the consumer’s first and last names are identical—or similar to—the names associated with the information. While the Big Three nationwide CRAs (Equifax, Experian, and TransUnion) no longer use name-only matching, other CRAs do, however, including some tenant and background screening companies.  

About 94% of employers and about 90% of landlords run criminal background checks, and 85% of landlords use eviction information to evaluate prospective employees and tenants. Many landlords and employers purchase reports containing this information for specialized tenant and employment screening companies. These screening companies may match a consumer with an eviction, criminal, or other public record, such as sex offender registry information, using only a first and last name, resulting in a consumer being denied employment or rental housing based solely on the wrong person’s criminal or other derogatory record.  See, e.g., NCLC’s Broken Records Redux: How Errors by Criminal Background Check Companies Continue to Harm Consumers Seeking Jobs and Housing (Dec. 2019); NCLC’s Salt in the Wound: How Eviction Records and Back Rent Haunt Tenant Screening Reports and Scores (Aug. 2020).

CRAs often rely on name-only matching when they choose to report records that typically do not include social security number, address, or other personally identifying information, such as criminal records, court records of evictions, or collection lawsuits. The Big Three CRAs have largely abandoned the use of public records in part because such records do not contain sufficient personally identifying information to allow for reliable matching.  See NCLC’s just-recently revised Fair Credit Reporting § 4.3.3.4 (mixed public records information).

Even date of birth in conjunction with a first and last name may not be a sufficient identifier. See Bureau of Consumer Fin. Prot. v. Sterling Infosys., Inc., No. 1:19-cv-10824, at ¶¶ 5–11 (S.D.N.Y. Nov. 22, 2019) (complaint); NCLC’s Fair Credit Reporting § 4.3.3.4.  

Consider that http://howmanyofme.com estimates that 45,878 people in the United States have the name “Robert Smith.” For every 325 instances of Robert Smith, five of them will share the same full date of birth. “Fuzzy logic” algorithms (including creating a match for those whose name is only similar to that found on a record) further increase the number of mismatches using just name and date of birth. See NCLC’s Broken Records Redux: How Errors by Criminal Background Check Companies Continue to Harm Consumers Seeking Jobs and Housing 18 (Dec. 2019).

Permissible Purpose Violations Where Report Containing Information Belonging to Other Consumers Is Sent to a User

The most recent CFPB advisory opinion on the FCRA, published at 87 Fed. Reg. 41,243 (July 12, 2022), and effective July 12, 2022, focuses on permissible purpose violations involving the use of a credit report that mistakenly contains information about another consumer. FCRA § 1681b(f) requires that a consumer report can only be provided if the user (such as an employer, landlord, or creditor) certifies that it has a permissible purpose to obtain a report on a specific person. 

The advisory opinion indicates that a CRA, when providing a user with a report on that specific person, must provide a report that only contains information about that individual.  “The Bureau interprets the permissible purposes in [§ 1681b(a)(3)] to apply only with respect to the consumer who is the subject of the user’s request.”  87 Fed. Reg. 41,243, 41,244 (July 12, 2022). 

A CRA violates § 1681b(a) where it provides to a user information on multiple consumers where the user has certified a permissible purpose for only one consumer.  A CRA does not have a reason to believe that the information it includes in a report pertains to the specific consumer where it provides a report that either contains only a possible match or a list of possible matches. Instead, the CRA should take additional steps to properly match the information to the specific consumer.  See 87 Fed. Reg. 41,243, 41,245 (July 12, 2022).  Critically, the CFPB emphasized that a CRA’s disclaimer to the user that the report may contain information about other consumers cannot cure a violation. See 87 Fed. Reg. 41,243, 41,244, 41,246 (July 12, 2022). 

Remedies for Permissible Purpose Violations Involving a Mismatch

The July 12 advisory opinion does not touch on remedies where a CRA provides information about the incorrect consumer to a user in violation of § 1681b(a).  Under § 1681s, the CFPB, FTC, and/or state attorneys general should be able to bring enforcement remedies against a CRA that provides reports containing information on consumers for whom the user has no permissible purpose.  The advisory opinion can be viewed as the CFPB advising CRAs as to this potential enforcement exposure involving mismatched information in consumer reports.

The question is whether a consumer has a viable private remedy against a CRA where—without the user having a permissible purpose—a CRA provides the user with that consumer’s information found in another consumer’s report.  If the CRA’s action is negligent, there is a § 1681o violation for actual damages and attorney fees, and there will be no requirement that the injured consumer first dispute the information or show that the CRA’s matching practices fail to follow reasonable procedures to assure maximum possible accuracy. 

But how are individuals to discover that their information has been mistakenly included in another person’s consumer report?  What actual damages has the individual suffered?  In a class action, how are class members to be identified so that damages can be distributed to the class?

Users Strictly Liable for Using Reports with No Permissible Purpose

The July 12 CFPB advisory opinion also addresses an additional topic, indicating “that consumer report users are strictly prohibited from using or obtaining consumer reports without a permissible purpose.”  The opinion rejects court decisions that created a “reason to believe” standard for users, since a subsequent FCRA amendment changed the law so “that the FCRA clearly imposes a strict prohibition on using or obtaining a consumer report without a permissible purpose.”  See87 Fed. Reg. 41,243, 41,246 (July 12, 2022). 

This strict liability standard will be of most relevance to agency enforcement actions.  A private remedy for the user’s violation of § 1681b(f) still requires that the user was willful or negligent.  See 15 U.S.C. §§ 1681n, 1681o.

Query though whether a user is negligent when it frequently obtains reports from a CRA that uses name-only matching and the user is aware of frequent mismatches in the reports it receives.  But, before bringing a private action, the consumer whose information was mistakenly in the consumer report will have to discover that mismatch.

Third CFPB Interpretation Supports State Credit Reporting Legislation

A July 11, 2022, CFPB interpretive rule states that the FCRA’s express preemption provisions have a “narrow and targeted scope,” providing support for states to adopt credit reporting legislation protecting consumers.  See 87 Fed. Reg. 41,042 (July 11, 2022).  The rule specifically notes that state laws that forbid or restrict CRAs from including information about medical debts, evictions, rental debts, or criminal records generally would not be preempted.  Just as important, the principles set out in the rule apply more broadly, indicating that the FCRA preemption language is far more limited than the consumer reporting industry has argued.

Extent of FCRA’s Preemption of State Law

The FCRA does not generally preempt state laws that are more protective of consumers.  The interpretive rule specifically says “[s]tate laws that are not 'inconsistent' with the FCRA—including State laws that are more protective of consumers than the FCRA—are generally not preempted.”  See 87 Fed. Reg. 41,042 (July 11, 2022).  See also 15 U.S.C. § 1681t(a).

Instead, the FCRA at 15 U.S.C. § 1681t(b) enumerates specific exceptions to this general rule of no preemption, listing areas where state law addressing certain particular credit reporting topics is preempted.  (Not discussed in the rule or this article: certain older state laws are grandfathered and protected from this § 1681t(b) preemption.)  See NCLC’s Fair Credit Reporting § 10.7.3.3.

“With Respect to” Applies to a Provision’s Specific Coverage—Not the Provision’s General Topic

A number of the exceptions providing for preemption found at § 1681t(b) preempt state law “with respect to” the subject matter regulated under a specific FCRA provision. The CFPB indicates that “with respect to” relates to the FCRA provision’s exact requirements and not the provision’s general subject matter.  The CFPB gives § 1681t(b)(1)(E) as an example that preempts state laws “with respect to” § 1681c relating to information contained in consumer reports. But § 1681c covers certain specific topics, not all information in consumer reports. Thus § 1681t(b)(1)(E) does not preempt state law regarding the content of consumer reports beyond topics specifically found in § 1681c. See 87 Fed. Reg. 41,042, 41,044 (July 11, 2022).

It is irrelevant that § 1681c’s title is “Requirements related to information contained in consumer reports.”  What counts are the specific topics covered in the provision, not its title.  See 87 Fed. Reg. 41,042, n.12 (July 11, 2022). 

State Law Can Regulate the Reporting of Medical Debt, Evictions, Rental Arrears, and Criminal Records

That the “with respect to” preemption only applies to specific topics has important practical implications.  Section 1681c(a)(5) regulates how long information can remain on a credit report, but no § 1681c provision regulates when information can initially be included in a credit report.  As a result, the CFPB states that § 1681t(b)(1)(E) does notpreempt state law addressing the time before which a medical debt can be initially reported.  See 87 Fed. Reg. 41,042 at 41,044–41,045 (July 11, 2022).  The Big Three reporting agencies have voluntarily agreed not to report medical debt for a year, but the rule clarifies that states could enact such a requirement or one that delayed reporting even longer.

Second, the rule also indicates that states can regulate information typically included in tenant and background screening reports. “States may pass laws addressing the furnishing and reporting of rental information. A state law prohibiting a consumer reporting agency from including information (or certain types of information) about a consumer’s eviction, rental arrears, or arrests on a consumer report would generally not be preempted under section 1681t(b)(1).” 87 Fed. Reg. 41,042, 41,045 (July 11, 2022).  Thus, for example, a state could prohibit the reporting of eviction records unless the eviction filing resulted in a judgment against the consumer. On the other hand, a state could not enact legislation indicating how long the eviction record can stay on the report, only when it can be initially listed.

State Law Ability to Require Non-English Disclosures

The July 11 CFPB interpretive rule also focuses on another example where state law is preempted only as to the specific topics found in an FCRA provision.  Section 1681t(b)(5) lists nine FCRA provisions that preempt state law, including § 1681j(a).  Section 1681j(a) requires a free annual disclosure of a consumer’s credit report.  While a state law might not be able to require a free report more than once a year, it could require that the report be in a language other than English, because the topic of § 1681j(a) is the disclosure of the report and not the language of the disclosure.  See 87 Fed. Reg. 41,042, 41,046 (July 11, 2022).  

“Relating to” Further Narrows “With Respect to”

Section 1681t(b)(1) has eleven subsections, and each set out preemption “with respect to” an FCRA provision “relating to” certain factors.  The “relating to” proviso further limits the preemptive effect of § 1681t(b)(1), beyond that of “with respect to.”  For example, § 1681t(b)(1)(E) preempts state law with respect to § 1681c “relating to information contained in consumer reports.” Thus § 1681t(b)(1)(E) preempts state law if the state law both is with respect to the specific topics found in § 1681c and relates to information contained in consumer reports. 

Section 1681c covers several topics other than information contained in consumer reports, so that state law regulating those other topics is not preempted, because they do not “relate to” information contained in consumer reports.   See 87 Fed. Reg. 41,042, 41,043 (July 11, 2022). See also Consumer Data Indus. Ass’n v. Frey, 26 F. 4th 1 (1st Cir. 2022).  See generally Dan’s City Used Cars, Inc. v. Pelkey, 569 U.S. 251, 261 (2013).

Advantages of Consumer Litigation Under State Credit Reporting Law

Most states have laws relating to consumer reporting agencies.   See NCLC’s Fair Credit Reporting Appx. H for a state-by-state summary of such laws.  Often these laws mirror the federal FCRA.  However, in many instances a state law provides important additional protections for consumers, or contain different statutes of limitation, remedies, or scope.

Consequently, it is generally best to bring an action under both the federal and the state statute.  Where a consumer does not want an action removed to federal court, raising only the state law claim may be preferable to bringing an FCRA action.

Whether a credit reporting claim is based on the FCRA or a state statute, there are advantages in bringing the action in state court.  Depending on the state, constitutional standing requirements may be looser in state court than federal court. The Supreme Court’s constitutional standing requirements were most recently set out in Transunion L.L.C. v. Ramirez, 141 S. Ct. 2190 (2021).  For a 50-state survey of state court standing requirements, see NCLC’s Fair Credit Reporting Appx. H.3.

Cases alleging violation of state credit reporting statutes typically stay in state court and state court standing requirements apply.  But even cases alleging a federal FCRA violation can be brought in state court.  When removed to federal court, if federal standing requirements are not met, the case will be remanded to state court, where state court standing requirements may be less strict.