Click here for pdf
Using, Marketing or Collecting Consumer Data?
Better Think Fair Credit Reporting Act
The Federal Trade Commission (FTC) recently sent letters to six providers of tenant rental history reports warning that the reports they sell may be "consumer reports," thereby making the company a "consumer reporting agency" under the Fair Credit Reporting Act (FCRA). These notifications are the latest reminder of the FTC’s commitment to aggressive enforcement of the requirements of the FCRA (see also Spokeo Consent Order granting a $800,000 civil penalty). The FCRA has broad definitions that apply to "consumer reporting agencies" and users, marketers and collectors of "consumer reports" that may not intuitively suggest application to many businesses.
Is Your Company a User or Marketer of Consumer Reports?
The FTC’s action is a reminder that "consumer reports" and "consumer reporting agencies" under FCRA are not just terms applicable to traditional credit reporting agencies. Users of “consumer reports” have notice restrictions against taking adverse actions without giving the consumer notice under the FCRA §615. Thus, companies receiving analytical reports about consumers should consider whether such reports should be considered “consumer reports” received from a “consumer reporting agency.”
In a case involving a mobile app sold on iTunes, the FTC brought an enforcement action against a company that compiled and sold a $1 app on iTunes that allowed users to access criminal history reports for individuals in various states without taking consumer protection measures required by the FCRA. According to the FTC complaint, Filiquarian Publishing LLC, Choice Level LLC, and their CEO Joshua Linsk failed to ensure that the information they sold was accurate and would be used only for legally permissible purposes. Choice Level provided the criminal records to Filiquarian that were accessed via Filiquarian’s mobile apps.
The FTC also alleged that they failed to tell users of their criminal record reports about their obligations under the FCRA, including the requirement to notify consumers if an adverse action was taken against them based on the information in a report. According to the FTC complaint, the disclaimers by the defendants that they were not a “consumer reporting agency” are not enough to avoid liability under the FCRA because the company advertised and expected that its reports could be used for employment purposes. The FTC settled with the defendants with an agreed order. Under the theories set forth in the FTC complaint, upstream information sources of consumer information may also be liable for violating the FCRA.
Some Requirements of Users of Consumer Reports under the FCRA
If your business activities meet the definitions above to be a user of “consumer reports,” here is a non-exhaustive selection of FCRA §615 requirements with which you must comply:
- You must notify the consumer and disclose certain information when you take adverse action with respect to a consumer based in whole or in part on the information contained in a “consumer report”;
- When you obtain information from a party other than a “consumer reporting agency” and deny credit or increase the charge for credit, you must notify the consumer of his right to make a written request at the time the adverse action is communicated to the consumer;
- If you use a “consumer report” on any consumer in connection with any credit or insurance transaction that is not initiated by the consumer, you must provide with each written solicitation made to the consumer regarding the transaction a clear and conspicuous statement of certain information.
Is Your Company a Consumer Reporting Agency?
Paraphrasing the FCRA definitions, a “consumer reporting agency” is someone who receives compensation for regularly engaging in assembling or evaluating consumer credit information or other information on consumers and furnishing consumer reports to third parties, The term “consumer report” generally means any communication of any information bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is expected to be used as a factor in establishing the consumer’s eligibility for, among other things, credit, insurance, employment, or any type of transaction that is initiated by a consumer.
So, in the case of the rental history providers, if they receive compensation for collecting the histories and providing them to landlords in the expectation that the information will be used for determining the subject consumer’s eligibility for a rental agreement, they are a consumer reporting agency providing a consumer report to the potential landlords.
The FTC obtained an order requiring payment of $2.6 million by an employment background screening company to settle charges that it violated the FCRA by failing to use reasonable procedures to assure the maximum possible accuracy of information it provided, failing to give consumers copies of their reports, and failing to reinvestigate consumer disputes, as required by law. See U.S. v. Hireright Solutions, Inc.
Some Requirements of Consumer Reporting Agencies under the FCRA
If your business activities meet the definitions above to be a “consumer reporting agency,” here is a non-exhaustive selection of FCRA § 605 requirements with which you must comply:
- You must take reasonable steps to ensure that the party to whom you are selling the consumer report has a permissible purpose to obtain the report under FCRA § 604 and for no other purpose; for example, credit transactions and the underwriting of insurance;
- You must take reasonable steps to ensure that the information you provide is accurate;
- You must provide consumers with copies of the report upon request and allow them to dispute information they believe to be inaccurate.
The Consumer Financial Protection Bureau, the FTC and the FCRA
The Consumer Financial Protection Bureau (CFPB) and the FTC share FCRA enforcement authority. By rule the CFPB supervises “larger participant” consumer reporting agencies. Generally, a consumer reporting agency is a larger participant if it generates $7 million or more in annual receipts from consumer reporting agency activity. Supervision by the CFPB means being subject to examination and being required to file certain reports.
While the CFPB has supervisory authority over larger participants in the consumer reporting space, it is clear the FTC is continuing to step up its own enforcement of FCRA requirements as discussed in this article. It is also important to note that while one must be a larger participant to fall under the CFPB’s supervisory authority, there is no such threshold limiting the CFPB’s enforcement authority.
Why is that distinction important? Under the Dodd-Frank Act the CFPB has authority to impose penalties up to $1 million dollars per day for violations of consumer protection statutes. So, even if your business is not a larger participant in the consumer reporting space and therefore not subject to supervision by the CFPB, you should still be mindful of its enforcement authority when it comes to violations of the FCRA.
In our data driven economy, as companies search for ways to maximize the value of corporate assets, the FCRA can be a trap for the unwary. Whenever consumer information is central to a new initiative or the expansion of existing lines of business an evaluation of the applicability of the FCRA is in order.
Locke Lord Can Assist
The attorneys in Locke Lord’s Consumer Finance, Advertising and Marketing, and Data Security Groups regularly assist clients in complying with consumer protection laws and regulations enforced by the CFPB and the FTC as well as state consumer protection laws and regulations. We are available to help our clients with the issues raised in this article and with legal compliance with the Fair Credit Reporting Act .
For more information on the matters discussed in this Locke Lord QuickStudy, please contact the authors:
Brett Foster | 214-740-8414 | firstname.lastname@example.org
Paul C. Van Slyke | 713-226-1406 | email@example.com
Patrick J. Hatfield | 512-305-4787 | firstname.lastname@example.org
Bart W. Huffman | 512-305-4746 | email@example.com