January 13, 2023
CFPB Bites of the Month - 2022 Annual Review - Credit Reporting
In this article, we share a timeline of our monthly "bites" for 2022 applicable to the credit reporting industry. Credit reporting remains a high priority for the CFPB, as credit reporting impacts consumers in a number of decisions in their daily lives. We expect the CFPB's interest to continue into 2023, with the CFPB indicating that they expect to launch rulemaking under the Fair Credit Reporting Act in 2023 (although they have yet to tell anyone what they expect to cover in that rulemaking). But the activities of 2022 may provide some strong clues.
So, what happened in 2022?
1. The CFPB released a report addressing consumer complaint responses at the big three credit bureaus
On January 5, 2022, the CFPB released a report that addressed changes in complaint responses provided by nationwide consumer reporting companies, particularly as they related to complaints filed by third parties on behalf of consumers (including credit repair operators).According to the CFPB, the changes allegedly resulted in fewer meaningful responses and less consumer relief. CFPB data indicates that in 2021, the three credit bureaus reported relief in response to less than 2% of covered complaints, down from nearly 25% of covered complaints in 2019. The CFPB alleged the three companies often failed to provide substantive responses, especially when the complaints were sent by third parties. According to the CFPB, the credit bureaus relied heavily on templates for complaint responses instead of providing thorough responses to consumers. The CFPB also indicated that two of the credit bureaus stopped providing substantive responses to consumers' complaints sent by third parties.
2. The CFPB issued a bulletin to prevent unlawful medical debt collection and credit reporting
On January 13, 2022, in the first of many regulatory initiatives aimed at medical debt, the CFPB released a bulletin reminding debt collectors and credit bureaus of their legal obligations under the No Surprises Act, which protects consumers from certain unexpected medical bills. According to the bulletin, companies may face significant legal liability for attempting to collect on medical bills that are prohibited by the No Surprises Act, the Fair Debt Collection Practices Act (FDCPA), and the Fair Credit Reporting Act (FCRA). The CFPB will be investigating claims and taking action against companies that violate these laws.
3. CFPB publishes annual list of CRAs
On January 27, 2022, the CFPB released its annual list of consumer reporting companies identified by the CFPB. The list identifies dozens of specialty reporting companies that create consumer reports, including employment, tenant, insurance, and medical markets.. Using the list, consumers can see what information CRAs have, dispute inaccuracies, and exercise various rights related to the FCRA. The CFPB's press release that accompanied the list claimed that while the three nationwide consumer reporting companies allow consumers to check their reports, many of the specialty companies charge a fee to access data. The list published by the CFPB, however, did not include any CRAs that charge a fee for disclosures.
4. The CFPB weighs in on an FTC Settlement concerning business credit reports
On February 18, 2022, the CFPB weighed in on a proposed FTC settlement concerning business credit reports, which are not governed by the Fair Credit Reporting Act. The FTC alleged that the company, which provides reports of business information to creditors, deceived small businesses about their role helping the businesses improve their credit reports. Under the settlement, the company agreed to provide prompt responses to complaints about inaccurate information, to restrict automatic subscription renewals, and to offer refunds to affected small businesses.
The FTC asked for comment on its proposed agreement, and the CFPB submitted a comment letter. The CFPB indicated that it is gathering data about whether and how small businesses are able to access credit. The CFPB indicated that it will work with the FTC to ensure that small businesses are treated fairly when it comes to accessing loans. The FTC finalized its settlement of the matter in April 2022.
5. The CFPB addresses medical bills on credit reports
On March 1, 2022, the CFPB announced that it had released a report claiming that the U.S. healthcare system is supported by a billing, payments, collections, and credit reporting infrastructure where mistakes are common, and where patients often have difficulty getting these errors corrected or resolved. The report indicates that medical bills are often incurred through unexpected and emergency events, are subject to opaque pricing, and involve complicated insurance or charity care coverage and pricing rules. According to the CFPB, medical bills placed on credit reports can result in reduced access to credit, increased risk of bankruptcy, avoidance of medical care, and difficulty securing employment, even when the bill itself is inaccurate. The report indicates that these repercussions are especially acute for people from Black and Hispanic communities, as well as people with low incomes, veterans, older adults, and young adults of all races and ethnicities.
The CFPB said it plans to take action so that the consumer credit reporting system is not used coercively against patients and their families to force them to pay questionable medical bills. Specifically, the CFPB intends to hold credit reporting companies accountable, work with federal partners to reduce coercive credit reporting; and determine whether unpaid medical billing data should be included in credit reports.
6. The CFPB proposed and finalized a rule to halt negative credit reporting for survivors of human trafficking
On April 7, 2022, the CFPB announced a proposed rule to halt negative credit reporting for survivors of human trafficking. The proposed rule would protect survivors of human trafficking by preventing CRAs from including negative information resulting from abuse. Congress required the CFPB to use its rulemaking authorities to implement the Debt Bondage Repair Act through rule changes to Regulation V, which ensures that consumers' credit information is fairly reported by CRAs. Signed by President Biden in December 2021, the Debt Bondage Repair Act prohibits CRAs from providing consumer reports that contain negative information about a trafficking survivor from any period the survivor was being trafficked. The CFPB proposal included guidelines to help survivors understand how to report their status, require CRAs to block adverse information, and make rules applicable to CRAs. The Rule was finalized June 24, 2022, and became effective July 25, 2022.
7. The CFPB alleged that a nationwide consumer reporting agency and a senior executive violated a 2017 consent order
On April 12, 2022, the CFPB filed a lawsuit against a nationwide consumer reporting agency, two related companies, and one of its senior executives for allegedly violating a 2017 consent order. The lawsuit alleges that the companies failed to implement required measures from the 2017 consent order and committed additional violations of certain federal laws. The CFPB claims the companies failed to implement specific remedial measures, deceptively marketed credit-related products, and used hidden tricks or trapdoors (which the CFPB called "digital dark patterns") to deceive customers. The complaint seeks monetary relief for consumers, injunctive relief, and civil money penalties. The complaint is not a final finding or ruling that defendants have violated the law, and the company asserts that the claims filed by the CFPB are "meritless."
8. The CFPB issued its Spring Supervisory Highlights
On May 2, 2022, the CFPB issued its Spring Supervisory Highlights. The CFPB's Spring Supervisory Highlights reported findings from examinations in various industries including credit reporting. With respect to credit reporting, the CFPB indicated that credit reporting companies failed to conduct reasonable investigations into disputed debts in a timely manner and failed to review and consider all the relevant evidence submitted by consumers.
9. The CFPB expressed concerns about credit reporting for Buy Now, Pay Later companies
On June 15, 2022, in a blog post, the CFPB expressed concerns about the ways in which consumer reporting agencies planned to address buy now, pay later (BNPL) companies. Until 2022, few BNPL lenders furnished information about consumers to the nationwide consumer reporting companies. But in announcements made in the middle of 2022, the three largest nationwide consumer reporting companies each described plans to accept BNPL payment data. However, the CFPB indicate that those plans vary, and that those variations could result in inconsistent treatment that will limit the potential benefits of furnished BNPL data. The CFPB said that when BNPL payments are furnished, it is important that lenders furnish both positive and negative data. The CFPB appears to believe that nationwide consumer reporting companies should adopt standardized BNPL furnishing codes and formats appropriate to the unique characteristics of the product. The CFPB indicated that it will monitor the progress in this area and invited consumers to submit complaints about both consumer reporting and BNPL products.
10. The CFPB nudged state regulators to police credit reporting markets
On June 28, 2022, the CFPB issued an Interpretive Rule indicating that with limited preemption exceptions, states may enact laws that are stricter than the FCRA. Recently, the Office of the New Jersey Attorney General notified the CFPB about pending litigation that included an allegation that the FCRA preempted a New Jersey consumer protection statute. According to the CFPB's view in the Interpretive Rule, states retain broad authority to protect people from harm due to credit reporting issues, and state laws are not preempted unless they conflict with the Fair Credit Reporting Act or fall within narrow preemption categories enumerated within the statute. Unlike legislative rules, interpretive rules only state the agency's interpretation of law or regulations, and the question of the preemptive effect of the FCRA is still before the court in the New Jersey case.
11. The CFPB issued an Advisory Opinion addressing privacy of personal data
On July 7, 2022, the CFPB issued an advisory opinion indicating that companies using and sharing credit reports and background reports must have a permissible purpose under the FCRA. The CFPB's Advisory Opinion indicates that credit reporting companies and users of credit reports have specific obligations to protect the data privacy. The advisory also reminds covered entities of potential criminal liability for certain misconduct.
The CFPB says that using insufficient matching procedures, such as name-only matching, can result in credit reporting companies providing reports to entities without a permissible purpose, which would violate consumers' privacy rights. Likewise, the CFPB indicated that companies violate the law in providing credit reports of multiple people as "possible matches." The CFPB further takes the position that disclaimers about insufficient matching procedures do not cure violations. The CFPB also said that users of consumer reports must ensure that they do not obtain a credit report when they lack a permissible purpose for doing so.
12. CFPB analyzed the impact of credit reporting changes for medical debt
On July 27, 2022, the Consumer Financial Protection Bureau (CFPB) published an analysis addressing changes made by the nationwide consumer reporting agencies that will affect people with unpaid medical debt. Specifically, starting in 2023, medical collection trade lines in amounts less than $500 will no longer be reported on consumer credit reports. However, according to the CFPB, almost half of all consumers with medical collections on their credit report will continue to see them after changes fully go into effect next year. The CFPB also indicated that consumers living in northern and eastern states are more likely to benefit from the changes.
13. CFPB issued a circular about data security practices
On August 11, 2022, the CFPB issued a circular reminding regulators that financial companies violate federal law when they fail to safeguard consumer data. The circular provides guidance to other regulators, describing examples of circumstances in which organizations can be held liable for data security protocols. According to the circular, liability can arise for failing to implement multi-factor authentication, inadequate password management, and failing to update software in a timely manner.
14. CFPB says furnishers have an obligation to investigate consumer disputes
On September 14, 2022, the CFPB and FTC once again addressed furnishers' duty to investigate credit disputes. The two agencies jointly filed an amicus brief in the U.S. Court of Appeals for the Third Circuit. According to the agencies, when a consumer submits a dispute to a credit reporting company and the dispute is passed along to the furnisher, the furnisher is required to investigate and report the results back to the credit reporting company. The brief indicates that a furnisher cannot avoid that obligation by claiming a dispute is "frivolous." The agencies also note that furnishers are required to inform consumers about additional information needed, rather than just ignoring potentially frivolous disputes.
15. CFPB Releases Report on Tenant Background Checks
On November 15, 2022, the CFPB released two reports on the tenant background check industry. The reports, which are based on an analysis of CFPB complaints and focus groups, describe how errors in these background checks can contribute to higher costs for tenants and barriers to quality rental housing. The CFPB analyzed more than 24,000 complaints and results from focus groups with 44 renters which they claim highlighted the renter challenges associated with failure to remove wrong, old, or misleading information and to provide adequate investigations of disputed information. According to the CFPB, these reports: have questionable content, increasingly involve algorithmic scoring, are difficult for consumers to fix, and are sold with erroneous data. Moreover, the CFPB asserted that renters don't receive adverse action notices as required by the Fair Credit Reporting Act.
16. CFPB Issues Advisory Opinion on "Junk Data" in Credit Reports
On October 20, 2022, the CFPB issued an Advisory Opinion addressing Fair Credit Reporting Act procedures to prevent facially false information in credit reports. The Advisory Opinion also discusses failures to implement reasonable internal controls and non-compliance with section 607(b) of the FCRA.
17. CFPB Kicks Off Personal Financial Data Rights Rulemaking
On October 27, 2022, the CFPB released an outline of options and proposals aimed to strengthen consumers' access to, and control over their financial data. The CFPB indicated that this is a first step before issuing a proposed rule on data rights that would implement section 1033 of the Dodd-Frank Act. Under the proposals, the CFPB would require firms to make a consumer's financial information available to them or to a third party at that consumer's direction.
18. CFPB Issues Guidance to Address Investigation Practices by Consumer Reporting Companies
On November 10, 2022, the CFPB issued a circular indicating that neither consumer reporting companies nor information furnishers can skirt dispute investigation requirements. The circular outlines how regulators and attorneys general can bring claims against companies that fail to investigate and resolve consumer report disputes. The CFPB claims that some consumer reporting companies and some furnishers have failed to conduct reasonable investigations of consumer disputes and failed to sufficiently address inaccuracies.
19. CFPB's Fall 2022 Supervisory Highlights again include a focus on credit reporting
On November 16, 2022, the CFPB announced that it had released its Fall 2022 Supervisory Highlights addressing examinations of numerous industries, which again included some observations related to credit reporting. With respect to credit reporting, the CFPB claims that some nationwide consumer reporting companies failed to report the outcome of their reviews of complaints to the CFPB - although the CFPB reported improvements in the response to complaints in early January 2023. Additionally, the CFPB indicated that some auto finance furnishers were knowingly reporting inaccurate information about consumers.