December 20, 2024
The Consumer Financial Protection Bureau (CFPB) has recently issued a proposed rule that aims to amend the Fair Credit Reporting Act’s (FCRA) implementation. As such, the CFPB has requested public comment on its proposal.
According to the proposal, the CFPB intends to place data brokers under the FCRA’s regulations. Successfully implementing this change would limit these companies’ ability to sell consumers’ personal and financial information. This potential regulation places data brokers under the same regulatory limits as credit bureaus and background check providers.
As a result, data brokers would experience similar limitations in acquiring and using consumer information. The CFPB deemed this regulation crucial to limiting the potential misuse of consumer information. For example, it could reduce criminal exploitations like identity theft, financial scams, and other illegal activities.
To address these concerns, the proposed rule would:
- Regulate data brokers under the FCRA: Classify any company that sells information about consumers’ income, credit history, credit score, or debt payments as a consumer reporting agency (CRA) regulated by the FCRA. This classification remains true regardless of the purpose of the information’s use or expected use.
- Expands the Definition of “Assembles” and “Evaluates”: Entities that assemble or evaluate consumer information would fall under the CRA classification if they collect, gather, retain, appraise, assess, contribute, or alter the content of information about consumers. This definition update could have far-reaching consequences for any organization that stores consumer data, such as payment information.
- Limit Permissible Purposes: The FCRA’s permissible purpose regulation does not permit users of consumer information “to solicit the consumer for a transaction the consumer did not initiate or to otherwise market products or services to the consumer.” Otherwise, the rule would not prevent CRAs from furnishing consumer reports for other legitimate business needs.
- Requires Clear Consent From Consumers: Regulated companies, such as data brokers, must acquire clear and explicit consent from consumers to obtain or share their credit reports. This step would require separate and explicit authorization instead of including the permission in a document with other information.
This proposed rule would mark one of the most significant FCRA expansions if implemented. However, with a likely upcoming change in administration, the CFPB’s priorities may change before the proposed rule takes effect. As such, the chances of the proposed rule taking effect appear bleak. Regardless of its success, those using consumer information must maintain compliance with the FCRA and other federal, state, and local laws affecting consumer reports.
Disclaimer:
Information provided here is for educational and informational purposes only and should not constitute as legal advice. We recommend you contact your own legal counsel for any questions regarding your specific practices and compliance with applicable laws.