CFPB Issues Guidance on Fair Credit Reporting Act Disclosure and Reporting Requirements

On January 11, 2024, the Bureau of Consumer Financial Protection (CFPB) published two pieces of guidance related to disclosure and reporting requirements by consumer reporting agencies under the Fair Credit Reporting Act (FCRA). First, the CFPB issued an advisory opinion clarifying a consumer reporting agency’s disclosure requirements under Section 609(a) of FCRA. Second, the CFPB issued an advisory opinion highlighting obligations under Section 607(b) of FCRA that require consumer reporting agencies to “follow reasonable procedures to assure maximum possible accuracy,” in addition to clarifying the reporting period for adverse items under Section 605(a)(5) of FCRA.

These advisory opinions apply to all consumer reporting agencies, as defined under Section 603(f) of FRCA,¹ including check and bank account screening companies that collect and report data on check screening services and account applications, openings, and closures.

Advisory Opinion on File Disclosure Requirements

Under Section 609(a) of FCRA, all consumer reporting agencies must clearly and accurately disclose to a consumer, upon request, “[a]ll information in the consumer’s file at the time of request” and “[t]he sources of the information.” Moreover, FCRA defines a consumer’s file as “all of the information on that consumer that is recorded and retained by a consumer reporting agency, regardless of how the information is stored.”²

Interpreting file disclosure requirements under Section 609(a) of FCRA, the CFPB has issued an advisory opinion to (1) underscore that consumers need not use specific language to trigger a consumer reporting agency’s file-disclosure requirements; (2) highlight certain requirements regarding information to be disclosed upon consumer request; and (3) affirm the need to disclose both the original source and any intermediary or vendor source related to an item of information in a consumer’s file.

Requests Under FCRA Section 609(a): The CFPB has interpreted FCRA as requiring consumer reporting agencies, upon receipt of a consumer request that provides proper identification, to provide a file disclosure, even if the consumer does not use the specific term “request,” “file,” or “complete file.” According to the CFPB, FCRA merely requires a consumer to make a “request” and provide proper identification. Although FCRA does not itself define the term “request,” the CFPB has construed the meaning of the term broadly. As such, FCRA’s file-disclosure requirement would be triggered if a consumer used such language as “report,” “credit report,” “consumer report,” “file,” or “record” in a communication with a consumer reporting agency. Moreover, consumers need not use the words “complete file” to invoke their right to a file disclosure.

Information Required Under FCRA Section 609(a)(1): If a consumer reporting agency provides a mere summary of information included in a consumer’s file, the CFPB has interpreted FCRA as requiring the consumer reporting agency to provide the information forming the basis of such a summary. To ensure that a file disclosure accurately reflects a consumer’s information, a consumer reporting agency must provide, for example, criminal history information in the format users see or will see.

Sources of Information Under FCRA Section 609(a)(2): Suggesting that some consumer reporting agencies have failed to disclose all sources of an item of information in a consumer’s file, the CFPB has interpreted FCRA as affirmatively requiring both the original source as well as any intermediary or vendor source for any item contained within a consumer’s file. According to the CFPB, consumers need not specifically request that consumer reporting agencies identify all sources of information in their file to trigger the requirement.

Advisory Opinion on Background Screening Requirements

Under Section 607(b) of FCRA, consumer reporting agencies “shall follow reasonable procedures to assure maximum possible accuracy of the information” included within a consumer report for the purposes of background screening.

The CFPB’s advisory opinion interprets “reasonable procedures to assure maximum possible accuracy” as including procedures to (1) prevent duplicative information; (2) include existing disposition information related to arrests, criminal charges, eviction proceedings, or other court filings; and (3) ensure that information expunged, sealed, or otherwise legally restricted from public access is not included. Having previously issued guidance on these aspects of Section 607(b), the CFPB has already brought several actions to enforce its interpretation of the statute.

This Advisory opinion also addresses Section 605(a)(5) of FCRA, which prohibits the reporting of “[a]ny adverse item of information” that precedes a consumer report “by more than seven years.” Given that the reporting period of each adverse item of information on a consumer report is unique, consumer reporting agencies must maintain reasonable procedures to prevent duplicative or legally restricted reporting. Moreover, adverse events should not be reopened on a consumer report by the occurrence of subsequent events. The non-conviction disposition of a criminal charge, for example, cannot be reported beyond the seven-year period that begins at the time of such a criminal charge.

Takeaways

Over the course of the past eight years, the CFPB has found incorrect information on consumer reports to represent the greatest share of credit or consumer reporting complaints submitted to the agency. The advisory opinions published should, in turn, signal a heightened focus on consumer reporting agencies and their obligation to maintain accurate consumer credit report information. These advisory opinions also set expectations of and standards for consumer reporting agencies in future enforcement and supervisory proceedings, in addition to affecting the extent of civil liability faced by a consumer reporting agency for a violation of FCRA.

The guidance also affects the civil liability of consumer reporting agencies for violations of FCRA. Under Section 617, “any person who is negligent in failing to comply” with FCRA is liable to a consumer in an amount equal to the consumer’s actual damages, costs, and reasonable attorney’s fees. Under Section 616, “any person who willfully fails to comply” with FCRA is liable to a consumer in an amount equal to actual or statutory damages of up to $1,000 per violation, punitive damages permitted by a court, costs, and reasonable attorney’s fees. Because federal courts have held violations to be willful when inconsistent with agency guidance, the advisory opinions published by the CFPB may increase the potential for civil liability for violations of FCRA.³

Institutions interested in how the CFPB’s advisory opinions may impact their businesses may contact any of the authors of this Advisory or their usual Arnold & Porter contact. The firm’s Financial Services team would be pleased to assist with any questions about the advisory opinions, or financial regulation or consumer protection more broadly.

© Arnold & Porter Kaye Scholer LLP 2024 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.