Protecting Americans From Harmful Data Broker Practices (Regulation V)
Federal RegisterDec 13, 2024
Ask Donna
What actually matters in this document.
Text
CONSUMER FINANCIAL PROTECTION BUREAU
12 CFR Part 1022
[Docket No. CFPB-2024-0044]
RIN 3170-AB27
Protecting Americans From Harmful Data Broker Practices (Regulation V)
AGENCY:
Consumer Financial Protection Bureau.
ACTION:
Proposed rule; request for public comment.
SUMMARY:
The Consumer Financial Protection Bureau (CFPB) is issuing a proposed rule for public comment to amend Regulation V, which implements the Fair Credit Reporting Act (FCRA). The proposed rule would implement the FCRA's definitions of consumer report and consumer reporting agency as well as certain of the FCRA's provisions governing when consumer reporting agencies may furnish, and users may obtain, consumer reports. The proposed rule is designed to, among other things, ensure that the FCRA's protections are applied to sensitive consumer information that the statute was enacted to protect, including information sold by data brokers.
DATES:
Comments must be received on or before March 3, 2025.
ADDRESSES:
You may submit comments, identified by Docket No. CFPB-2024-0044 or RIN 3170-AB27, by any of the following methods:
•
Federal eRulemaking Portal: https://www.regulations.gov.
Follow the instructions for submitting comments. A brief summary of this document will be available at
https://www.regulations.gov/docket/CFPB-2024-0044.
•
Email: 2024-NPRM-CONSUMER-REPORTING@cfpb.gov.
Include Docket No. CFPB-2024-0044 or RIN 3170-AB27 in the subject line of the message.
•
Mail/Hand Delivery/Courier:
Comment Intake—Protecting Americans from Harmful Data Broker Practices (Regulation V), c/o Legal Division Docket Manager, Consumer Financial Protection Bureau, 1700 G Street NW, Washington, DC 20552.
Instructions:
The CFPB encourages the early submission of comments. All submissions should include the agency name and docket number or Regulatory Information Number (RIN) for this rulemaking. Because paper mail is subject to delay, commenters are encouraged to submit comments electronically. In general, all comments received will be posted without change to
https://www.regulations.gov.
All submissions, including attachments and other supporting materials, will become part of the public record and subject to public disclosure. Proprietary information or sensitive personal information, such as account numbers or Social Security numbers, or names of other individuals, should not be included. Submissions will not be edited to remove any identifying or contact information.
FOR FURTHER INFORMATION CONTACT:
George Karithanom, Regulatory Implementation and Guidance Program Analyst, Office of Regulations, at 202-435-7700 or
https://reginquiries.consumerfinance.gov/.
If you require this document in an alternative electronic format, please contact
CFPB_Accessibility@cfpb.gov.
SUPPLEMENTARY INFORMATION:
Data brokers, including consumer reporting agencies, collect information about, among other things, the credit, criminal, employment, and rental histories of hundreds of millions of Americans. They analyze and package this information into reports used by creditors, insurers, landlords, employers, and others to make decisions about consumers. This collection, assembly, evaluation, dissemination, and use of vast quantities of often highly sensitive personal and financial data about consumers poses a significant threat to consumer privacy. It can also threaten national security and facilitate numerous tangible consumer harms, such as financial scams and the identification of victims for stalking and harassment.
Congress enacted the Fair Credit Reporting Act (FCRA)
1
in part to protect consumer privacy by regulating the communication of consumer information by consumer reporting agencies. The statute subjects such communications, which are referred to as consumer reports, to certain requirements and limitations, and it affords certain protections to consumers. For example, the FCRA imposes clear bright-line rules permitting people to obtain consumer reports from consumer reporting agencies only for certain specified purposes, known as permissible purposes, and forbidding consumer reporting agencies from furnishing consumer reports to users who lack a permissible purpose. In addition, consumers have various rights under the FCRA, such as the right to dispute the accuracy of information in their file and to be notified when, for example, a creditor, landlord, or employer relies on consumer report information to make a negative decision about the consumer's application for credit, housing, or employment.
1
15 U.S.C. 1681
et seq.
In recent years, the consumer reporting marketplace has evolved in ways that imperil Americans' privacy. There is an emerging consensus that intrusive surveillance and aggregation of sensitive data about consumers can create conditions for harming national security by exposing information that could be exploited by countries of concern.
2
Stalkers and domestic abusers can also obtain sensitive contact information from data brokers to contact or locate people who do not wish to be contacted or located, such as domestic violence survivors. In addition, vast troves of sensitive data, including, for example, individualized data about a consumer's finances, are bought and sold, without consumers' knowledge or consent, by data brokers who believe that the FCRA does not apply to them or to some of their activities. This data can be leveraged to scam or defraud people. Data brokers evading coverage under the FCRA include traditional consumer reporting agencies and recent market entrants using new business models and technologies to collect and analyze consumer information on an unprecedented scale. The CFPB is proposing this rule to address when a data broker is covered by the FCRA, and to protect Americans from the harms and invasions of privacy created by certain data broker activities that violate the FCRA.
2
See, e.g.,
E.O. No. 14117, 89 FR 15421 (Feb. 28, 2024); Justin Sherman et al.,
Data Brokers and the Sale of Data on U.S. Military Personnel: Risks to Privacy, Safety, and National Security
(Nov. 2023) (hereinafter Duke Report on Data Brokers and Military Personnel Data),
https://techpolicy.sanford.duke.edu/wp-content/uploads/sites/4/2023/11/Sherman-et-al-2023-Data-Brokers-and-the-Sale-of-Data-on-US-Military-Personnel.pdf.
I. Summary of the Proposed Rule
The CFPB proposes to implement the FCRA's definitions of consumer report and consumer reporting agency in several respects to ensure that the FCRA's protections apply to all data brokers that transmit the types of consumer information that Congress designed the statute to protect, and to the types of activities that Congress designed the statute to regulate. For example, the proposed rule:
• Provides that data brokers that sell information about a consumer's credit history, credit score, debt payments (including on non-credit obligations), or income or financial tier generally are consumer reporting agencies selling consumer reports, regardless of the
purpose for which any specific communication of such information is used or expected to be used;
• Provides that a communication by a consumer reporting agency of a portion of the consumer report that consists of personal identifiers such as the consumer's name, address, or age, is a consumer report if the information was collected for the purpose of preparing a consumer report about the consumer;
• Includes provisions intended to prevent privacy harms associated with the re-identification of de-identified consumer report information;
• Provides that a communication by a consumer reporting agency of information about a consumer is a consumer report if the information is used for an FCRA-covered purpose, regardless of whether there is evidence that the consumer reporting agency knew or expected that the information would be used for such a purpose;
• Provides that an entity that otherwise meets the definition of consumer reporting agency is a consumer reporting agency if it assembles or evaluates information about consumers, including by collecting, gathering, or retaining; assessing, verifying, or validating; or contributing to or altering the content of such information.
The CFPB also proposes to address certain aspects of FCRA section 604(a) regarding permissible purposes to furnish and obtain consumer reports. These proposals are designed to ensure that consumer reports are furnished for permissible purposes under the FCRA, and for no other reasons. For example, the proposed rule:
• Provides that a consumer reporting agency furnishes a consumer report to a person when the consumer reporting agency facilitates the person's use of the consumer report for the person's financial gain, even if the consumer reporting agency does not technically transfer the consumer report to the person;
• Provides that the FCRA provision that authorizes a consumer reporting agency to furnish a consumer report in accordance with the written instructions of the consumer can be used to obtain a consumer report for any reason specified by a consumer, but only if the consumer signs a separate authorization that is not hidden in fine print and that discloses certain information to the consumer, including the reason for obtaining the report; and
• Provides that the FCRA's permissible purpose relating to legitimate business needs for consumer reports does not authorize furnishing of consumer reports for marketing.
The proposal would not interfere with consumer reporting agencies' ability to furnish consumer reports to either prevent fraud or verify the identity of a consumer when done in connection with a permissible purpose, like credit applications, government benefits, bank account opening, and rental applications, and in compliance with the FCRA's other requirements.
II. Background
A. History and Purposes of the FCRA
Congress enacted the FCRA, one of the first data privacy laws in the world, in 1970. The FCRA's enactment was the culmination of multiple Congressional investigations into the growing data surveillance industry.
3
By the late 1960s, the industry was already of “vast size and scope.”
4
It involved: (1) the collection by private entities, known as consumer reporting agencies, of information about tens of millions of American consumers, including information about “their employment, income, billpaying record, marital status, habits, character and morals”;
5
(2) the assembly and evaluation of this information by consumer reporting agencies in order to create elaborate dossiers about individual consumers; and (3) the sale of those dossiers to a range of entities, including to potential creditors and employers, who used them to make eligibility determinations about consumers.
6
3
See generally
Robert M. McNamara Jr.,
The Fair Credit Reporting Act: A Legislative Overview,
22 J. Public Law 67, 77-88 (1973) (hereinafter Fair Credit Reporting Act: A Legislative Overview).
4
115 Cong. Rec. S2410 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire) (“For example, the Associated Credit Bureaus of America have over 2,200 members serving 400,000 creditors in 36,000 communities. These credit bureaus maintain credit files on more than 110 million individuals and in 1967 they issued over 97 million credit reports.”).
5
115 Cong. Rec. S2413 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire).
6
See generally
115 Cong. Rec. S2410-11 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire).
Before the FCRA's passage, the consumer reporting industry was subject to “an almost complete lack of regulation,”
7
leaving consumers largely powerless to protect themselves from a wide range of serious harms.
8
Congressional hearings revealed an industry shrouded in secrecy. Many consumer reporting agencies prohibited consumer report users from disclosing to consumers that information in a consumer report was the reason for an adverse decision, such as the denial of credit, or the name of the consumer reporting agency that prepared the report on which the user relied.
9
According to one contemporary commentator, “[w]hether the consumer ever discovered the cause of his being rejected was largely a matter of an educated guess or clairvoyance bordering on blind luck.”
10
But even if a consumer knew the reason for an adverse decision and the name of the consumer reporting agency, this often was not enough: consumers were not always permitted to access their files or dispute inaccurate information.
11
And even if a consumer overcame these obstacles and managed to file a dispute, the investigations conducted by consumer reporting agencies were often standardless and shoddy, in part because many consumer reporting agencies deemed investigations too costly to conduct.
12
7
S. Rep. No. 517, 91st Cong., 1st Sess. 3 (1969).
8
See generally
Fair Credit Reporting Act: A Legislative Overview,
supra
note 3, at 77-88; S. Rep. No. 517, 91st Cong., 1st Sess. 3-4 (1969); 115 Cong. Rec. S2410-14 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire).
9
S. Rep. No. 517, 91st Cong., 1st Sess. 3 (1969); 115 Cong. Rec. S2412 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire).
10
Fair Credit Reporting Act: A Legislative Overview,
supra
note 3, at 79.
11
S. Rep. No. 517, 91st Cong., 1st Sess. 3 (1969); 115 Cong. Rec. S2412 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire).
12
Fair Credit Reporting Act: A Legislative Overview,
supra
note 3, at 81-82; S. Rep. No. 517, 91st Cong., 1st Sess. 3 (1969); 115 Cong. Rec. S2412 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire).
Congressional hearings further revealed that many consumer reporting agencies at that time exhibited only a marginal commitment to accuracy. Consumer reports sometimes included information that was false or incomplete or that pertained to the wrong consumer altogether.
13
Indeed, consumer reporting agencies often disclaimed the accuracy of their reports, portraying themselves as mere transmitters of information without responsibility for ensuring that the information was correct.
14
Because consumers generally were unable to see the information for themselves and have it corrected, the harms that flowed from the communication of inaccurate, incomplete, irrelevant, and outdated information could be intractable.
13
115 Cong. Rec. S2411-12 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire).
14
Fair Credit Reporting Act: A Legislative Overview,
supra
note 3, at 80.
Congressional hearings also revealed that the consumer reporting industry posed significant privacy risks to consumers, and the legislative history suggests that Congress was concerned about the invasion of consumer privacy generally, as well as the specific harms
that flow from such invasions.
15
Consumer reporting agencies possessed huge quantities of sensitive information about tens of millions of Americans, but there were no “public standards to [e]nsure that the information [was] kept confidential and used only for its intended purpose”—a fact that the primary sponsor of the FCRA, Senator William Proxmire, described as “disturbing.”
16
As a result, it was relatively easy for one person to obtain confidential information about another person. In one example, a reporter was able to obtain 10 out of 20 reports requested at random from 20 consumer reporting agencies by using the name of a fictitious company under the guise of offering credit.
17
As Senator Proxmire noted in introducing the bill that would become the FCRA, these threats to consumer privacy were only likely to increase with “[t]he growing accessibility of this information through computer- and data-transmission techniques.”
18
15
115 Cong. Rec. S2413 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire).
16
Id.
17
S. Rep. No. 517, 91st Cong., 1st Sess. 4 (1969); 115 Cong. Rec. S2413 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire).
18
115 Cong. Rec. S2413 (daily ed. Jan. 31, 1969) (statement of Sen. William Proxmire).
Congress sought to address these and other consumer harms in the FCRA. In enacting the statute, it found that consumer reporting agencies played a “vital role” in assembling and evaluating consumer information to meet the needs of commerce, but that rules were necessary to ensure that consumer reporting agencies conduct their activities in a manner that is “fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization” of that information.
19
Accordingly, the FCRA established a framework with four principal pillars: (1) a bright-line prohibition on using or disseminating consumer reports unless for one of the limited permissible purposes identified by Congress; (2) a requirement that consumer reporting agencies follow reasonable procedures to assure the maximum possible accuracy of consumer reports; (3) a consumer right to dispute inaccurate or incomplete information and have it corrected; and (4) a consumer right to see the information that a consumer reporting agency possesses about the consumer. In the years since its passage in 1970, the FCRA has been amended many times, including to expand the statute's reach so that it now imposes obligations not just on consumer reporting agencies and consumer report users, but also on the entities that furnish information to consumer reporting agencies.
20
19
FCRA section 602, 15 U.S.C. 1681 (Congressional findings and statement of purpose).
20
See, e.g.,
Fair & Accurate Credit Transactions Act of 2003, Public Law 108-159 (2003); Consumer Credit Reporting Reform Act of 1996, Public Law 104-208 (1996).
The CFPB's Regulation V, 12 CFR part 1022, generally implements the FCRA. In 2003, Congress granted the Federal Trade Commission (FTC) and several other Federal agencies rulemaking authority for certain FCRA provisions.
21
For some provisions the authority was joint; for others it was exclusive to a particular agency. Over the next several years, the FTC and those agencies issued multiple rules implementing various provisions of the statute.
22
With the passage of the Consumer Financial Protection Act of 2010 (CFPA), Congress transferred rulemaking authority for most provisions of the FCRA to the CFPB.
23
21
See
Fed. Trade Comm'n,
40 Years of Experience with the Fair Credit Reporting Act: An FTC Staff Report with Summary of Interpretations,
at 5-6 (July 2011) (hereinafter FTC 40 Years Staff Report),
https://www.ftc.gov/sites/default/files/documents/reports/40-years-experience-fair-credit-reporting-act-ftc-staff-report-summary-interpretations/110720fcrareport.pdf.
22
See, e.g.,
74 FR 31484 (July 1, 2009); 69 FR 63922 (Nov. 3, 2004); 69 FR 35467 (June 24, 2004).
23
See
Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), Public Law 111-203, section 1088, 124 Stat. 1376, 2086 (2010);
see also
Dodd-Frank Act sections 1024, 1025, and 1061, 124 Stat. 1987 (codified at 12 U.S.C. 5514, 5515, and 5581). Authority over FCRA sections 615(e) and 628, 15 U.S.C. 1681m(e) and 1681w, is limited to the Federal banking agencies and the National Credit Union Administration, the FTC, the Commodity Futures Trading Commission, and the U.S. Securities and Exchange Commission. In addition, section 1029 of the Dodd-Frank Act generally excludes from the transfer of authority to the CFPB rulemaking authority over a motor vehicle dealer that is predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both. 12 U.S.C. 5519(a) and (c).
B. Goals of the Rulemaking
Protecting Consumer Information in the Data Broker Market
Today, Americans regularly engage in activities that reveal personal information about themselves, often without realizing it. They may, for example, visit a website, download an app, charge an item to a credit card, use a loyalty card at a grocery store or pharmacy, order goods online, subscribe to a newspaper or magazine, or make a donation. In each instance, the entity with whom the consumer interacts might collect information about the consumer. These entities might sell the consumer's information to other entities with whom the consumer does not have a relationship, or they might keep or reuse the information for themselves. Entities that collect, aggregate, sell, resell, license, enable the use of, or otherwise share consumer information with other parties are commonly known as data brokers.
24
24
See
88 FR 16951, 16952-53 (Mar. 21, 2023).
Different data brokers compile and sell different types of consumer information.
25
Much of the information is private and highly sensitive, such as information about a consumer's finances, income, physical and mental health, sexual orientation, religious affiliation, and political preferences, as well as information about the websites and apps the consumer visits or uses, the stores the consumer frequents, the products the consumer buys, and the consumer's location throughout the day.
26
Data brokers obtain this information from a variety of sources, including retailers, websites and apps, newspaper and magazine publishers, and financial service providers, as well as cookies and similar technologies that gather information about consumers' online activities.
27
Other information is publicly available, such as criminal and civil record information maintained by Federal, State, and local courts and governments, and information available on the internet, including information posted by consumers on social media.
28
The volume of data collected, bought,
and sold by data brokers is enormous. Some of the nation's largest data brokers boast that they possess information about hundreds of millions of American consumers consisting of billions of data points, with some data updated instantaneously.
29
25
See generally
Urbano Reviglio,
The Untamed and Discreet Role of Data Brokers in Surveillance Capitalism: A Transnational and Interdisciplinary Overview,
11 Internet Policy Review 3 (Aug. 4, 2022),
https://policyreview.info/articles/analysis/untamed-and-discreet-role-data-brokers-surveillance-capitalism-transnational-and;
Fed. Trade Comm'n,
Data Brokers: A Call for Transparency and Accountability,
at 11-18, 24, B3-B6 (May 2014) (hereinafter FTC Data Broker Report),
https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf.
26
See
Am. Compl. For Permanent Inj. and Other Relief ¶¶ 72-76, 97-106,
FTC
v.
Kochava, Inc.,
No. 2:22-cv-00377-BLW (D. Idaho June 5, 2023),
https://www.ftc.gov/system/files/ftc_gov/pdf/26AmendedComplaint%28unsealed%29.pdf;
Joanne Kim, Duke Sanford Cyber Policy Program,
Data Brokers & the Sale of Americans' Mental Health Data
(Feb. 2023) (hereinafter Duke Report on Data Brokers and Mental Health Data),
https://techpolicy.sanford.duke.edu/wp-content/uploads/sites/4/2023/02/Kim-2023-Data-Brokers-and-the-Sale-of-Americans-Mental-Health-Data.pdf;
FTC Data Broker Report,
supra
note 25; Staff of S. Comm. on Com., Sci., & Transp.,
A Review of the Data Broker Industry: Collection, Use, and Sale of Consumer Data for Marketing Purposes,
at ii, 13-21 (Dec. 18, 2013),
https://www.commerce.senate.gov/services/files/0D2B3642-6221-4888-A631-08F2F255B577.
27
See, e.g.,
Alfred Ng & Jon Keegan,
Who is Policing the Location Data Industry?,
The Markup (Feb. 24, 2022),
https://themarkup.org/the-breakdown/2022/02/24/who-is-policing-the-location-data-industry;
FTC Data Broker Report,
supra
note 25, at 11-14.
28
See
FTC Data Broker Report,
supra
note 25, at 11-13.
29
Justin Sherman, Duke Sanford Cyber Policy Program,
Data Brokers and Sensitive Data on U.S. Individuals: Threats to American Civil Rights, National Security, and Democracy,
at 4-8 (2021) (hereinafter Duke Report on Data Brokers and Sensitive Data),
https://techpolicy.sanford.duke.edu/wp-content/uploads/sites/4/2021/08/Data-Brokers-and-Sensitive-Data-on-US-Individuals-Sherman-2021.pdf.
Certain data brokers compile the information they collect into reports about individual consumers, which they sell to third parties for use in assessing a consumer's eligibility for credit, employment, or insurance. Data brokers may also use the information, or the inferences they have drawn from that information, to create elaborate dossiers about consumers for targeted marketing purposes. For example, a data broker may use information about a consumer's income, location, purchases, or health condition to classify the consumer—including, for instance, as “Financially Challenged,” “Modest Wages,” “Working-class Mom,” “Senior Products Buyer,” or “Consumer[ ] with Clinical Depression”—and then sell lists of such consumers to advertisers.
30
In addition, data brokers may use the information they collect to develop and maintain their own products, such as “people search” engines and other online lookup tools, to build proprietary algorithms, to test and run advertising campaigns, and to train machine learning systems.
31
Some data brokers simply sell the consumer information they collect to individual purchasers, including to other data brokers and members of the general public.
30
See
Duke Report on Data Brokers and Mental Health Data,
supra
note 26, at 14; FTC Data Broker Report,
supra
note 25, at 20-21.
31
See, e.g.,
Will Knight,
Generative AI Is Making Companies Even More Thirsty for Your Data,
Wired (Aug. 10, 2023),
https://www.wired.com/story/fast-forward-generative-ai-companies-thirsty-for-your-data/.
Government agencies, technology and privacy experts, consumer advocates, and others have identified a range of consumer harms posed by data brokers that treat consumer information as though it is not subject to the FCRA.
32
As discussed further in part IV, the data broker industry can threaten national security. For example, countries of concern can obtain from data brokers the financial information of active military members, such as income and level of indebtedness, to compromise or blackmail them in an effort to obtain sensitive national security information. The data broker industry also is used to facilitate a range of financial scams. For example, fraudsters can obtain from data brokers lists of people with income below a certain threshold, which can be used to pitch predatory and unlawful products to families in financial distress. The highly sensitive information collected and sold by data brokers also is an attractive target for other bad actors. For example, thieves can obtain information from data brokers that enables them to steal people's identities and open new accounts or drain existing ones. And stalkers, harassers, and other criminals can use sensitive information obtained from data brokers to contact people who do not wish to be contacted, such as domestic violence survivors.
32
See, e.g.,
Elec. Privacy Info. Ctr.,
Disrupting Data Abuse: Protecting Consumers from Commercial Surveillance in the Online Ecosystem
(Nov. 2022),
https://epic.org/wp-content/uploads/2022/12/EPIC-FTC-commercial-surveillance-ANPRM-comments-Nov2022.pdf;
Duke Report on Data Brokers and Sensitive Data,
supra
note 29; FTC Data Broker Report,
supra
note 25.
To date, however, many data brokers have attempted to avoid liability under the FCRA by arguing that they are not consumer reporting agencies selling consumer reports, as those terms are defined in the statute. Many data brokers have made these arguments even though they collect, assemble, evaluate, or sell the same information as other consumer reporting agencies—and even though their activities pose the same risks to consumers that motivated the FCRA's passage. As explained further below, the proposed rule provides that the FCRA's definitions of consumer reporting agency and consumer report cover a wide range of data brokers and data broker activities under the FCRA. If the proposed rule is finalized, one practical effect would be that additional data brokers would be prohibited from selling information for non-FCRA purposes, thus limiting the transmission of information that is used to market products to consumers—and to scam, defraud, stalk, or harass them.
Protecting Consumer Information From Unauthorized Disclosure by Consumer Reporting Agencies
The CFPB also has observed that consumer reporting agencies continue to engage in practices that may be harmful to consumers. The consumer credit reporting industry has consistently been a major source of consumer complaints to the CFPB. Complaints about credit or consumer reporting represented roughly 80 percent of consumer complaints submitted to the CFPB during 2023, far more than any other category of consumer product or service.
33
Indeed, credit or consumer reporting has been the most-complained-about category of consumer financial product or service to the CFPB every year since 2017.
34
One ongoing area of concern for the CFPB is consumer reporting agencies engaging in practices that may threaten consumer privacy.
33
Consumer Fin. Prot. Bureau,
Consumer Response Annual Report,
at 11 (Mar. 2024),
https://files.consumerfinance.gov/f/documents/cfpb_cr-annual-report_2023-03.pdf
(noting that the CFPB received approximately 1.3 million credit or consumer reporting complaints in 2023, a 34 percent increase compared to 2022).
34
Consumer Fin. Prot. Bureau,
Consumer Response Annual Report,
at 11 (Mar. 2023),
https://files.consumerfinance.gov/f/documents/cfpb_2022-consumer-response-annual-report_2023-03.pdf;
Consumer Fin. Prot. Bureau,
Consumer Response Annual Report,
at 3 (Mar. 2022),
https://files.consumerfinance.gov/f/documents/cfpb_2021-consumer-response-annual-report_2022-03.pdf;
Consumer Fin. Prot. Bureau,
Consumer Response Annual Report,
at 9 (Mar. 2021),
https://files.consumerfinance.gov/f/documents/cfpb_2020-consumer-response-annual-report_03-2021.pdf;
Consumer Fin. Prot. Bureau,
Consumer Response Annual Report,
at 9 (Mar. 2020),
https://files.consumerfinance.gov/f/documents/cfpb_consumer-response-annual-report_2019.pdf;
Consumer Fin. Prot. Bureau,
Consumer Response Annual Report,
at 9 (Mar. 2019),
https://files.consumerfinance.gov/f/documents/cfpb_consumer-response-annual-report_2018.pdf;
Consumer Fin. Prot. Bureau,
Consumer Response Annual Report,
at 9 (Mar. 2018),
https://files.consumerfinance.gov/f/documents/cfpb_consumer-response-annual-report_2017.pdf.
As discussed above, privacy was a key motivating factor for passage of the FCRA, and the FCRA protects consumer privacy in multiple ways, including by strictly limiting the circumstances under which consumer reporting agencies may disclose consumer information. For example, FCRA section 604, entitled “Permissible purposes of consumer reports,” identifies an exclusive list of permissible purposes for which consumer reporting agencies may furnish consumer reports, including in accordance with the written instructions of the consumer to whom the report relates and for purposes relating to credit, employment, and insurance.
35
The FCRA's
permissible purpose provisions are central to the statute's protection of consumer privacy. The CFPB is concerned that sensitive consumer information that the statute was designed to protect is being furnished by consumer reporting agencies to users that do not have a permissible purpose under the FCRA to obtain the information, thereby threatening consumers' privacy, and causing reputational, emotional, economic, and physical harm to consumers. These threats have grown more acute as advances in technology have facilitated the easy sharing of such consumer information online.
35
15 U.S.C. 1681b(a). Other sections of the FCRA identify additional limited circumstances under which consumer reporting agencies are permitted or required to disclose certain information to government agencies.
See
FCRA sections 608, 626, and 627, 15 U.S.C. 1681f, 1681u, 1681v;
see also, e.g., FTC
v.
Manager, Retail Credit Co., Miami Beach Branch Off.,
515 F.2d 988, 994-95 (D.C. Cir. 1975) (holding that 15 U.S.C. 1681s(a) authorizes the FTC to obtain consumer reports in FCRA enforcement investigations). Further, the Debt Collection Improvement Act of 1996, Public Law 104-134, 110 Stat. 1321, section 31001(m)(1), allows the head of an executive, judicial, or legislative agency to obtain a consumer report under certain circumstances relating to debt collection.
See
31 U.S.C. 3711(h). The proposed rule is not intended to alter the additional
circumstances in which government agencies may obtain consumer report information.
For example, consumer reporting agencies sell personal identifiers collected for the purpose of preparing consumer reports—often known as “credit header” information—to third parties who may not have an FCRA-permissible purpose to obtain the information. The sale by consumer reporting agencies of personal identifiers, which may include sensitive information such as a consumer's Social Security number, contributes to the availability of such information for purchase online, potentially by fraudsters and other persons seeking to dox and expose consumers' personal information or otherwise exploit or harm consumers. The proposed rule would take steps to address this problem by providing that the term “consumer report” includes communications by a consumer reporting agency of personal identifiers that were collected for the purpose of preparing consumer reports and that such information therefore can be sold by consumer reporting agencies only to users who have a permissible purpose to obtain it.
The CFPB is also aware that consumer reporting agencies offer and sell to users who do not have an FCRA permissible purpose a variety of products that include information that has been drawn from consumer reporting databases and that has been aggregated or otherwise purportedly de-identified to try to mask the identities of the individual consumers to whom the information relates. This information may be sold or made available, for example, for use in marketing campaigns, even though advertising and marketing generally are not permissible purposes under the FCRA.
36
As with the sale of personal identifiers, the sale of purportedly de-identified information about consumers to users who do not have an FCRA permissible purpose to obtain it contributes to the proliferation of sensitive consumer information available for purchase online. The CFPB is concerned that advances in technology have made, and will continue to make, it easier for users to combine data and identify consumers within purportedly de-identified data sets, and that the sale of such information by consumer reporting agencies thus threatens the privacy of consumer information in the very ways Congress designed the FCRA to prevent. The CFPB proposes three possible alternatives to address this problem and clarify when a communication by a consumer reporting agency of information about a consumer is a consumer report.
36
An exception exists for the purpose of making firm offers of credit or insurance. FCRA section 604(c)(1)(B), 15 U.S.C. 1681b(c)(1)(B). In addition, a consumer reporting agency may provide a consumer report to a user “in accordance with the written instructions of the consumer” to whom the report relates. FCRA section 604(a)(2), 15 U.S.C. 1681b(a)(2).
In addition to general concerns regarding the privacy of consumers' sensitive information, the CFPB is concerned that consumer reporting agencies are monetizing consumer report information for use in marketing in ways that the FCRA prohibits. As noted, marketing and advertising generally are not permissible purposes for furnishing or obtaining consumer reports. Nevertheless, as technology has advanced, consumer reporting agencies have begun to employ techniques and business models designed to evade this restriction. The proposed rule would address these developments and would emphasize that the FCRA's legitimate business need permissible purpose does not authorize consumer reporting agencies to furnish consumer reports to users for solicitation or marketing purposes.
The CFPB additionally proposes to specify what is needed to establish a permissible purpose based on the written instructions of a consumer. This proposed provision is intended to ensure that consumer reporting agencies and consumer report users do not abuse the written instructions permissible purpose by purportedly obtaining consumer consent to furnish or obtain a consumer report pursuant to disclosures buried within lengthy terms and conditions or otherwise presented to the consumer in a manner that interferes with the consumer's ability to make informed decisions.
C. Outreach and Engagement
Request for Information
On March 15, 2023, the CFPB issued a Request for Information (RFI) regarding the data broker industry and business practices involving the collection and sale of consumer information.
37
The RFI sought information about new business models that sell consumer data and about consumer harm that could result from such business models. The CFPB received over 7,000 comments in response to the RFI. The comments helped to inform the CFPB's approach to the proposed rule.
37
88 FR 16951 (Mar. 21, 2023) (hereinafter CFPB Data Broker RFI).
Small Business Review Panel
Pursuant to the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA),
38
the CFPB issued an Outline of Proposals and Alternatives under Consideration in connection with this proposal in September 2023.
39
The CFPB convened a Small Business Review Panel (Panel) on October 16, 2023, and held Panel meetings on October 18 and 19, 2023. Representatives from 16 small businesses were selected as small entity representatives for the SBREFA process. These entities represented small businesses that the CFPB determined would likely be directly affected by one or more of the proposals under consideration. On December 15, 2023, the Panel completed the Final Report of the Small Business Review Panel on the CFPB's Proposals and Alternatives Under Consideration for the Consumer Reporting Rulemaking.
40
The CFPB also invited and received feedback on the proposals under consideration from others, including stakeholders other than small entity representatives, although this feedback was not included in the Small Business Review Panel Report.
41
The CFPB has considered the
feedback from small entity representatives and other stakeholders, as well as the findings and recommendations of the Small Business Review Panel, in preparing this proposed rule. Panel recommendations regarding specific proposals under consideration are addressed in part IV.
38
Public Law 104-121, 110 Stat. 857 (1996).
39
Consumer Fin. Prot. Bureau,
Small Business Advisory Review Panel For Consumer Reporting Rulemaking—Outline of Proposals and Alternatives Under Consideration
(Sept. 15, 2023) (hereinafter Small Business Review Panel Outline or Outline),
https://files.consumerfinance.gov/f/documents/cfpb_consumer-reporting-rule-sbrefa_outline-of-proposals.pdf.
40
Consumer Fin. Prot. Bureau,
Final Report of the Small Business Review Panel on the CFPB's Proposals and Alternatives Under Consideration for the Consumer Reporting Rulemaking
(Dec. 15, 2023) (hereinafter Small Business Review Panel Report or Panel Report),
https://files.consumerfinance.gov/f/documents/cfpb_sbrefa-final-report_consumer-reporting-rulemaking_2024-01.pdf.
41
Feedback received on the Small Business Review Panel Outline will be placed on the public docket for this rulemaking.
This proposed rule does not address feedback received as part of the SBREFA process about proposals that were under consideration regarding medical debt collection information. Those proposals under consideration were addressed in the CFPB's proposed rule regarding consumer reporting of medical information.
42
This proposed rule also does not address feedback received as part of the SBREFA process about proposals that were under consideration regarding data security and data breaches, disputes involving legal matters, and disputes involving systemic issues. Those topics are not included in this proposed rule.
42
89 FR 51692 (June 18, 2024) (hereinafter CFPB Medical Debt Proposed Rule).
Interagency and Stakeholder Consultations
Consistent with section 1022(b)(2)(B) of the CFPA, the CFPB has consulted with the appropriate prudential regulators and other Federal agencies, including regarding consistency with any prudential, market, or systemic objectives administered by these agencies. The CFPB has also consulted with officials from certain State agencies. In addition, the CFPB has discussed the proposed rule with, and considered written feedback submitted by, a range of interested stakeholders. The CFPB discusses throughout this document feedback received through these various channels that is relevant to the proposed rule.
III. Legal Authority
The CFPB is proposing to amend Regulation V pursuant to its authority under the FCRA and the CFPA. Section 1022(b)(1) of the CFPA authorizes the CFPB to prescribe rules “as may be necessary or appropriate to enable the [CFPB] to administer and carry out the purposes and objectives of the Federal consumer financial laws, and to prevent evasions thereof.”
43
The FCRA is a Federal consumer financial law, except with respect to sections 615(e) and 628.
44
Accordingly, the CFPB has authority under CFPA section 1022(b)(1) to issue regulations to administer and carry out the purposes and objectives of the FCRA and to prevent evasion thereof, except with respect to sections 615(e) and 628.
43
12 U.S.C. 5512(b)(1).
44
CFPA section 1002(14), 12 U.S.C. 5481(14) (defining “Federal consumer financial law” to include the “enumerated consumer laws” and the provisions of the CFPA); CFPA section 1002(12), 12 U.S.C. 5481(12) (defining “enumerated consumer laws” to include the FCRA, except with respect to sections 615(e) and 628).
FCRA section 621(e) provides that, except with respect to sections 615(e) and 628, the CFPB “shall prescribe such regulations as are necessary to carry out the purposes of [the FCRA].”
45
Specifically, FCRA section 621(e) provides that the CFPB “may prescribe regulations as may be necessary or appropriate to administer and carry out the purposes and objectives” of the FCRA.
46
The stated purpose of the FCRA is to ensure that “consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information.”
47
Except with respect to sections 615(e) and 628, the CFPB accordingly has authority to issue regulations “necessary or appropriate to administer and carry out” the provisions of the FCRA consistent with this purpose.
48
FCRA section 621(e) further provides that the CFPB may prescribe regulations as may be necessary and appropriate to prevent evasions of the FCRA or to facilitate compliance therewith.
49
45
15 U.S.C. 1681s(e).
46
Id.
47
FCRA section 602(b), 15 U.S.C. 1681(b).
48
See Loper Bright Enters.
v.
Raimondo,
144 S. Ct. 2244, 2263 (2024) (explaining that Congress's use of the term “appropriate” “leaves agencies with flexibility” in regulating (citation omitted)).
49
Cf. Consumer Fin. Prot. Bureau
v.
Townstone Fin., Inc.,
107 F.4th 768, 776 (7th Cir. 2024) (“In endowing the Board with authority to prevent `circumvention or evasion,' Congress indicated that the [Equal Credit Opportunity Act] must be construed broadly to effectuate its purpose of ending discrimination in credit applications.”).
The CFPB has considered this proposed rule in the context of its legal authority under the FCRA and the CFPA and has developed the proposed provisions by relying on its expertise in understanding and developing policy regarding the consumer reporting market. The CFPB has preliminarily determined that each of the proposed provisions is consistent with the purpose of the FCRA and is authorized under FCRA section 621(e) and CFPA section 1022(b)(1). Pursuant to FCRA section 621(e), any final rule prescribed by the CFPB would apply to all persons subject to the FCRA, except as described in section 1029(a) of the CFPA.
50
50
The CFPB also notes that, subject to certain exceptions, the FCRA states that it “does not annul, alter, affect, or exempt any person subject to [the FCRA] from complying with the laws of any State with respect to the collection, distribution, or use of any information on consumers, or for the prevention or mitigation of identity theft, except to the extent that those laws are inconsistent with any provision of this subchapter, and then only to the extent of the inconsistency.” 15 U.S.C. 1681t(a);
see also Davenport
v.
Farmers Ins. Grp.,
378 F.3d 839, 842 (8th Cir. 2004) (“The FCRA makes clear that it is not intended to occupy the entire regulatory field with regard to consumer reports”). Therefore, State laws that are not inconsistent with the FCRA—including State laws that are more protective of consumers than the FCRA—are generally not preempted.
See
87 FR 41042 (July 11, 2022).
As noted in proposed § 1022.1(b)(1) regarding the scope of Regulation V, the regulation implements only certain provisions of the FCRA. In this rulemaking, the CFPB proposes to implement for the first time in Regulation V the definitions of consumer report and consumer reporting agency in FCRA section 603(d) and (f) and the permissible purposes of consumer reports as set forth in FCRA section 604(a).
51
Unless specifically noted otherwise, the CFPB's mere restatement of statutory language is not intended to affect the status quo regarding caselaw or judicial or other interpretations that exist with respect to such restated language. Explaining the scope of Regulation V in proposed § 1022.1(b)(1) and restating certain statutory text should facilitate compliance with the statute, but the CFPB requests comment on the proposed approach.
51
The proposed rule does not restate all of FCRA sections 603 and 604. Among other provisions in those sections, the proposed rule does not restate FCRA section 604(c) regarding credit or insurance transactions that are not initiated by the consumer.
IV. Discussion of the Proposed Rule
Subpart A—General Provisions
Section 1022.4 Definition; Consumer Report
In general, a consumer report under the FCRA is a written, oral, or other communication by a consumer reporting agency of any information that: (1) bears on at least one of seven specified factors relating to a consumer; and (2) is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for credit or insurance, for employment purposes, or for any other purpose authorized under FCRA section 604 (
i.e.,
the section that establishes permissible purposes of consumer reports). The seven factors relating to a consumer specified in the definition of consumer report are a
consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.
52
The CFPB proposes § 1022.4 to implement and interpret the FCRA definition of consumer report.
52
FCRA section 603(d), 15 U.S.C. 1681a(d).
Proposed § 1022.4(a), (f), and (g) restate the FCRA definition with minor wording and organizational changes for clarity.
53
Proposed § 1022.4(a)(1) restates the “bears on” prong of the definition, proposed § 1022.4(a)(2) restates the purposes listed in the definition, and proposed § 1022.4(f) and (g) restate provisions addressing exclusions from the definition. The CFPB proposes § 1022.4(b) through (e) to address whether and when the communication of certain consumer information constitutes a consumer report, with the goal of ensuring the FCRA's protections are applied to such information. The CFPB also proposes to revise several provisions in existing Regulation V that cross-reference the definition of consumer report in FCRA section 603(d) to instead cross-reference the definition in proposed § 1022.4.
54
53
In restating FCRA section 603(d)(2)(D), proposed § 1022.4(f) cross-references FCRA section 603(y) rather than FCRA section 603(x) because the CFPA re-designated FCRA section 603(x) as FCRA section 603(y).
See
15 U.S.C. 1681a, n.1; Fed. Trade Comm'n,
Fair Credit Reporting Act, 15 U.S.C. 1681,
at 2 n.1 (Sept. 2018),
https://www.ftc.gov/system/files/documents/statutes/fair-credit-reporting-act/545a_fair-credit-reporting-act-0918.pdf
(noting that “(o) or (x)” in FCRA section 603(d)(2)(D) “[s]hould be read as `(o) or (y)' ”).
54
These provisions are §§ 1022.20(b)(3), 1022.32(b), 1022.71(f), 1022.130(c), and 1022.142(b)(2). If this proposal and the CFPB's Medical Debt Proposed Rule,
supra
note 42, are both finalized, the CFPB intends to revise in the same way cross-references to the terms “consumer report” and “consumer reporting agency” in § 1022.38, as proposed to be added to Regulation V by the Medical Debt Proposed Rule.
Is Used or Expected To Be Used
Proposed § 1022.4(b) and (c) address the phrase “is used or expected to be used” and surrounding elements of the statutory definition of consumer report. The proposed provisions address whether and when the applicable information is used (proposed § 1022.4(b)) or is expected to be used (proposed § 1022.4(c)) for one of the purposes specified in the definition—that is, for the purpose of serving as a factor in establishing a consumer's eligibility for consumer credit or insurance, for employment purposes, or for any other purpose authorized under FCRA section 604. The CFPB proposes these provisions to ensure that the FCRA's protections apply to certain communications of consumer information, including by incentivizing entities that sell consumer information to monitor the uses to which such information is put and by ensuring that certain types of consumer information are within the scope of the FCRA regardless of how any particular communication of that information is used.
As explained further below, the FCRA's definition of the term “consumer report” presents several interpretive questions relevant to this proposed rule. First, what is the item that might be “used or expected to be used” for the relevant purpose—the specific “communication” (
i.e.,
the actual transmittal of data) or the “information” contained within that communication (
i.e.,
the facts that the communication describes)? Courts have tended to focus their analysis on the specific communication, although it is unclear how many courts have been presented with the alternative.
55
Second, given that the phrase is in the passive voice, by whom might a communication or information be “used or expected to be used” to qualify as a consumer report—the specific recipient of the communication or a broader population of parties? Again, courts have tended to consider the activities of the specific user in the case at issue, but it is unclear whether courts have been presented with the alternative.
56
Third, whose expectations are relevant in determining whether a communication of information is “expected to be used” for a particular purpose—the person making the communication or someone else? And fourth, are that person's subjective expectations all that matter, or, as courts have held, does the analysis also consider what the person objectively
should
expect?
55
See, e.g., Comeaux
v.
Brown & Williamson Tobacco Co.,
915 F.2d 1264, 1273-74 (9th Cir. 1990) (“The plain language of section 1681a(d) reveals that a credit report will be construed as a `consumer report' under the FCRA if the credit bureau providing the information
expects
the user to use the
report
for a purpose permissible under the FCRA . . . .” (second emphasis added));
cf. Mintun
v.
Equifax Info. Servs., LLC,
535 F. Supp. 3d 988, 994 (D. Nev. 2021) (applying the series-qualifier and nearest-reasonable-referent cannons to conclude that, under the definition of consumer report, “it is the information in the communication, not the communication itself, that must be of the kind that
is used or expected to be used or collected in whole or in part
for the purposes of serving as a favor [
sic
] in credit, employment, or insurance decisions or other reasons allowed under the FCRA”).
56
See, e.g., Comeaux,
915 F.2d at 1273-74.
With these interpretive questions in mind, the CFPB is proposing provisions to administer and carry out the statutory scheme, prevent evasion of the FCRA's requirements, and ensure that the statute's protections apply to communications of consumer information that raise concerns the FCRA was designed to address. In doing so, the CFPB is also proposing particular approaches to resolving the interpretive questions set forth above. First, the CFPB proposes to treat “used or expected to be used” as modifying “information” rather than “communication.” Grammatically, the term to which “used or expected to be used” refers should also be the term to which “collected” refers, and a consumer reporting agency does not “collect” communications. Second, the CFPB proposes to interpret “used” to include use by persons other than the direct recipient of a communication. If “used or expected to be used” referred only to how the direct recipient used or was expected to use the information in a communication, then the recipient's use or expected use for a non-permissible purpose would not violate the statute because, by virtue of that use or expected use, the communication would not be a consumer report.
57
Moreover, if the analysis focused only on the initial recipient, the statute would be easy to evade by passing information through intermediaries before it reached the ultimate user. Third, the CFPB proposes to interpret “expected to be used” to refer to the expectations of the person communicating the information, which is consistent with longstanding case law and is a natural reading of the statutory language. Fourth, the CFPB proposes to interpret “expected to be used” to consider both what that person subjectively expected and what that person objectively
should
have expected about the use of the transmitted information. This interpretation is consistent with past agency and judicial interpretations and would emphasize that persons cannot sell consumer information and attempt to avoid coverage by willfully ignoring the purposes for which the information will be used.
57
The communication of the information could still be a consumer report if the information was collected for a purpose described in FCRA section 603(d)(1), in which case it could be furnished only to a recipient with a permissible purpose.
Since the FCRA's enactment in 1970, applications of the law have often undermined one of the statute's core commitments: protecting consumer privacy. The CFPB proposes to implement the statute in a manner that respects Congress's concern with limiting the purchase and sale of sensitive consumer information and restores the full meaning of the statute's permissible purpose provisions.
The CFPB uses these threshold principles, described in more detail below, to guide the following proposals.
4(b) Is Used
Proposed § 1022.4(b) interprets the phrase “is used” in the definition of consumer report. It provides that information in a communication is used for a purpose described in proposed § 1022.4(a)(2) if a recipient of the information uses the information for such purpose. The proposal would clarify that the purpose for which information in a communication is used can cause the communication to be a consumer report, regardless of whether the person communicating the information collected it or expected it to be used for that purpose.
This interpretation derives from a straightforward reading of the statute. As summarized above, section 603(d)(1) of the FCRA defines a consumer report as a communication of information by a consumer reporting agency bearing on any of seven, specified consumer factors that is “[1] used or [2] expected to be used or [3] collected” in whole or in part for a purpose described in proposed § 1022.4(a)(2). The principle that a statute must be construed to “give effect, if possible, to every clause and word”
58
requires that the phrase “is used” be given a meaning independent of “expected to be used” and “collected.”
59
The CFPB's proposed interpretation does so.
58
Williams
v.
Taylor,
529 U.S. 362, 404 (2000) (quoting
United States
v.
Menasche,
348 U.S. 528, 538-39 (1955));
see also Duncan
v.
Walker,
533 U.S. 167, 174 (2001) (discussing rule against surplusage).
59
Similarly, the series-qualifier cannon requires reading the phrase “in whole or in part” as modifying each word or phrase in the series (
i.e.,
“is used,” “expected to be used,” and “collected”) rather than just the final one (
i.e.,
“collected”).
See Facebook, Inc.
v.
Duguid,
592 U.S. 395, 402 (2021) (describing the series-qualifier canon);
United States
v.
MyLife.com, Inc.,
499 F. Supp. 3d 757, 764 (C.D. Cal. 2020) (finding that the complaint adequately pled that the defendant's reports “were used or expected to be used in whole or in part for a FCRA purpose”).
The proposed interpretation is consistent with guidance previously issued by FTC staff explaining that a report that is not otherwise a consumer report may become a consumer report if it is subsequently used by the recipient for an FCRA-covered purpose.
60
That guidance also suggests that a communication of consumer information that is actually used for an FCRA-covered purpose might
not
be a consumer report if the person making the communication could not have reasonably expected the information to be used in such a way.
61
Under the CFPB's proposed interpretation, however, a report including information that “is used” for a purpose described in proposed § 1022.4(a)(2) (and that satisfies the other elements of the definition of consumer report) is a consumer report, irrespective of whether the person furnishing the report could have reasonably expected that use or took steps to prevent it.
60
FTC 40 Years Staff Report,
supra
note 21, at 22.
61
See id.
(“If the entity supplying the report has taken reasonable steps to [e]nsure that the report is not used for such a purpose, and if it neither knows of, nor can reasonably anticipate such use, the report should not be deemed a consumer report by virtue of uses beyond the entity's control.”).
Proposed § 1022.4(b) also would clarify another aspect of the phrase “is used” in the FCRA's definition of consumer report. In the definition, the phrase “for the purpose of serving as a factor in establishing the consumer's eligibility,” which follows the phrase “is used,” lacks a subject, making it unclear whose use of the information matters in determining whether information is used for a purpose described in proposed § 1022.4(a)(2). Proposed § 1022.4(b) would clarify that information is used for a purpose described in proposed § 1022.4(a)(2) if
anyone,
not merely the direct recipient of the communication, uses the information for such a purpose.
Interpreting the phrase “is used” to encompass not just the immediate recipient of the information but also downstream users is necessary to carry out the purposes of the statute and prevent evasion. If all that mattered was what the immediate recipient would do with the information, a person could potentially avoid FCRA coverage even if the person had actual knowledge that the entity to which it communicated the information was selling the information to a downstream recipient who planned to use it for a purpose described in proposed § 1022.4(a)(2). Indeed, under such an interpretation, a person could potentially use intermediaries to ensure that they never sold information directly to a recipient who would use it for such a purpose, even if the person knew that was how the information would eventually be used. The CFPB's proposed interpretation is consistent with case law holding that the “is used” element of the definition of consumer report is satisfied if
anyone
—not just the initial recipient of the communication—uses the information for a purpose described in proposed § 1022.4(a)(2).
62
62
Ernst
v.
Dish Network, LLC,
49 F. Supp. 3d 377, 383 (S.D.N.Y. 2014) (“This means that if
anyone
uses, expects to use or collects the information for [a permissible purpose], the statutory definition of `consumer report' is satisfied.”) (emphasis added);
see also Henderson
v.
Corelogic Nat'l Background Data, LLC,
161 F. Supp. 3d 389, 397-98 (E.D. Va. 2016).
As a practical matter, this would mean that a person that sells information that is used for a purpose described in proposed § 1022.4(a)(2) would become a consumer reporting agency, regardless of whether the person knows or believes that the communication of that information is legally considered a consumer report, assuming the other elements of the definition of consumer reporting agency are satisfied. In other words, so long as a person acts for the purpose of furnishing a report that is or becomes a consumer report as that term is defined in proposed § 1022.4, that person is a consumer reporting agency; a person need not know or believe it is furnishing a consumer report as that term is defined under the FCRA. For example, consider an entity that collects information about individual consumers' travel preferences for use in marketing and sells that information to a third party for marketing purposes with the belief that the communication of that information is not a consumer report. If the third party actually uses the information to establish a consumer's eligibility for credit, the report would be a consumer report (assuming the other elements of that definition were satisfied). The entity that sold the information would then be a consumer reporting agency (assuming the other elements of that definition were satisfied) because it intended to communicate to the third party the information that was in fact used for an FCRA-covered purpose, even if it did not believe that it was furnishing consumer reports. The CFPB proposes that this conclusion flows from the definition of consumer reporting agency in FCRA section 603(f).
In addition to being consistent with the regulatory text, this reading of the statute better prevents entities from evading FCRA coverage by disclaiming intent to furnish consumer reports. A requirement that a person selling consumer information is a consumer reporting agency only if it believes that its communications meet the FCRA's definition of consumer report would incentivize willful ignorance and undermine the purpose of the statute. The CFPB's interpretation, by contrast, provides a clear, bright-line rule that should be more difficult for entities, particularly data brokers, to evade. For that reason, it is more consistent with
the broad remedial purpose of the FCRA.
63
63
See, e.g., Cortez
v.
Trans Union, LLC,
617 F.3d 688, 722 (3d Cir. 2010) (describing the FCRA as “undeniably a remedial statute that must be read in a liberal manner in order to effectuate the congressional intent underlying it”);
Guimond
v.
Trans Union Credit Info. Co.,
45 F.3d 1329, 1333 (9th Cir. 1995) (observing that the FCRA's “consumer oriented objectives support a liberal construction” of the statute).
The CFPB proposes § 1022.4(b) as an interpretation of the phrase “is used.” The CFPB also preliminarily concludes that proposed § 1022.4(b) is necessary to prevent evasion of the FCRA by entities that sell consumer information and ignore the uses to which that information is put by initial and downstream recipients.
64
The CFPB requests comment on whether the proposed interpretation is likely to incentivize entities to monitor more carefully how a communication of consumer information ultimately is used, any potential alternatives to prevent entities from evading coverage under the FCRA, and any compliance challenges associated with the proposed interpretation.
64
See supra
part II.B, Goals of the Rulemaking,
Protecting Consumer Information in the Data Broker Market.
4(c) Is Expected To Be Used
Proposed § 1022.4(c) would establish two tests for determining whether information is expected to be used for a purpose described in proposed § 1022.4(a)(2). Under these tests, information in a communication is expected to be used for such a purpose if: (1) the person making the communication expects or should expect that a recipient of the information will use it for such a purpose; or (2) it is information about a consumer's credit history, credit score, debt payments, or income or financial tier. Information would need to satisfy only one of the tests for the “expected to be used” element of the definition of consumer report to be met. If either test were satisfied, the communication of the information would be a consumer report and the person communicating the information would be a consumer reporting agency, assuming the other elements of those definitions were met. As a result, the person's sale of the information would be subject to the FCRA.
4(c)(1)
Under the first test, described in proposed § 1022.4(c)(1), information in a communication is expected to be used for a purpose described in proposed § 1022.4(a)(2) if the person making the communication expects or should expect that a recipient of the information in the communication will use the information for such a purpose.
65
Proposed § 1022.4(c)(1) would clarify four aspects of the meaning of the phrase “expected to be used.”
65
Regulation V, 12 CFR 1022.3(
l
) defines person to mean “any individual, partnership, corporation, trust, estate cooperative, association, government or governmental subdivision or agency, or other entity.”
Information Is Expected To Be Used
The “expected to be used” element of the definition of consumer report does not identify what item must be “expected to be used” for a purpose described in proposed § 1022.4(a)(2). A consumer report is a “communication” of certain “information” about a consumer, so the phrase could reasonably refer to the communication itself (
i.e.,
the actual transmittal of data), or the information contained within the communication (
i.e.,
the facts that the communication describes).
Proposed § 1022.4(c) clarifies that, under the first test, the relevant inquiry is whether the
information
in a communication is expected to be used for a purpose described in proposed § 1022.4(a)(2). This proposed interpretation follows directly from the statutory language. As relevant here, the FCRA defines a consumer report as a communication of information by a consumer reporting agency “which is used or expected to be used or collected in whole or in part” for a purpose described in proposed § 1022.4(a)(2). Grammatically, the term to which “expected to be used” refers should also be the term to which “collected in whole or in part” refers. Consumer reporting agencies collect information, not communications. Accordingly, under the CFPB's proposed interpretation, the term “expected to be used” refers to information.
66
66
See Mintun
v.
Equifax Info. Servs., LLC,
535 F. Supp. 3d 988, 994 (D. Nev. 2021) (applying the series-qualifier and nearest-reasonable-referent cannons to conclude that, under the definition of consumer report, “it is the information in the communication, not the communication itself, that must be of the kind that
is used or expected to be used or collected in whole or in part
for the purposes of serving as a favor [
sic
] in credit, employment, or insurance decisions or other reasons allowed under the FCRA”).
Person Communicating the Information
The “expected to be used” element of the FCRA's definition of consumer report is phrased in the passive voice; it does not identify the subject whose expectations are relevant in determining whether a communication of information is a consumer report. Proposed § 1022.4(c)(1) rephrases this element of the definition in the active voice to clarify that, under the first test, the expectations of the person communicating the information determine whether the information is expected to be used for a particular purpose. In other words, the proposal clarifies that a communication of information is a consumer report if the person communicating the information expects the information to be used for a purpose described in proposed § 1022.4(a)(2) and the other elements of that definition are met. This proposed interpretation, which is consistent with longstanding case law, is a natural reading of the statutory language and makes sense in the context of the statute.
67
It is also necessary to prevent evasion by entities, such as data brokers, that have sufficient information to know that the consumer data they sell is likely being used for eligibility determinations.
67
See, e.g., Fralish
v.
Transunion, LLC,
No. 3:20-CV-969 JD, 2021 WL 4990003, at *3 (N.D. Ind. Oct. 26, 2021) (“Information constitutes a `consumer report' if the consumer reporting agency which prepares and sends the report `expects' the report to be used for one of the `consumer purposes' set forth by the FCRA.”);
Ippolito
v.
WNS, Inc.,
864 F.2d 440, 449 (7th Cir. 1988) (“[A] consumer may establish that a particular credit report is a `consumer report' falling within the coverage of the FCRA if . . . the consumer reporting agency which prepares the report `expects' the report to be used for one of the `consumer purposes' set forth in the FCRA.”);
Heath
v.
Credit Bureau of Sheridan, Inc.,
618 F.2d 693, 696 (10th Cir. 1980) (explaining that “ `expected to be used' would seem to refer to what the reporting agency believed”).
Knowledge Standard
The FCRA does not define the term “expected.” Proposed § 1022.4(c)(1) would clarify that, under the first test, information is expected to be used for a purpose described in proposed § 1022.4(a)(2) if the person communicating the information subjectively expects that it will be used for such a purpose, or if the person objectively
should
expect that it will be used for such a purpose.
Interpreting the phrase “expected to be used” to encompass a person's subjective and objective expectations is consistent with FTC staff's longstanding view that the definition of consumer report covers uses of information that the person can reasonably anticipate.
68
And it is consistent with case law holding that a person's reasonable expectations about how information
will be used can establish whether the person is providing consumer reports.
69
68
FTC 40 Years Staff Report,
supra
note 21, at 22 (“If the entity supplying the report has taken reasonable steps to [e]nsure that the report is not used for such a purpose, and if it neither knows of,
nor can reasonably anticipate such use,
the report should not be deemed a consumer report . . . .” (emphasis added)).
69
See, e.g., Harrington
v.
ChoicePoint Inc.,
No. CV 05-1294 MRP JWJX, 2005 WL 7979032, at *5 (C.D. Cal. Sept. 15, 2005) (holding that consumer reporting agency “should have expected the information it disclosed would be used for FCRA purposes” despite the entity's contractual language with users barring such uses); Mem. & Order at *6,
Roybal
v.
Equifax,
No. 2:05-CV-01207-MCE-KJM, 2008 WL 4532447 (E.D. Cal. Oct. 9, 2008) (allowing an FCRA claim based on inaccuracies in the reporting of a joint account because that information “could reasonably have been expected to be used” in establishing consumer's eligibility for credit);
cf. Intel Corp. Inv. Pol'y Comm.
v.
Sulyma,
589 U.S. 178 (2020) (“[T]he law will sometimes impute knowledge—often called `constructive' knowledge—to a person who fails to learn something that a reasonably diligent person would have learned.”).
Interpreting “expected to be used” in this way also is necessary to carry out the purposes of the FCRA and prevent evasion. If all that mattered was how a person subjectively expected the information to be used, the statute would reward willful ignorance: a person could potentially avoid FCRA coverage by, for example, choosing not to ask or deciding not to monitor how recipients of the information intended to use it. The proposed interpretation is therefore consistent with the statute's purpose.
70
70
See, e.g., Cortez
v.
Trans Union, LLC,
617 F.3d 688, 722 (3d Cir. 2010) (describing the FCRA as “undeniably a remedial statute that must be read in a liberal manner in order to effectuate the congressional intent underlying it”);
Guimond
v.
Trans Union Credit Info. Co.,
45 F.3d 1329, 1333 (9th Cir. 1995) (observing that the FCRA's “consumer oriented objectives support a liberal construction” of the statute).
The proposed interpretation also makes sense in the context of the statute as a whole. Elsewhere in the FCRA, Congress imposed requirements that refer only to a person's actual knowledge. For example, FCRA section 605 requires the exclusion of certain information from a consumer report if, among other things, the consumer reporting agency “has
actual knowledge
that the information is related to a veteran's medical debt.”
71
If Congress had intended the meaning of “expected to be used” to turn only on the person's actual, subjective expectations in the same way, it would have said so.
72
71
15 U.S.C. 1681c(a)(7), (8) (emphasis added).
72
See DHS
v.
MacLean,
574 U.S. 383, 392 (2015) (“Congress generally acts intentionally when it uses particular language in one section of a statute but omits it in another.”).
In enforcement actions and guidance documents, other regulators have identified a non-exhaustive list of factors that may be relevant to determining whether a person should expect that information will be used for an FCRA-covered purpose. These factors include, for example, whether the person screens potential users before allowing them to access information, whether the person advertises its information for non-FCRA-covered uses only, and whether the person maintains procedures to monitor and audit how its information is used.
73
The CFPB requests comment on whether it would be helpful to identify in Regulation V factors that are or may be relevant to determining whether a person should expect that information will be used for an FCRA-covered purpose, and, if so, what those factors might be. The CFPB also requests comment on whether it would be helpful to identify the steps a person must or should take to ensure that the consumer information it sells is not used for an FCRA-covered purpose, absent which the person would be deemed to expect that the consumer information will be used for such a purpose.
73
See, e.g.,
Compl. ¶ 9,
United States
v.
Instant Checkmate, Inc.,
No. 3:14-CV-00675-H-JMA (S.D. Cal. Mar. 24, 2014),
https://www.ftc.gov/system/files/documents/cases/140409instantcheckmatecmpt.pdf
(alleging that Instant Checkmate, in its marketing and advertising, including through its Google Ad Words campaign, “promoted the use of its reports as a factor in establishing a person's eligibility for employment or housing”); Compl. for Civil Penalties, Permanent Inj. & Other Equitable Relief ¶ 13,
United States
v.
ChoicePoint
(N.D. Ga. Jan. 30, 2006),
https://www.ftc.gov/sites/default/files/documents/cases/2006/01/0523069complaint.pdf
(alleging that ChoicePoint failed to adequately verify or authenticate the identities and qualifications of prospective users of its database).
Downstream Recipients
The phrase “for the purpose of serving as a factor in establishing the consumer's eligibility,” which follows the phrase “expected to be used” in the definition, lacks a subject, making it unclear whose use of the information matters in determining whether information is expected to be used for a purpose described in proposed § 1022.4(a)(2). For the same reasons described in the discussion of proposed § 1022.4(b), proposed § 1022.4(c)(1) would clarify that, under the first test, information is expected to be used for a purpose described in proposed § 1022.4(a)(2) if the person communicating the information expects or should expect that
any
recipient of the information will use it for such a purpose.
As discussed above, the CFPB proposes § 1022.4(c)(1) as an interpretation of the phrase “expected to be used.” The CFPB also proposes § 1022.4(c)(1) pursuant to its authority to prevent evasions of the FCRA. The CFPB preliminarily concludes that proposed § 1022.4(c)(1) is necessary to prevent evasion of the FCRA by entities that sell consumer information and ignore the uses to which that information is put by initial and downstream recipients.
74
74
See supra
part II.B, Goals of the Rulemaking,
Protecting Consumer Information in the Data Broker Market.
4(c)(2)
Under the second test, described in proposed § 1022.4(c)(2), the CFPB preliminarily concludes that entities that sell consumer information generally expect certain types of that information to be used in the market at large for a purpose described in proposed § 1022.4(a)(2), because those types of information are typically used for such a purpose. Specifically, under proposed § 1022.4(c)(2), a person selling any of four types of information about a consumer—credit history, credit score, debt payments, and income or financial tier—for
any
purpose generally would qualify as a consumer reporting agency selling consumer reports because those information types are typically used to underwrite loans. Accordingly, the person's conduct would be governed by the FCRA's restrictions and requirements, including provisions that protect the privacy and promote the accuracy of consumer data.
As discussed in part II, the data broker industry poses a range of significant harms to consumers and the nation. These include national security harms.
75
As the U.S. Department of Justice (DOJ) has observed, countries of concern can use Americans' sensitive personal data “to engage in malicious cyber-enabled activities and malign foreign influence, and to track and build profiles on U.S. individuals, including members of the military and Federal employees and contractors, for illicit purposes such as blackmail and espionage.”
76
They can also use that data “to collect information on activists, academics, journalists, dissidents, political figures, or members of non-governmental organizations or marginalized communities in order to intimidate such persons; curb political opposition; limit freedoms of expression, peaceful assembly, or association; or enable other forms of suppression of civil liberties.”
77
75
See, e.g.,
The White House,
Fact Sheet: President Biden Issues Executive Order to Protect Americans' Sensitive Personal Data
(Feb. 28, 2024),
https://www.whitehouse.gov/briefing-room/statements-releases/2024/02/28/fact-sheet-president-biden-issues-sweeping-executive-order-to-protect-americans-sensitive-personal-data/.
76
89 FR 15780, 15781 (Mar. 5, 2024) (U.S. Dep't of Just. Advance Notice of Proposed Rulemaking seeking comment on topics related to the implementation of E.O. 14117).
77
Id.
Recent research funded by the U.S. Military Academy at West Point has highlighted the gravity of the threat posed by data brokers who sell information about the activities and private lives of United States military personnel, veterans, government employees, and their families.
78
With virtually no vetting, researchers were able to purchase individually identified information about active-duty military members' income, net worth, and credit rating—information that could be used by foreign adversaries to identify individuals for purposes of coercion, blackmail, or espionage.
79
Data brokers also facilitate the targeting of military members and government employees by allowing buyers to purchase lists that match multiple categories, such as lists that include individuals who fall into the “Intelligence and Counterterrorism” category and the “Behind on Bills” category.
80
As President Biden noted in a February 2024 executive order addressing foreign access to Americans' data, “[t]he continuing effort of certain countries of concern to access Americans' sensitive personal data and United States Government-related data constitutes an unusual and extraordinary threat . . . to the national security and foreign policy of the United States.”
81
78
See
Duke Report on Data Brokers and Military Personnel Data,
supra
note 2.
79
Id.
at 5.
80
Consumer Fin. Prot. Bureau,
Prepared Remarks of CFPB Director Rohit Chopra at the White House on Data Protection and National Security
(Apr. 2, 2024),
https://www.consumerfinance.gov/about-us/newsroom/prepared-remarks-of-cfpb-director-rohit-chopra-at-the-white-house-on-data-protection-and-national-security/.
81
E.O. No. 14117, 89 FR 15421 (Feb. 28, 2024).
The data broker industry also poses unique harms to individuals in financially precarious situations. Fraudsters can use information from data brokers to target individuals likely to purchase predatory financial products. For example, some data brokers sell consumer lists with titles such as “Rural and Barely Making It,” “Retiring on Empty: Single,” and “Credit Crunched: City Families.”
82
As the Senate Committee on Commerce, Science, and Transportation observed over a decade ago, these lists “appeal to companies that sell high-cost loans and other financially risky products to populations more likely to need quick cash.”
83
The purchase and sale of consumers' financial information can also be used to perpetrate outright scams against low-income individuals and individuals in financially precarious situations. In 2015, for example, the FTC brought suit against a data broker operation that sold payday loan applicants' financial information to phony internet merchants and fraudsters who used the information to debit consumers' bank accounts for financial products that the consumers never actually purchased.
84
82
S. Comm. on Com., Sci., & Transp., Off. of Oversight & Investigations Majority Staff,
A Review of the Data Broker Industry: Collection, Use, and Sale of Consumer Data for Marketing Purposes,
at 5 (Dec. 18, 2013),
https://www.commerce.senate.gov/services/files/0d2b3642-6221-4888-a631-08f2f255b577.
83
Id.
84
Compl. for Permanent Inj. and Other Equitable Relief,
Fed. Trad Comm'n
v.
Sequoia One, LLC,
No. 2:15-cv-01512-JCM-CWH (D. Nev. Aug. 7, 2015),
https://www.ftc.gov/system/files/documents/cases/150812sequoiaonecmpt.pdf;
Fed. Trade Comm'n,
FTC Charges Data Brokers with Helping Scammer Take More Than $7 Million from Consumers' Accounts
(Aug. 12, 2015),
https://www.ftc.gov/news-events/news/press-releases/2015/08/ftc-charges-data-brokers-helping-scammer-take-more-7-million-consumers-accounts.
The data broker industry also poses data security risks. The highly sensitive consumer information collected and sold by data brokers is an attractive target for hackers and identity thieves. In recent years, cyber criminals have stolen from data brokers information about hundreds of millions of Americans,
85
some of which has been made available for sale.
86
Purchasers can use this information to open new financial accounts in consumers' names, drain existing accounts, obtain loans, seek employment, apply for government benefits, and send “phishing” communications to family and friends. According to the DOJ, in 2021 nearly 24 million U.S. residents over 16 had experienced identity theft in the past 12 months, with financial losses of over $16 billion.
87
85
See, e.g.,
Brian Krebs,
NationalPublicData.com Hack Exposes a Nation's Data,
Krebs on Security (Aug. 15, 2024),
https://krebsonsecurity.com/2024/08/nationalpublicdata-com-hack-exposes-a-nations-data/;
Justin Sherman, Duke Sanford School of Public Policy,
Data Brokers and Data Breaches
(Sept. 27, 2022),
https://techpolicy.sanford.duke.edu/blogroll/data-brokers-and-data-breaches;
Brian Krebs,
Hacked Data Broker Accounts Fueled Phone COVID Loans, Unemployment Claims,
Krebs on Security (Aug. 6, 2020),
https://krebsonsecurity.com/2020/08/hacked-data-broker-accounts-fueled-phony-covid-loans-unemployment-claims/;
Lily Hay Newman,
1.2 Billion Records Found Exposed Online in a Single Server,
Wired (Nov. 22, 2019),
https://www.wired.com/story/billion-records-exposed-online;
Stacy Cowley,
Equifax to Pay at Least $650 Million in Largest-Ever Data Breach Settlement,
N.Y. Times (July 22, 2019),
https://www.nytimes.com/2019/07/22/business/equifax-settlement.html.
86
See, e.g.,
Brian Krebs,
National Public Data Published Its Own Passwords,
Krebs on Security (Aug. 19, 2024),
https://krebsonsecurity.com/2024/08/national-public-data-published-its-own-passwords/;
Brian Krebs,
Data Broker Giants Hacked by ID Theft Service,
Krebs on Security (Sept. 25, 2013),
https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/.
87
Erika Harrell & Alexandra Thompson, Bureau of Just. Stat., U.S. Dep't of Just., NCJ 306474,
Victims of Identity Theft, 2021,
at 1 (Oct. 2023),
https://bjs.ojp.gov/document/vit21.pdf.
In addition, the data broker industry poses risks to the personal safety of American consumers. For example, domestic abusers and others can use data from data brokers to stalk, harass, and commit violence.
88
Other bad actors can use data broker information to dox consumers, expose their personal information, and subject them to distress, embarrassment, shame, and stigma.
89
Moreover, the data broker industry threatens consumers' right to privacy—the right to be left alone, free from wrongful intrusions into private activities.
90
Surveys suggest that many consumers would be concerned to know that information about their personal lives was being bought and sold without their consent and outside their control by entities with whom they have no
relationship and whose actions they cannot trace.
91
And the data broker industry raises questions of fundamental fairness to consumers. The consumer profiles that data brokers compile and sell can determine what offers, benefits, and opportunities consumers receive.
92
Yet those profiles, often based on data of dubious veracity and sometimes merely on inferences drawn from that data, are typically constructed without consumers' knowledge, input, or permission, creating a significant risk that they contain inaccurate, incomplete, or outdated information that consumers are often powerless to correct.
88
See, e.g.,
Letter from Amy Klobuchar & Lisa Murkowski, Sens., U.S. Senate, to Hon. Rebecca K. Slaughter, Acting Chair, Fed. Trade Comm'n (Mar. 4, 2021),
https://www.klobuchar.senate.gov/public/_cache/files/5/e/5e1e58a4-4b38-49e8-9a8b-37ea1604d9b9/A6F005737B2A977445475E4E0C2E3685.ftc-privacy-and-domestic-violence-letter-final---signed.pdf
(expressing “serious concerns regarding recent reports that data brokers are publicizing the location and contact information of victims of domestic violence, sexual violence, and stalking”); Esther Salas,
My Son Was Killed Because I'm a Federal Judge,
N.Y. Times (Dec. 8, 2020),
https://www.nytimes.com/2020/12/08/opinion/esther-salas-murder-federal-judges.html
(recounting instance in which aggrieved litigant obtained Federal judge's address from data broker); Mara Hvistendahl,
I Tried to Get My Name Off People-Search Sites. It Was Nearly Impossible.,
Consumer Reports (Aug. 20, 2020),
https://www.consumerreports.org/personal-information/i-tried-to-get-my-name-off-peoplesearch-sites-it-was-nearly--a0741114794/
(recounting domestic abuse victim's effort to delete her information from data broker databases so that her abuser could not obtain it);
Remsburg
v.
Docusearch, Inc.,
No. Civ. 00-211-B, 2002 WL 844403, at *2-3 (D.N.H. Apr. 25, 2002) (describing stalker's use of data broker information to locate victim).
89
See, e.g.,
Joseph Cox & Emanuel Maiberg,
Fiverr Freelancers Offer to Dox Anyone With Powerful U.S. Data Tool,
404 Media (July 2, 2024),
https://www.404media.co/fiverr-freelancers-offer-to-dox-anyone-with-powerful-u-s-data-tool-tloxp/;
Joseph Cox,
The Secret Weapon Hackers Can Use to Dox Nearly Anyone in America for $15,
404 Media (Aug. 22, 2023),
h
ttps:/
/
www.404media.co/the-secret-weapon-hackers-can-use-to-dox-nearly-anyone-in-america-for-15-tlo-usinfosearch-transunion/?curator=TechREDEF.
90
Cf. In re Facebook, Inc. Internet Tracking Litig.,
956 F.3d 589, 603-04 (9th Cir. 2020) (observing that “[t]echnological advances . . . provide access to a category of information otherwise unknowable and implicate privacy concerns in a manner different from traditional intrusions as a ride on horseback is different from a flight to the moon” (internal quotation marks and citations omitted));
FTC
v.
Kochava, Inc.,
715 F. Supp. 3d 1319, 1324 (D. Idaho 2024) (noting that the Supreme Court has recognized “the unique threat that modern technology can pose to privacy rights” (citing
Carpenter
v.
United States,
585 U.S. 296 (2018)).
91
See, e.g.,
Brooke Auxier et al.,
Americans and Privacy: Concerned, Confused and Feeling Lack of Control Over Their Personal Information,
Pew Rsch. Ctr. (Nov. 15, 2019),
https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/; cf.
Tiffany Johnson et al.,
It's All Personal: A Study on Consumer Attitudes Towards Data Collection & Usage,
PCH Consumer Insights, at 3 (Nov. 15, 2023),
https://insights.pch.com/img/data-ethics-design.pdf
(identifying data types that consumers regard as “personal”).
92
See
FTC Data Broker Report,
supra
note 25, at 31 (noting that score produced by data brokers “could be used to determine the types of offers consumers may receive, the number of offers, or even the level of customer service provided to specific individuals”).
Notwithstanding these harms, for years many data brokers have attempted to avoid liability under the FCRA by arguing that the “expected to be used” portion of the statute's definition of consumer report is satisfied only if the person selling the communication expects that the buyer will use the communication for a purpose described in FCRA section 603(d)(1), such as to assess the consumer's eligibility for credit. According to this argument, if the seller expects that the buyer will use the communication for another purpose, such as to market products, the “expected to be used” portion of the definition is not satisfied. And as long as the communication was not actually used, and the information in the communication was not collected, for a purpose described in FCRA section 603(d)(1), this argument provides that there is no consumer report and the FCRA does not apply. Where courts have been presented with certain fact patterns, such as where the data broker took steps to monitor and prohibit the sale of data for FCRA uses, this has sometimes served as an adequate defense. However, it is unclear whether courts have been squarely presented with an alternative approach to the issue.
93
93
See, e.g., Ippolito
v.
WNS, Inc.,
864 F.2d 440, 450-51 (7th Cir. 1988) (focusing on the purchaser's conduct in determining whether the entity that sold a report expected that it would be used for an FCRA-covered purpose).
Construing the phrase “expected to be used” in this way leads to a result contrary to the FCRA's stated objective in section 602(a)(4) of “respect[ing] . . . the consumer's right to privacy.” Section 604's prohibition on furnishing consumer reports for non-permissible purposes, such as marketing outside of the prescreening context, is evaded by the very acts that section 604 purportedly prohibits. This is because, as the FCRA defines the term “consumer report” in section 603(d)(1)(C), a communication of information is not a consumer report unless it is used or expected to be used for a permissible purpose in the first place—
i.e.,
for a purpose “authorized under section [604].” This reading of “expected to be used” would render section 604's prohibitions a nullity with respect to the furnishing of consumer reports for non-permissible purposes, except for the fact that a communication of information could still be a consumer report if the information was “collected in whole or in part” for a permissible purpose. Under this reading, if an entity collects information for a permissible purpose, it cannot provide that same information for an impermissible purpose.
But it would shortchange the FCRA's privacy-protecting objectives to conclude that consumer information collected by a consumer reporting agency for a purpose authorized under section 604 is subject to all of the FCRA's restrictions, including prohibitions on uses outside of what section 604 authorizes, while identical consumer information collected by a data broker solely for a purpose not authorized under section 604 is subject to none of the FCRA's restrictions. Under such an interpretation, for example, Congress would have prohibited a consumer reporting agency that collects consumers' income information for use by banks in making credit eligibility decisions from selling that information for marketing purposes (or any other non-permissible purpose), but it would have permitted a data broker that collects the
exact same
income information solely for purposes Congress did not authorize in the FCRA to sell the information for those purposes. This has led to the unregulated proliferation of the very types of consumer information that the FCRA's framers intended to protect.
94
94
See
115 Cong. Rec. S2413 (Jan. 31, 1969) (statement of FCRA's primary sponsor expressing concern about companies that maintain “files on millions of Americans, including their employment, income, billpaying record, marital status, habits, character and morals” without adequate regulations restricting the files' use).
Proposed § 1022.4(c)(2) would avoid this result and conform with Congress's intent to protect consumers' right to privacy by providing that certain types of information about consumers—namely, credit history, credit score, debt payments, and income or financial tier—are expected to be used for a purpose described in proposed § 1022.4(a)(2) even if the specific communication in which the information is conveyed is not itself used or expected to be used for such a purpose.
The CFPB proposes that the text of FCRA section 603(d)(1) alone may support proposed § 1022.4(c)(2). In contrast to prior case law that did not consider this approach, the CFPB preliminarily determines that the part of the definition of consumer report referring to what the sender “expects” could be construed as referring not to how the sender expects the “communication” or report will be used, but rather to how the sender expects the “information” within the report will be used.
95
“Information” is defined as “knowledge obtained from investigation, study, or instruction; intelligence, news; facts, data.”
96
Accordingly, whether information “is expected to be used” for a particular purpose may depend, in part, on how the facts in a communication might be used in the future, even if they are provided by other entities in different “communications” or reports.
95
Cf. Mintun
v.
Equifax Info. Servs., LLC,
535 F. Supp. 3d 988, 994 (D. Nev. 2021).
96
See Information,
Merriam-Webster.com Dictionary,
https://www.merriam-webster.com/dictionary/information
(last visited Oct. 15, 2024).
The CFPB preliminarily concludes that a data broker selling information about a consumer's credit history, credit score, debt payments (including on non-credit obligations), or income or financial tier should know that such information is typically used in determining a consumer's eligibility for credit, and therefore should expect that such information will be used for an FCRA purpose. According to FICO, for example, its credit scores are used in 90 percent of all lending decisions.
97
Moreover, in assessing a consumer's eligibility for a mortgage loan, the nation's largest lenders consider, among other things, a prospective borrower's income (often by reviewing a consumer's W-2 statements, tax returns, and pay stubs), as well as the borrower's credit history and level of indebtedness
(often by reviewing multiple or merged consumer reports).
98
Indeed, the government-sponsored entities that purchase a substantial portion of residential mortgage loans
99
require lenders to obtain a consumer's credit report and score, and consider a consumer's income and recurring debt payments, before making a loan.
100
And the CFPB's ability-to-repay rules require lenders to consider similar information.
101
97
Basic Facts About FICO Scores,
FICO,
https://www.fico.com/en/latest-thinking/fact-sheet/basic-facts-about-fico-scores
(last visited Oct. 30, 2024).
98
See, e.g., What Documents Are Needed to Apply for a Mortgage?,
Chase,
https://www.chase.com/personal/mortgage/education/financing-a-home/mortgage-application
(last visited Oct. 30, 2024);
How to Apply for a Mortgage,
Bank of America,
https://www.bankofamerica.com/mortgage/learn/how-to-apply-for-a-mortgage/
(last visited Oct. 30, 2024);
Home-Buying & Mortgage Process,
US Bank,
https://www.usbank.com/home-loans/mortgage/first-time-home-buyers/mortgage-process.html
(last visited Oct. 30, 2024);
Importance of Credit, Debt, and Savings When Buying a House,
Wells Fargo,
https://www.wellsfargo.com/mortgage/learning/getting-started/importance-of-credit-debt-savings-in-homebuying/
(last visited Oct. 15, 2024); Hanna Kielar,
Qualifying For A Mortgage: The Basics,
Rocket Mortgage (Apr. 10, 2024),
https://www.rocketmortgage.com/learn/mortgage-qualification.
99
See
Fed. Hous. Fin. Agency,
FHFA Statistics, What Types of Mortgages Do Fannie Mae and Freddie Mac Acquire?
(Apr. 14, 2021),
https://www.fhfa.gov/blog/statistics/what-types-of-mortgages-do-fannie-mae-and-freddie-mac-acquire
(listing enterprise share of mortgage originations by year).
100
See, e.g.,
Fannie Mae,
Selling Guide: Fannie Mae Single Family,
at B3 (June 5, 2024),
https://singlefamily.fanniemae.com/media/39241/display;
Freddie Mac,
Seller/Servicer Guide,
at Series 5000,
https://guide.freddiemac.com/app/guide/series/5000
(last visited Oct. 30, 2024).
101
Regulation Z, 12 CFR 1026.43(c).
As a practical matter, if proposed § 1022.4(c)(2) were finalized, then, under FCRA section 604, data brokers and similar entities that otherwise met the definition of a consumer reporting agency could not sell reports containing a consumer's credit history, credit score, debt payments, or income or financial tier to anyone who lacked a permissible purpose to obtain them, such as a company that intended to use the reports for marketing purposes outside of the statute's pre-screening provisions.
102
Such entities also would need to comply with the FCRA's other prohibitions and requirements for consumer reporting agencies, such as the requirement in FCRA section 607 to follow reasonable procedures to assure maximum possible accuracy of the information in their reports, and the requirements in FCRA sections 609 and 611 to disclose certain information to consumers and to investigate consumers' disputes.
103
102
15 U.S.C. 1681b.
103
15 U.S.C. 1681e, 1681g, 1681
i.
If proposed § 1022.4(c)(2) is finalized, a substantial number of additional data brokers operating today likely will qualify as consumer reporting agencies selling consumer reports under the FCRA, resulting in improved consumer protections and a substantial reduction in the volume of consumer information being bought and sold for non-permissible purposes, such as marketing. In addition, proposed § 1022.4(c)(2), if finalized, should make it more difficult for bad actors to purchase consumer information from data brokers and threaten national security or facilitate financial scams and fraud. In these ways, proposed § 1022.4(c)(2) would further the FCRA's broad remedial purpose
104
and Congress's intent to protect consumers' right to privacy and to provide greater protections for particularly sensitive consumer information.
105
104
See, e.g., Cortez
v.
Trans Union, LLC,
617 F.3d 688, 722 (3d Cir. 2010) (describing the FCRA as “undeniably a remedial statute that must be read in a liberal manner in order to effectuate the congressional intent underlying it”);
Guimond
v.
Trans Union Credit Info. Co.,
45 F.3d 1329, 1333 (9th Cir. 1995) (observing that the FCRA's “consumer oriented objectives support a liberal construction” of the statute).
105
See
15 U.S.C. 1681(a).
In the Small Business Review Panel Outline, the CFPB described a proposal under consideration that would have provided that information in a communication is expected to be used for an FCRA purpose if the information is the type of information typically used for such a purpose. The Small Business Review Panel recommended that the CFPB consider how best to provide guidance on the types of information about consumers that are typically used for an FCRA purpose. Proposed § 1022.4(c)(2) is limited to the four types of information listed in that section: a consumer's credit history, credit score, debt payments, and income or financial tier. This limitation creates a bright-line rule that is responsive to the Small Business Review Panel's feedback, and that should simplify compliance and enforcement and reduce market uncertainty. The CFPB requests comment on whether it would be helpful to provide further guidance defining the four types of information listed in proposed § 1022.4(c)(2).
The CFPB notes that proposed § 1022.4(c)(2) would cover, for example, a list of people with income or credit scores above or below a certain number or within a certain range, even if a consumer's precise income or credit score is not specified. If all other elements of the definitions of consumer report and consumer reporting agency were satisfied, the list would be a series of consumer reports and the entity communicating the list would be a consumer reporting agency. In addition, the CFPB reiterates that information would need to satisfy only one of the tests in proposed § 1022.4(c) for the “expected to be used” element of the definition of consumer report to be met. In other words, the communication of information that is
not
specifically listed in proposed § 1022.4(c)(2)—including, for example, criminal records, employment information, eviction history, and alternative data
106
—could still be a consumer report if the person communicating the information expects or should expect that a recipient of the information in the communication will use the information for an FCRA purpose.
106
See generally
82 FR 11183 (Feb. 21, 2017) (request for information about the use or potential use of alternative data in the credit process).
The CFPB proposes § 1022.4(c)(2) as an administrable, bright-line rule for certain categories of information to implement the phrase “expected to be used” in the FCRA's definition of consumer report. The CFPB also proposes § 1022.4(c)(2) pursuant to its authority to prescribe regulations necessary to carry out the purposes of the FCRA and prevent evasion. It is likely that a substantial number of data brokers sell the types of information listed in proposed § 1022.4(c)(2), and that a substantial number of the entities that buy such information from data brokers in fact use it for FCRA purposes—including to make credit eligibility determinations. Nevertheless, many data brokers attempt to avoid the legal obligations of the FCRA by remaining ignorant of how their data ultimately is used, in some instances by selling data without inquiring into the buyer's identity or intended use of the data, in other instances by ignoring certain uses or disclaiming liability for them, and in other instances by selling data to intermediary entities that sell it further downstream.
107
These practices—data brokers' sale of information that is typically used for credit eligibility determinations and data brokers' minimal oversight of the uses to which that information is
put
108
—have created a unique likelihood that the information sold by data brokers will be used by downstream buyers to evaluate a consumer's eligibility for credit.
109
Data brokers collect, buy, and sell the same types of data that consumer reporting agencies assemble and disseminate, and the data broker industry poses many of the same risks that the FCRA was designed to address.
110
Yet many data brokers have attempted to evade coverage under the statute. One purpose of proposed § 1022.4(c)(2) is to prevent further evasion.
107
See, e.g.,
Duke Report on Data Brokers and Military Personnel Data,
supra
note 2, at 25-29; Compl. For Permanent Inj., Monetary Relief, Other Equitable Relief, and Civil Penalties,
FTC
v.
Instant Checkmate, LLC,
No. 3:23-cv-01674 TWR (MSB) (S.D. Cal. Sept. 11, 2023),
https://www.ftc.gov/system/files/ftc_gov/pdf/truthfinder_complaint.pdf;
Press Release, Fed. Trade Comm'n,
FTC Warns Data Broker Operations of Possible Privacy Violations
(May 7, 2013),
https://www.ftc.gov/news-events/news/press-releases/2013/05/ftc-warns-data-broker-operations-possible-privacy-violations.
108
See, e.g.,
Duke Report on Data Brokers and Sensitive Data,
supra
note 29, at 4-8; FTC Data Broker Report,
supra
note 25, at B1-B5.
109
See
15 U.S.C. 1681a(d)(1)(A) through (C) and 1681b(a)(3).
110
See
115 Cong. Rec. S2413 (Jan. 31, 1969).
The CFPB requests comment on proposed § 1022.4(c)(2) and other possible approaches to implementing the definition of consumer report, as well as on the potential impacts of each approach, including on whether they would advance the privacy interests of consumers and protect consumers from data misuses and abuses. In addition, the CFPB requests comment on the possible effects, if proposed § 1022.4(c)(2) is finalized, on entities that furnish data to, purchase data from, or rely on the services of entities that would qualify as consumer reporting agencies selling consumer reports.
4(d) Personal Identifiers for a Consumer
Proposed § 1022.4(d) relates to certain personal identifiers for a consumer that are often referred to as “credit header” information. Personal identifiers typically appear at the top of consumer reports and include, for example, names, date of birth, addresses, Social Security number (SSN), and telephone number. In § 1022.4(d)(1), the CFPB proposes to provide that the term “consumer report” includes a communication by a consumer reporting agency of a personal identifier for a consumer that was collected by the consumer reporting agency in whole or in part for the purpose of preparing a consumer report about the consumer. This would mean that a consumer reporting agency could only make such a communication if the user had a permissible purpose under the FCRA to obtain it. Proposed § 1022.4(d)(2) sets forth an enumerated list of information that would constitute personal identifiers for a consumer. The CFPB proposes § 1022.4(d) to prevent the misuse of personal identifiers collected by consumer reporting agencies to prepare consumer reports and to prevent evasions of the FCRA.
How Personal Identifiers Are Treated Today
The FTC has addressed personal identifiers collected by consumer reporting agencies in various contexts over the last few decades and has generally taken a fact-specific approach in determining whether communications of identifying information by consumer reporting agencies are consumer reports. For example, in 2000, the FTC determined in an administrative opinion that age was consumer report information when communicated by a consumer reporting agency,
111
but that various other types of personal identifiers were not, based on evidence in a proceeding regarding whether the different types of information bore on the seven factors specified in the definition of consumer report and how they were used or expected to be used.
112
In its 2011 staff report, the FTC indicated that demographic and identifying information about consumers such as name and address generally is not considered consumer report information under the FCRA, unless it is used for eligibility determinations.
113
The FTC stated that a report limited to identifying information does not constitute a consumer report if it does not bear on any of the seven factors specified in the definition and is not used to determine eligibility.
114
111
In re Trans Union Corp.,
FTC Docket No. 9255, at 31 (Feb. 10, 2000),
https://www.ftc.gov/sites/default/files/documents/cases/2000/03/transunionopinionofthecommission.pdf
(“[T]he record shows that an individual's age does bear on their credit capacity and is used in credit granting decisions. . . . The record . . . demonstrates that lenders use age information as a factor in credit granting decisions. Further, age clearly bears on credit capacity where state laws restrict contracting with minors. Therefore, age information falls within the definition of a consumer report and its disclosure by a CRA to target marketers violates the FCRA.”) (citations omitted);
see also
65 FR 33645, 33668 n.35 (May 24, 2000) (noting that age is consumer report information).
112
In re Trans Union Corp.,
FTC Docket No. 9255, at 30-31 (Feb. 10, 2000),
https://www.ftc.gov/sites/default/files/documents/cases/2000/03/transunionopinionofthecommission.pdf
(concluding that (1) name, mother's maiden name, generational designator, telephone number, and SSN were not consumer report information because the evidence presented in the proceeding did not show that they bore on any of the seven factors specified in the definition of consumer report, and (2) address was not consumer report information because, while it might bear on creditworthiness, the evidence presented in the proceeding did not show that address was used or expected to be used as a credit eligibility factor in scoring or as a credit criterion in prescreening).
113
FTC 40 Years Staff Report,
supra
note 21, at 1 n.4.
114
Id.
at 21. The 2011 staff report indicated, for example, that “[t]elephone and other directories that only provide names, addresses, and phone numbers, are not `consumer reports,' because the information is not collected to be used or expected to be used in evaluating consumers for credit, insurance, employment, or other purposes.” The FTC recognized, however, that a list of consumers' names and addresses is a series of consumer reports if the list is assembled or defined by reference to characteristics or other information that is also used (even in part) in eligibility decisions. For example, the FTC noted that “a list comprised solely of consumer names and addresses, but compiled based on the criterion that every name on the list has at least one active trade line, updated within six months, is a series of consumer reports.”
Id.
In finalizing its initial privacy regulation under the Gramm-Leach-Bliley Act (GLBA), the FTC explained that, to the extent that a consumer reporting agency's communication of “credit header” information is not a consumer report, GLBA and its implementing regulation limit consumer reporting agencies' redisclosure of information furnished by financial institutions pursuant to the GLBA's consumer reporting exception, which allows financial institutions to share nonpublic personal information with a consumer reporting agency in accordance with the FCRA without providing consumers notice and an opportunity to opt out of such sharing.
115
Specifically, the FTC explained that GLBA and its implementing regulation do not allow a consumer reporting agency that receives information pursuant to this exception to redisclose the information to “individual reference services, direct marketers, or any other party that does not have a permissible purpose to obtain that information as part of a consumer report.”
116
The FTC noted, however, that consumer reporting agencies may be able to sell consumer identifying information if they receive the information from financial institutions outside of a GLBA exception.
117
115
65 FR 33646, 33668 (May 24, 2000) (citing 15 CFR 313.15(a)(5), which the CFPB later restated in Regulation P as 12 CFR 1016.15(a)(5)).
116
65 FR 33646, 33668 (May 24, 2000) (declining requests that the FTC create a new exception to the reuse and redisclosure limitations that would allow consumer reporting agencies to sell “credit header” information);
see also Trans Union LLC
v.
FTC,
295 F.3d 42 (D.C. Cir. 2002) (rejecting challenges to FTC privacy rule, including to its handling of header information).
117
65 FR 33646, 33668-69 (May 24, 2000).
Courts considering communications of personal identifiers by consumer reporting agencies have generally concluded that such communications are not consumer reports, largely on the ground that the information does not bear on the factors specified in the definition.
118
However, similar to the
FTC's guidance, some decisions have recognized that communications of identifying information may meet the FCRA definition of consumer report in specific circumstances.
119
118
See, e.g., Gray
v.
Experian Info. Sols. Inc.,
No. 8:23-CV-981-WFJ-AEP, 2023 WL 6895993, at *3-4 (M.D. Fla. Oct. 19, 2023);
Bickley
v.
Dish Network, LLC,
751 F.3d 724, 729 (6th Cir. 2014);
Ali
v.
Vikar Mgmt. Ltd.,
994 F. Supp. 492, 497, 499 (S.D.N.Y.
1998);
Dotzler
v.
Perot,
914 F. Supp. 328, 330-31 (E.D. Mo. 1996),
aff'd,
124 F.3d 207 (8th Cir. 1997).
119
Steinmetz
v.
LexisNexis,
No. 2:19-CV-00070-RFB-DJA, 2020 WL 2198974, at *3 (D. Nev. May 5, 2020) (noting that “it is not inconceivable that information like one's birthdate could be relevant for determining eligibility for certain consumer credit products”).
Consumer reporting agencies and other industry stakeholders have generally taken the position that personal identifiers are not subject to the FCRA at all.
120
Consumer reporting agencies thus currently sell “credit header” information for purposes that are not permissible purposes under the FCRA.
121
For example, such information appears to be offered for sale for purposes not authorized under section 604, such as marketing
122
that is not done in accordance with the statute's prescreening or written instructions provisions.
123
120
See, e.g.,
Comment from stakeholder Equifax,
Re: CFPB's Small Business Advisory Review Panel for Consumer Reporting Rulemaking—Outline of Proposals and Alternatives Under Consideration,
at 2 (Nov. 6, 2023) (“Credit header information, such as name, current and former addresses, Social Security number, date of birth, and phone number, does not meet the current, definitional standard for a consumer report.”). Indeed, an industry trade association has erroneously suggested that the FTC has categorically excluded identifying information from the definition of consumer report. Comment from stakeholder CDIA,
Re: CFPB's Small Business Advisory Review Panel for Consumer Reporting Rulemaking—Outline of Proposals and Alternatives Under Consideration,
at 13 (Nov. 6, 2023) (“The FTC's long-standing and unambiguous interpretation of the FCRA is that identifying information (
i.e.,
credit header information) does not constitute a consumer report.”).
121
See, e.g., What Is Credit Header?,
Tracers (Oct. 22, 2020),
https://www.tracers.com/blog/what-is-credit-header/
(“You can see how beneficial all of this information can be if you're a business trying to reach out to brand new or existing customers. This type of data isn't regulated under the Fair Credit Reporting Act because it's not part of a customer's credit history, which means you can use it in a variety of ways for your business's benefit.”).
122
See, e.g., Introducing Acxiom Auto 360: Data Solution for OEMs and Car Dealerships,
Acxiom,
https://www.acxiom.com/auto-360/
(last visited Oct. 30, 2024) (“What if you needed only one, incredibly powerful data-marketing tool? One solution using best-in-industry capabilities combining household data sets with credit header data and adding insights to
influence
a customer's next buying decision.”).
123
FCRA section 604(c)(1)(B) permits consumer reporting agencies to furnish consumer reports in connection with credit or insurance transactions not initiated by the consumer under certain conditions, including that the consumer reporting agency must allow consumers to opt out of the prescreening process, the user must provide a firm offer of credit or insurance to consumers whose information they receive, and both the consumer reporting agency and the user must comply with notice requirements. FCRA section 604(a)(2) permits consumer reporting agencies to furnish a consumer report in accordance “with the written instructions of the consumer to whom it relates.”
Implementing the FCRA's Definition of the Term “Consumer Report”
The CFPB proposes § 1022.4(d) pursuant to its authority under FCRA section 621(e)(1) to “prescribe regulations as may be necessary or appropriate to administer and carry out the purposes and objectives” of the FCRA, including the definition of consumer report in FCRA section 603(d). As noted above, a consumer report under the FCRA is, in general, a communication by a consumer reporting agency of any information that: (1) bears on at least one of seven specified factors; and (2) is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing a consumer's eligibility for credit, insurance, or employment purposes or for any other purpose authorized under FCRA section 604. The CFPB preliminarily concludes that a consumer reporting agency's communication of a personal identifier for a consumer that the consumer reporting agency collected for the purpose of preparing a consumer report about the consumer meets both prongs of the definition and, therefore, that a communication of such information by a consumer reporting agency is a consumer report.
The CFPB preliminarily concludes that personal identifiers for a consumer bear on one or more of the seven factors specified in the definition of consumer report. Those factors are a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.
Webster's dictionary defines “characteristic” as “a distinguishing trait, quality, or property.”
124
A consumer's names (including aliases), age or date of birth, addresses, telephone numbers, email addresses, and SSN or Individual Taxpayer Identification Number (ITIN) are all themselves personal characteristics of the consumer because they are personal traits, qualities, or properties that serve to distinguish the consumer.
125
124
See Characteristic,
Merriam-Webster.com Dictionary,
https://www.merriam-webster.com/dictionary/characteristic
(last visited Oct. 30, 2024).
125
See, e.g., Moreland
v.
CoreLogic SafeRent LLC,
No. SACV 13-470 AG ANX, 2013 WL 5811357, at *4 (C.D. Cal. Oct. 25, 2013) (“Where a person lives is a fundamental ‘personal characteristic [ ].’ ”).
Personal identifiers for a consumer also can bear on the specified factors in other ways. For example, a consumer's current and former names and aliases may bear on the consumer's mode of living by revealing family associations, marital history, and the names the consumer has chosen to use. Similarly, email addresses that the consumer uses or has used may, for example, provide information about the consumer's educational or employment associations. Addresses and telephone numbers provide information about where a consumer has lived, how often they have moved, and whether they receive mail at a post office box, which are part of the consumer's mode of living. The fact that no SSN is provided for a consumer or that another identification number (such as an ITIN or a matricula consular number) is provided can reveal information about the consumer's immigration status, which is a personal characteristic and bears on the consumer's mode of living.
Additionally, the mere fact that a particular consumer reporting agency or type of consumer reporting agency has personal identifiers for a consumer can itself bear on one or more of the factors specified in the definition of consumer report. For example, the fact that a nationwide consumer reporting agency has personal identifiers for a consumer suggests that it has credit records about the consumer and the consumer is not “credit invisible,” which goes to the consumer's credit capacity or credit standing. Similarly, the fact that a particular type of specialty consumer reporting agency has personal identifiers for a consumer might suggest that the consumer rents rather than owns their home; has applied for individually underwritten life or health insurance; has had claims filed against their homeowner's or automobile insurance policies; or has a telecommunication, pay TV, or utility account.
126
126
See, e.g.,
Consumer Fin. Prot. Bureau,
List of Consumer Reporting Companies
(2024),
https://www.consumerfinance.gov/consumer-tools/credit-reports-and-scores/consumer-reporting-companies/companies-list/
(last visited Oct. 15, 2024) (“Most tenant screening companies won't have information on you unless you apply for rental housing or otherwise authorize a landlord or property manager to obtain a report from them.”);
Request Your MIB Underwriting Services Consumer File,
MIB Group,
https://www.mib.com/request_your_record.html
(last visited Oct. 15, 2024) (“You will not have an MIB Underwriting Services Consumer File unless you have applied for individually underwritten life or health insurance in the last seven years.”); Natalie Todoroff & Jessa Claeys,
What are CLUE reports in insurance?
Bankrate (Sept. 3, 2024),
https://www.bankrate.com/insurance/homeowners-insurance/clue-report/
(describing information included in CLUE reports);
NCTUE empowers you to take control of your credit,
NCTUE Consumers,
https://nctue.com/consumers/
(last visited Oct. 15, 2024).
The CFPB also preliminarily determines that personal identifiers collected by consumer reporting agencies to prepare consumer reports meet the second prong of the definition
of consumer report because they are used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for consumer credit or insurance, employment purposes, or other purposes authorized under FCRA section 604. The personal identifiers at issue in this proposal are only information that comes from entities that are already consumer reporting agencies that furnish consumer reports, and the question is whether such entities can take the sensitive contact information that they collect to prepare consumer reports and sell it for purposes not authorized under the FCRA. In that fact pattern, the CFPB preliminarily determines that the sensitive contact information was “collected in whole or in part” to populate consumer reports to furnish to clients that use it for a permissible purpose. Proposed § 1022.4(d) does not address data brokers that sell contact information that was not collected for the purpose of preparing consumer reports.
Moreover, every time
any
information from a consumer report, such as income or employment history, is used as a factor in determining eligibility for an FCRA purpose, a personal identifier for the consumer must also be used. Otherwise, it would be impossible for users to be sure that the information used from the consumer report relates to the correct consumer.
Indeed, personal identifiers provided by consumer reporting agencies can be critical in assessing whether applicable requirements are met. For example, employers may be required for certain positions to ensure that prospective employees do not appear on a sex offender registry and may use names and other personal identifiers from consumer reporting agencies to do so. Similarly, financial institutions and others may use names and other personal identifiers in determining whether an applicant for credit or other products or services is on the list of Specially Designated Nationals maintained by the Office of Foreign Assets Control (OFAC) or one of OFAC's other sanctions lists, to ensure that OFAC's regulations do not prohibit them from approving the transaction.
127
127
See generally
Off. of Foreign Assets Control, U.S. Dep't of Treas.,
FFIEC, BSA/AML Manual: Office of Foreign Assets Control—Overview, https://bsaaml.ffiec.gov/manual/OfficeOfForeignAssetsControl/01
(last visited Oct. 15, 2024);
Cortez
v.
Trans Union, LLC,
617 F.3d 688, 707-08 (3rd Cir. 2010) (“Trans Union invites us to conclude that information that goes to the very legality of a credit transaction is somehow not ‘a factor in establishing the consumer's eligibility . . . for credit.’. . . . It is difficult to imagine an inquiry more central to a consumer's ‘eligibility’ for credit than whether federal law prohibits extending credit to that consumer in the first instance. The applicability of the FCRA is not negated merely because the creditor/dealership could have used the OFAC Screen to comply with the USA PATRIOT Act, as well as deciding whether it was legal to extend credit to the consumer.”); Off. of Foreign Assets Control, U.S. Dep't of Treas.,
Frequently Asked Question #46
(Sept. 10, 2002),
https://ofac.treasury.gov/faqs/46
(last visited Oct. 15, 2024) (discussing what to provide as a denial reason on an adverse action notice if a loan meets an institution's underwriting standards but is a true “hit” on the Specially Designated Nationals list).
Personal identifiers provided by consumer reporting agencies can also serve as a factor in eligibility determinations in other ways. For example, age may be specifically considered in determining whether a consumer meets requirements for credit and insurance products and services. Minors, for example, may be ineligible to even enter into contracts under State law, and some products such as reverse mortgages are only offered to seniors.
128
Age also can determine whether an applicant is eligible for a particular employment position or for benefits such as Social Security retirement benefits and Supplemental Security Income.
129
Similarly, whether a consumer has an SSN can affect eligibility for employment, Social Security benefits, and certain other government benefits.
130
128
Fed. Trade Comm'n,
Reverse Mortgages
(Aug. 2022),
https://consumer.ftc.gov/articles/reverse-mortgages
(noting that you cannot legally commit to a regular mortgage until you are 18, unless you have a co-signer, and that you must be 62 or older to get a reverse mortgage);
cf. In re Trans Union Corp.,
FTC Docket No. 9255, at 31 (Feb. 10, 2000),
https://www.ftc.gov/sites/default/files/documents/cases/2000/03/transunionopinionofthecommission.pdf
(explaining various ways in which age had been used in credit granting decisions).
129
See, e.g.,
Soc. Sec. Admin.,
Retirement Benefits,
at 2-4 (2024),
https://www.ssa.gov/pubs/EN-05-10035.pdf
(explaining age restrictions for Social Security retirement benefits); Soc. Sec. Admin.,
Supplemental Security Income (SSI) Eligibility Requirements
(2024), Understanding SSI—SSI Eligibility (ssa.gov).
130
Soc. Sec. Admin.,
Social Security Numbers for Noncitizens
(Apr. 2023),
https://www.ssa.gov/pubs/EN-05-10096.pdf
(“You need an SSN to work, collect Social Security benefits, and receive other government services.”).
Address information provided by consumer reporting agencies can also play a role in eligibility determinations. For example, many financial service providers and insurance companies are only licensed to operate in particular States and therefore can only offer their products or services to consumers residing in those jurisdictions. Federally regulated lenders are also prohibited from making a mortgage loan to a consumer if a property is not covered by flood insurance and is located in a Special Flood Hazard area where flood insurance is available.
131
Employment positions may be limited to residents of certain localities.
131
42 U.S.C. 4012a(b).
In light of all of these considerations, the CFPB preliminarily concludes that communications by consumer reporting agencies of personal identifiers for a consumer that are collected by a consumer reporting agency for the purpose of preparing consumer reports about the consumer are consumer reports. FCRA section 608 further supports this interpretation by specifically permitting consumer reporting agencies to share “identifying information respecting any consumer, limited to his name, address, former addresses, places of employment, or former places of employment” with a governmental agency notwithstanding the permissible purpose requirements for consumer reports.
132
If identifying information were entirely excluded from the definition of consumer report as industry has suggested, there would have been no need for Congress to craft FCRA section 608 to expressly allow sharing of certain identifying information with government agencies.
132
15 U.S.C. 1681f.
Proposed § 1022.4(d) Would Promote the FCRA's Goals and Prevent Misuse of Personal Identifiers
Proposed § 1022.4(d) would promote the FCRA's goals of ensuring accuracy and fairness in consumer reporting by ensuring that personal identifiers collected by consumer reporting agencies for the purpose of preparing consumer reports are subject to all of the FCRA's protections that apply to consumer reports. A primary purpose of the FCRA is “to protect consumers from the transmission of inaccurate information about them, and to establish credit reporting practices that utilize accurate, relevant, and current information in a confidential and responsible manner.”
133
The CFPB has long recognized how important personal identifiers are in ensuring the accuracy of consumer reports.
134
Specifying that such information is a consumer report when it is communicated on its own by a consumer reporting agency would ensure that consumers receive notice when adverse actions are taken based on the information, thereby alerting
consumers to inaccuracies in their personal identifiers as well as increasing visibility for consumers into users' decision-making. It would also help confirm that consumers have a right to dispute incorrect personal identifiers maintained by consumer reporting agencies and have their information corrected.
135
For example, there may be consumers who are being denied credit, insurance, employment, or benefits due to an address or SSN discrepancy resulting from erroneous information and who would benefit from an adverse action notice so they can identify and clear up the error.
133
Guimond
v.
Trans Union Credit Info. Co.,
45 F.3d 1329, 1333 (9th Cir. 1995) (citations omitted).
134
For example, the CFPB highlighted in an advisory opinion regarding name-only matching the importance of consumer reporting agencies' matching procedures in ensuring accuracy. 86 FR 62468 (Nov. 10, 2021). However, even the best matching procedures cannot prevent mistakes if the identifying information maintained by consumer reporting agencies is itself wrong.
135
In the absence of a bright-line rule regarding personal identifiers, at least one consumer reporting agency has taken the position that consumer reporting agencies have no obligation to investigate consumer disputes about inaccurate identifying information that they use in generating consumer reports, notwithstanding the fact that the FCRA clearly requires them to do so.
See
Brief of
Amici Curiae,
Consumer Fin. Prot. Bureau and Fed. Trade Comm'n in Supp. of Plaintiff-Appellant,
Nelson
v.
Experian Info. Sols., Inc.,
No. 4:21-cv-00894-CLM (11th Cir. filed Mar. 29, 2024),
https://files.consumerfinance.gov/f/documents/cfpb_amicus-brief-nelson-v-experian_2024-03.pdf.
Providing that the term “consumer report” includes personal identifiers collected by consumer reporting agencies to prepare consumer reports would also protect consumers' privacy by limiting access to such information to entities that have one of the purposes recognized by Congress in the FCRA. As discussed elsewhere in this document, recent studies by Duke University have found that data brokers are openly and explicitly advertising for sale sensitive demographic and other information about U.S. individuals, including active-duty members of the military, their families, and veterans, which can be used to identify and compromise or blackmail them in order to obtain sensitive military information, threatening national security.
136
Personal identifiers may include sensitive information, including SSNs and driver's license numbers, as well as addresses and telephone numbers for people who do not wish to be located, such as domestic violence survivors seeking to stay safe from their abusers. Consumer groups have noted that, because consumer reporting agencies sell “credit header” information, this information has become readily available for purchase online. They have expressed concern that this online marketplace for “credit header” information is used for doxing, identity theft, harassment, and physical violence.
137
Investigative reporting by 404 Media indicates that criminals have obtained access to “credit header” information and are selling unfettered access to such data to other criminals.
138
136
Duke Report on Data Brokers and Military Personnel Data,
supra
note 2; Duke Report on Data Brokers and Sensitive Data,
supra
note 29.
137
See, e.g.,
Comment from stakeholders Just Futures Law, Consumer Action, and six other nonprofits,
Re: CFPB's Small Business Advisory Review Panel for Consumer Reporting Rulemaking—Outline of Proposals and Alternatives Under Consideration,
at 2 (Nov. 6, 2023).
138
Joseph Cox,
The Secret Weapon Hackers Can Use to Dox Nearly Anyone in America for $15,
404 Media (Aug. 22, 2023),
https://www.404media.co/the-secret-weapon-hackers-can-use-to-dox-nearly-anyone-in-america-for-15-tlo-usinfosearch-transunion/?curator=TechREDEF
(“This is the result of a secret weapon criminals are selling access to online that appears to tap into an especially powerful set of data: the target's credit header. . . . Through a complex web of agreements and purchases, that data trickles down from the credit bureaus to other companies who offer it to debt collectors, insurance companies, and law enforcement. A 404 Media investigation has found that criminals have managed to tap into that data supply chain, in some cases by stealing former law enforcement officer's identities, and are selling unfettered access to their criminal cohorts online.”);
see also
Joseph Cox & Emanuel Maiberg,
Fiverr Freelancers Offer to Dox Anyone With Powerful U.S. Data Tool,
404 Media (July 2, 2024),
https://www.404media.co/fiverr-freelancers-offer-to-dox-anyone-with-powerful-u-s-data-tool-tloxp/
(“Dozens of sellers on the freelancing platforming Fiverr claim to have access to a powerful data tool used by private investigators, law enforcement, and insurance firms which contains personal data on much of the U.S. population. The sellers are then advertising the ability to dig through that data for prospective buyers, including uncovering peoples' Social Security numbers for as little as $30, according to listings viewed by 404 Media. . . . The advertised tool is TLOxp, maintained by the credit bureau TransUnion, and can also provide a target's unlisted phone numbers, utilities, physical addresses, and more.”).
Except for certain information that may be released to government agencies under specific FCRA provisions, the proposal would curtail consumer reporting agencies' ability to furnish without a permissible purpose personal identifiers that had been collected for the purpose of preparing consumer reports. The proposal would thus reduce the ability of consumer reporting agencies to disclose sensitive contact information that ultimately could be accessed and used by stalkers, doxxers, domestic abusers, and other lawbreakers, as discussed above. While the storage of Americans' sensitive data may be necessary to facilitate lending, employment background checks, and other beneficial uses prescribed under the FCRA, it cannot be used to facilitate crimes.
Impacts on Other Current Uses of Personal Identifiers
The Small Business Review Panel recommended that the CFPB consider the impacts on current uses of “credit header” information (including,
e.g.,
for identity verification, fraud prevention and detection, employment background checks, other investigations, and digital advertising) and ways to mitigate any negative effects if communications of “credit header” information are consumer reports.
139
Small entity representatives and others have noted that “credit header” information has numerous beneficial uses. For example, it is often used currently to comply with legal obligations related to identity verification. These obligations include customer identification programs and anti-money laundering compliance obligations pursuant to the USA PATRIOT Act and the Bank Secrecy Act, which are designed to prevent and detect money laundering and the financing of terrorism.
140
According to industry trade associations, “credit header” information is also used for other purposes, such as identifying and locating people in a range of contexts, including missing children, victims of natural disasters, and responsible parties and witnesses in insurance claims investigations and civil and criminal matters.
141
Other uses cited include investigating human trafficking, ensuring that packages are sent to the correct address, preventing online purchase fraud, and ensuring age-restricted content and merchandise is not available to minors.
139
Small Business Review Panel Report,
supra
note 40, at 47-48 & section 9.3.3.
140
For example, section 326 of the USA PATRIOT Act requires the U.S. Department of Treasury's Financial Crimes Enforcement Network (FinCEN) to prescribe regulations that require financial institutions to establish programs for account opening that include: (1) verifying the identity of any person seeking to open an account, to the extent reasonable and practicable; (2) maintaining records of the information used to verify the person's identity, including name, address, and other identifying information; and (3) determining whether the person appears on any lists of known or suspected terrorists or terrorist organizations provided to the financial institution by any government agency. 31 U.S.C. 5318(l).
141
Other examples cited include identifying and locating owners of lost or stolen property, heirs, pension beneficiaries, organ and tissue donors, suspects, terrorists, fugitives, tax evaders, and parents and ex-spouses with delinquent child or spousal support obligations.
Industry stakeholders have expressed concern that treating “credit header” information as consumer report information may increase costs, result in delays where time is of the essence, and cause consumer frustration, while undermining efforts to combat money laundering, terrorism, and other crimes. However, it appears that many of these predictions overstate the consequences of reading the FCRA's definition of consumer report to include communications of personal identifiers collected by consumer reporting
agencies to prepare consumer reports. If the proposal is finalized, identifying information would still be available in various ways. Many current uses of such information, such as confirming an applicant meets the minimum age requirement for a job or a loan, fall within specific permissible purposes. If an entity has a permissible purpose under FCRA section 604(a)(3) to obtain a consumer report, the entity can also use the consumer report for identity verification and fraud prevention activities conducted in connection with that permissible purpose. For example, a creditor has a permissible purpose to use consumer report information for identity verification and fraud prevention if such activities are conducted in connection with a credit transaction that involves an extension of credit to the consumer or review or collection of a credit account of the consumer.
142
A court order or a subpoena can also provide an FCRA permissible purpose.
143
Additionally, a consumer's written instructions can provide a permissible purpose, such as for any identity verification or fraud prevention activities that are not conducted in connection with another permissible purpose.
144
142
FCRA section 604(a)(3)(A), 15 U.S.C. 1681b(a)(3)(A).
143
FCRA section 604(a)(1), 15 U.S.C. 1681b(a)(1).
144
See infra
discussion of proposed § 1022.11.
Furthermore, proposed § 1022.4(d) would not affect access to identifying information from any sources that are not subject to the FCRA. Proposed § 1022.4(d) would not, for example, affect the status or availability of an ordinary telephone directory or of any other repository of identifying information that is not collected for the purpose of preparing consumer reports. Other data sources could include, for example, public records directly from a government entity, such as property records, voter registrations, and professional license filings.
145
145
See discussion of government-run databases in the discussion of proposed § 1022.5 below.
Proposed § 1022.4(d) also would not affect the status or availability of identifying information obtained from financial institutions for purposes other than to prepare consumer reports.
146
The GLBA and Regulation P generally require financial institutions to provide consumers with notice and a right to opt out of the sharing of their nonpublic personal information with non-affiliated third parties, but an exception to these requirements provides that financial institutions can share such information “to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.”
147
146
To the extent any repository included identifying information obtained from financial institutions, it would need to comply with the restrictions and requirements of the GLBA and its implementing regulations, including the limitations on reuse and redisclosure.
See, e.g.,
15 U.S.C. 6802(c); 12 CFR 1016.11.
147
15 U.S.C. 6802(e)(3)(B); 12 CFR 1016.15(a)(2)(ii). A financial institution may provide identifying information to a non-affiliated third party for purposes of identity verification and fraud prevention pursuant to this exception, and Regulation P's reuse and redisclosure provisions would allow the recipient of such information to redisclose the information to other non-affiliated third parties for the same purposes. 15 U.S.C. 6802(c); 12 CFR 1016.11(a)(1)(iii), (c)(3) (providing that information received pursuant to an exception, such as the fraud exception, may generally only be used or disclosed in the ordinary course of business to carry out the activity covered by the exception under which the recipient received the information). As long as the information was not received under Regulation P's exception to the notice and opt out requirements to allow disclosure of nonpublic personal information for consumer reporting purposes (
see
12 CFR 1016.15(a)(5)(i), allowing financial institutions to provide consumers' nonpublic information to consumer reporting agencies in accordance with the FCRA), or otherwise collected, expected to be used, or used for the purpose of serving as a factor in establishing the consumer's eligibility for an FCRA permissible purpose, the communication of such data would not be a consumer report under proposed § 1022.4(d).
Some stakeholders have raised questions about the impact that this proposed intervention might have on government agencies' access to identifying information originating from consumer reporting agencies for law enforcement and other purposes. Government agencies, including local, Tribal, State, and Federal law enforcement, access personal identifiers for numerous beneficial uses. These include for facilitating access to and administering government benefits, identifying and ruling out suspects for criminal investigations, identifying witnesses, and other uses that may serve the public interest.
Law enforcement and other government agencies currently obtain data from a broad range of sources and proposed § 1022.4(d) would not affect many of these sources, such as government-run databases addressed below in the discussion of proposed § 1022.5. To the extent that government agencies currently use information that would be affected by proposed § 1022.4(d), they would continue to be able to access such information in a variety of ways if the proposed rule were finalized. For example, FCRA section 608 provides that a consumer reporting agency may furnish to a governmental agency the name, address, former addresses, places of employment, or former places of employment of any consumer even if no permissible purpose exists. FCRA sections 626 and 627 also provide that, under specified circumstances, consumer reporting agencies must provide certain consumer reporting information to the FBI and a consumer report and all other information in a consumer's file to certain government agencies for counterintelligence or counterterrorism purposes.
148
If government agencies required additional information beyond what is available pursuant to FCRA sections 608, 626, and 627, access could be obtained through a court order, a subpoena, a consumer's written instructions, or any other permissible purpose.
148
15 U.S.C. 1681u, 1681v.
While personal identifiers would remain available to law enforcement and other government agencies through these various channels, the CFPB recognizes the value of government agencies' access to personal identifiers in efficient, consolidated, and timely ways. The CFPB therefore requests comment on proposed § 1022.4(d) and how best to maintain government agencies' access to personal identifiers in order to ensure that the beneficial uses described above can continue as usual. In particular, the CFPB requests comment on a potential exemption from § 1022.4(d) for communications consisting exclusively of personal identifiers that are solely furnished to, or solely used to furnish to, local, Tribal, State, and Federal governments.
The CFPB is also continuing to consider the potential impacts of proposed § 1022.4(d) on the other areas identified by the Small Business Review Panel. The CFPB requests comment on those impacts and on ways to mitigate any potentially negative impacts.
Preventing Evasions of the FCRA
In addition to proposing § 1022.4(d) pursuant to the CFPB's authority to “prescribe regulations as may be necessary or appropriate to administer and carry out the purposes and objectives” of the FCRA, the CFPB also proposes § 1022.4(d) pursuant to its rulemaking authority under FCRA section 621(e) to prevent evasions of, and to facilitate compliance with, the FCRA. Proposed § 1022.4(d) would facilitate compliance with the FCRA by establishing a clear, bright-line rule on how the FCRA applies to personal identifiers. It also would help to prevent evasions of the FCRA where consumer reporting agencies willfully or otherwise ignore how the personal identifiers they sell are used or expected to be used or
wrongly assume such information cannot bear on the specified factors.
The absence of a bright-line rule regarding personal identifiers could raise more compliance concerns and make the rule more susceptible to evasions than proposed § 1022.4(d)'s categorical approach. As noted above, the FTC's staff guidance in the 40 Years Staff Report indicated that identifying information can be consumer report information if it bears on any of the seven factors identified in the FCRA and is used to determine eligibility.
149
Rather than engaging in the communication-by-communication analysis required under the FTC's approach, many consumer reporting agencies and trade associations have instead taken the position that communication of personal identifiers is never a consumer report. Indeed, although the FTC recognized decades ago that communications of age information drawn from consumer reporting databases fall within the definition of a consumer report,
150
consumer reporting agencies have continued to include age information, such as full or partial dates of birth, in the “credit header” information they sell to entities that have no permissible purpose under the FCRA, incorrectly claiming that such information is not covered by the FCRA.
151
As technology advances, uses of identifying information in eligibility determinations are likely to expand and develop in ways that may not be visible to regulators and consumers, amplifying the concern that consumer reporting agencies may violate the FCRA in the absence of a bright-line rule regarding personal identifiers. The CFPB preliminarily determines that proposed § 1022.4(d)'s categorical approach with respect to personal identifiers is necessary to facilitate compliance with the FCRA and to prevent evasion of the FCRA by consumer reporting agencies that sell personal identifiers without adequately considering whether the information they are selling constitutes a consumer report.
149
FTC 40 Years Staff Report,
supra
note 21, at 21.
150
In re Trans Union Corp.,
FTC Docket No. 9255, at 31 (Feb. 10, 2000),
https://www.ftc.gov/sites/default/files/documents/cases/2000/03/transunionopinionofthecommission.pdf
(concluding based on the evidence presented that “age information falls within the definition of a consumer report”);
see also
65 FR 33645, 33668 n.35 (May 24, 2000) (noting that the FTC's 2000 decision determined that age is consumer report information).
151
See, e.g.,
Matt Wiley,
What Is Header Data?,
Equifax (Feb. 22, 2021),
https://www.equifax.com/business/blog/-/insight/article/what-is-header-data/); CLEAR Enhancements Overview,
Thomson Reuters,
https://legal.thomsonreuters.com/content/dam/ewp-m/documents/legal/en/pdf/fact-sheets/clear-enhancements-2021.pdf
(announcing inclusion of full Equifax “credit header” information regarding date of birth in CLEAR database) (last visited Oct. 15, 2024); Letter from Ron Wyden, Sen., U.S. Senate, to Rohit Chopra, Director, CFPB (Dec. 8, 2021),
https://www.wyden.senate.gov/imo/media/doc/CFPB%20Letter%20120821.pdf
(describing sale of “credit header” information from the National Consumer Telecom and Utilities Exchange including date of birth).
The CFPB requests comment on whether, in lieu of adopting the approach of proposed § 1022.4(d), a final rule should provide that a communication by a consumer reporting agency of personal identifiers can be a consumer report if the information meets the two-prong test in proposed § 1022.4(a)'s definition of consumer report. If the CFPB adopted this alternative approach in a final rule, the final rule could provide illustrative examples of communications by consumer reporting agencies of personal identifiers that are consumer reports, such as communications of age or address information. The CFPB requests comment on examples that might be helpful to include if it were to adopt this alternative approach in a final rule.
4(e) De-Identification of Information
Proposed § 1022.4(e) addresses when a consumer reporting agency's communication of de-identified information should be considered a consumer report. Industry participants often assume that information drawn from a consumer reporting database is not a consumer report if the information has been aggregated or otherwise stripped of identifying information. However, information that has been aggregated or otherwise purportedly de-identified can often be used to re-identify individuals and to target individuals to receive or not receive marketing or used in other ways that may violate consumer privacy. The CFPB is considering a range of options to address the risk of re-identification of consumer report information that has been de-identified.
152
The CFPB therefore proposes three alternative versions of § 1022.4(e). The proposed alternatives are all designed to further the FCRA's goal of ensuring the privacy of consumer information, including by preventing targeted marketing using purportedly de-identified consumer reporting information that could be re-identified. Each alternative would have varying effects on the use of de-identified information as discussed below.
152
In the Small Business Review Panel Outline, the CFPB indicated that it was considering proposals to clarify whether and when “aggregated or anonymized” consumer report information constitutes or does not constitute a consumer report. Small Business Review Panel Outline,
supra
note 39, at 11. The CFPB is using the terms “de-identified information” and “de-identification” in this proposal because it believes these terms capture information that has been stripped of identifiers, through aggregation or other means, and therefore can encompass information that has been aggregated or anonymized or both. The term “de-identified” is similar to the term “anonymized” that was used in the Outline but more aptly conveys that there is a possibility that data may be re-identified.
FCRA section 603(d)(1) defines consumer report, in part, as a “communication of . . . information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.”
153
FCRA section 603(c) defines a consumer as “an individual.”
154
Interpreting these terms, the FTC 40 Years Staff Report states that “information may constitute a consumer report even if it does not identify the consumer by name if it could `otherwise reasonably be linked to the consumer.' ”
155
Extrapolating from that statement, many stakeholders today believe that a communication of information by a consumer reporting agency is not a consumer report if the information is not linked or reasonably linkable to a specific individual. Many stakeholders also often seem to assume that information is not reasonably linkable when in fact it is.
153
15 U.S.C. 1681a(d)(1).
154
15 U.S.C. 1681a(c).
155
FTC 40 Years Staff Report,
supra
note 21, at 21.
In light of advances in technology and current industry practices, the CFPB is concerned that the reasonably linkable standard articulated in the FTC 40 Years Staff Report alone may not be sufficiently protective of consumer reporting information that, while nominally de-identified, may in fact be re-identifiable. The CFPB is aware that, in many cases, consumers may be re-identified with relative ease from purportedly de-identified datasets.
156
Indeed, there have been numerous reports over the years of supposedly de-identified data being re-identified and revealing potentially sensitive personal information such as
web browsing
activity,
157
medical information,
158
and sexual orientation.
159
For example, in one well-publicized case, researchers were able to identify individuals from anonymized Netflix data with the help of publicly available information.
160
More recently, scientists reported developing an algorithm capable of identifying “99.98 percent of Americans from almost any available data set with as few as 15 attributes, such as gender, ZIP code or marital status.”
161
Presumably, the potential to re-identify data that has been de-identified will only increase as artificial intelligence and data analytics technologies continue to improve.
162
In the FCRA context, concerns about potential re-identification of data that have been de-identified are particularly pronounced due to the sensitivity of consumer report information and the privacy goals that prompted Congress to enact the statute.
This text is long and has been trimmed here. Open the source document for the complete record.
This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.