Lots of Eyes are Looking to the FCRA Lately, So Let’s Get to Know it Together.

What is the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681 et seq.?

Often regarded as one of the first privacy statutes in the US, the FCRA is a federal statute that regulates the use of personal information  in some especially sensitive circumstances, such as employment screening, credit underwriting and insurance underwriting. Congress’s intent was to ensure fair and accurate credit reporting while protecting the privacy of personal information contained in credit reporting files. Since its enactment in 1970, it remains one of the primary tools across the nation to create consumer rights regarding how personal information is used and disclosed.

Who enforces FCRA?

Private litigants, the federal government, and state agencies. This is what makes FCRA compliance critical for users, furnishers, and consumer reporting agencies.   The private litigation trend is only going up. From 2010 to 2019, FCRA litigation more than tripled.   Indeed, according to WebRecon, FCRA lawsuits went from 1,362 in 2010 to 4,937 in 2019.

Federal administrative and enforcement interest has also gained traction, especially in the wake of COVID-19’s economic impact on consumers. The Federal Trade Commission (“FTC”) has long administered and enforced the FCRA. In May 2020, the FTC issued a report to Congress detailing the agency’s efforts to educate consumers about their rights to dispute and correct errors in their consumer reports.  But the FTC is not alone. In 2010, the Consumer Financial Protection Bureau (“CFPB”) was established by  the Dodd-Frank Wall Street Reform and Consumer Protection Act. One of the CFPB’s core functions is to enforce federal consumer laws, including violations of the FCRA. And it doesn’t do so lightly:  just check out this May 2020 $18MM+ settlement with Monster Loans. Not only can the CFPB bring enforcement actions against furnishers, users and consumer reporting agencies (“CRAs”), it is also the first federal agency to have supervisory jurisdiction over CRAs- meaning it can conduct routine examinations of companies not suspected of violating the FCRA.

State agencies can enforce too. The FCRA also authorizes state agencies to take investigative and enforcement action for violations of the FCRA. Numerous state attorneys general have vowed to do just that – check out this April 13, 2020 letter from a consortium of 23 attorneys general to the CFPB.

Four FCRA litigation risks to know and watch:  

  1. COVID-19 Impact on the Consumer Finance Industry and FCRA.

The COVID pandemic has wreaked economic havoc on the world. Here at CPWorld, we are keeping you up-to-date on movements that impact the consumer financial industry from private litigants to regulatory supervision and enforcement so you can better anticipate how the changing landscape and public opinion may impact your organization.

March 13, 2020: President declares national emergency due to COVID-19 pandemic.

March 27, 2020: the CARES Act is enacted, which amended furnishers’ duties under the FCRA.

April 1, 2020: the CFBP issues a policy statement that it intends to relax certain oversight priorities during the current COVID-19 pandemic.

April 13, 2020:  a coalition of 23 attorneys general deliver a sharp letter to the CFPB, demanding it enforce the law.

Understand the CARES Act’s amendment of the FCRA and the clash of powers by reading THIS CPWorld Update.

April 30, 2020: The National Association of Consumer Advocates delivers a letter to the CFPB foreshadowing what areas the plaintiffs’ bar will likely attack in the coming months and years, including issues implicating the FCRA, such as how consumer data is being reported and how credit disputes are being investigated.

May 5, 2020: the Federal Trade Commission issues a report to Congress detailing the agency’s efforts to educate consumers about their rights to dispute and correct errors in their consumer reports.   The FTC emphasized that it “continues to look for education and enforcement opportunities around the issue of consumer report accuracy and disputes.”

This interest in the consumer financial industry has certainly made for some interesting prospective legislation that we are tracking here at CPWorld, together with our first-in-class public policy team. Indeed, stay tuned for our HEROES Act coverage to respond to the updates below:

  • HERE The Czar discusses House’s proposed bill and its potential impacts/amendments to the Fair Debt Collections Practices Act; and
  • HERE the FCRA-guru Glenn Brown talks about wild impacts the HEROES Act would have on FCRA.
  1. Failure to comply with furnishers’ investigation duties.

Although the FCRA was enacted in 1970, furnisher liability was not a significant concern until Congress passed the Consumer Credit Reporting Reform Act of 1996. As a result of this FCRA amendment, furnishers of information to CRAs face real litigation risk. The FCRA does not define the term “furnisher.” However, based on a definition found in Regulation V under the FCRA and on common usage, it has come to mean any entity that furnishes information related to a consumer regarding the entity’s transactions or experiences with the consumer to one or more consumer reporting industries for inclusion in a consumer report.

15 U.S.C. §1681s-2(b) governs a furnisher’s duty to investigate consumers’ disputes.An “indirect dispute” is when a furnisher receives notice of a dispute from a CRA. After receipt of the dispute, a furnisher must complete an investigation and report back to the CRA that notified the furnisher of the dispute within 30 days of the date on which the CRA received the dispute from the consumer. It is the quality of the furnisher’s investigation that is often litigated. Here’s some Circuit-level examples of when furnishers have failed to perform an adequate investigation:

  • Fourth Circuit: only doing a “cursory review” of a consumer’s file likely isn’t going to hack it. Instead, a furnisher must conduct a “searching inquiry” into the dispute, which could include looking beyond information in consumer’s file and consulting underlying documents related to the account – like account applications. Further, a furnisher cannot limit its investigation to the information provided by a CRA. Johnson v. MBNA Am. Bank, NA, 357 F.3d 426, 431 (4th Cir. 2004).
  • Eleventh Circuit: A furnisher’s investigation was unreasonable when “failed to create a reliable system for inputting information regarding the settlement of litigation that might impact the data found on the relevant databases”. As a result of this unreliable system, the furnisher’s investigator was unable to adequately research and verify the consumer dispute. Marchisio v. Carrington Mortg. Servs., LLC, 919 F.3d 1288, 1302 (11th Cir. 2019).
  • EleventhCircuit: If a furnisher decides to report disputed information as verified, “the question of whether the furnisher behaved reasonably will turn on whether the furnisher acquired sufficient evidence to support the conclusion that the information was true.” The 11th Circuit explicitly rejected the argument that a furnisher may limit its investigation simply because the CRA failed to exhaustively describe the dispute in its Automated Consumer Dispute Verification (“ACDV”) form. “When a furnisher has access to dispute-related information beyond the information provided by the CRA, it will often be reasonable for the furnisher to review that additional information and conduct its investigation accordingly.” Hinkle v. Midland Credit Management, Inc. 827 F.3d 1295 (11th Cir., 2016).
  1. Furnishing consumer reports without a “permissible purpose.”

The FCRA provides that a consumer report can only be furnished or used for a “permissible purpose.” 15 U.S.C. § 1681b outlines these permissible purposes, which are limited to the circumstances laid out in the statute “and no other.” § 1681b(a) (emphasis added). Any CRA that furnishes a consumer report for any other purpose faces the risk of civil liability. If that violation is negligent, there is a possibility of plaintiffs recovering actual damages and attorneys’ fees. If the violation is found to be willful, then plaintiffs are entitled to seek statutory damages of between $100 and $1,000 per violation, attorneys’ fees and punitive damages.

The FCRA lays out circumstances in which a CRA may furnish a report “to a person which it has reason to believe” fits one of several criteria, §1681b(a)(3). For example, a CRA has a permissible purpose if it reasonably believes the person:

  • Intends to use the report “in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer.” § 1681b(a)(3)(A).
    • This section creates three permissible purposes: (1) extending credit; (2) reviewing an account; (3) collections.
  • Intends to use the report “for employment purposes.” § 1681b(a)(3)(B).
  • “Otherwise has a legitimate business need for the information,” either “in connection with a business transaction that is initiated by the consumer” or “to review an account to determine whether the consumer continues to meet the terms of the account.” § 1681b(a)(3)(F).

There are several other permissible purposes under the FCRA. A CRA may furnish a consumer report “in accordance with the written instructions of the consumer to whom it relates.” § 1681b(a)(2). A consumer’s written instructions or written consent can authorize a CRA to furnish a report even in circumstances that are not otherwise permissible. For example, one court found that a signed personal guaranty  authorizing the defendant “to obtain an investigative credit report from a credit bureau or credit reporting agency and conduct credit checks concerning my credit history” was permissible under the FCRA. Norcom v. Lease Fin. Grp., LLC, 2014 U.S. Dist. LEXIS 82083 (D. Or. June 17, 2014). Another court  similarly found that a plaintiff’s “broad written authorization” constituted a permissible purpose “regardless whether [defendant’s] purpose was otherwise permitted by the [FCRA].” Hammons v. Enterprise Leasing Co. – Southwest, 993 F. Supp. 1388 (W.D. Okla. 1998).

The question of whether a purpose was permissible may be one of the most highly-litigated FCRA issues across the country: each permissible purpose can raise a slew of questions, and the answers can be highly fact-specific and dependent on the Circuit in which suit is brought. The question is almost never simply whether there was a “legitimate business need” – instead, it’s whether the consumer initiated the transaction, what constitutes a transaction, whether there was a transaction at all, and so on.

Below are just a few examples of circumstances where courts have found that no permissible purpose existed:

  • In many jurisdictions, comparison shopping by a plaintiff – or “window shopping,” where a plaintiff may inquire about prices or plans but does not apply for credit or initiate a purchase – does not give rise, under § 1681b(a)(3)(A), to a permissible purpose or a reasonable belief that one exists. See, e.g., Miller v. Dish Network, LLC, 326 F. Supp. 3d 51, 71-72 (E.D. Va. 2018); Boone v. T-Mobile USA Inc., No. 17-378-KM-MAH, 2018 U.S. Dist. LEXIS 14951, at *36-37 (D.N.J. Jan. 26, 2018); Qureshi v. Penkhus Motor Co., 2016 U.S. Dist. LEXIS 133431, at *1-3 (D. Colo. Sept. 26, 2016).
  • Even a debt collection agency does not automatically have a permissible purpose for obtaining a consumer report; after the enactment of FACTA in 2003, it must show that an outstanding debt stems from a credit transaction under § 1681b(a)(3)(A). Pintos v. Pac. Creditors Ass’n, 565 F.3d 1106 (9th Cir. 2009) (parking violation not a credit transaction, so no permissible purpose); Pigg v. Fair Collections & Outsourcing of New Eng., Inc., No. 1:16-cv-01902-JMS-DML, 2017 U.S. Dist. LEXIS 110893, at *11 (S.D. Ind. July 18, 2017) (finding a credit transaction is a “necessary prerequisite” under § 1681b(a)(3)(A)).

It’s critical to know whether a specific permissible purpose has been litigated in your local courts or circuit court of appeals. That’s why we’re keeping an eye on how permissible purpose issues develop across the country for you.  See, e.g., The Purpose Driven Pull.

  1. Employment FCRA Notice Disclosures.

Per 15 U.S.C. §§ 1681b(b)(2)(A)(i)–(ii)), an employer can only obtain a consumer report for employment purposes if two conditions are met: First, a clear and conspicuous disclosure must be made to the consumer – in writing, and in a document that consists solely of that disclosure – that a consumer report may be obtained for employment purposes. Also, the consumer must authorize – in writing – the user to obtain the report. An employer that does not meet both of these conditions prior to obtaining a consumer report is violating the FCRA, and potentially find itself on the hook for statutory and punitive damages, attorney’s fees, and costs.

But what qualifies as “clear and conspicuous”? It varies highly depending on the facts and the jurisdiction. The cases below show just a few situations where courts have imposed liability:

  • In the Fifth Circuit, a notice that was placed on the back of a pamphlet and wasn’t underlined or bolded, where other language was, didn’t qualify as clear and conspicuous. In fact: “the district court read the back of the credit report and had to ask counsel where the notice was.” Ouch. Stevenson v. TRW, Inc., 987 F.2d 288, 295-96 (5th Cir. 1993).
  • The Seventh Circuit came to a similar conclusion: a disclaimer with tiny text that was evidently “designed to ensure minimal attention by the reader” was “not distinct in any way” and did not pass muster under the FCRA. The court concluded that for employer disclosures, “there must be something about the way that the notice is presented in the document such that the consumer’s attention will be drawn to it.” Cole v. U.S. Capital, Inc., 389 F.3d 719, 731 (7th Cir. 2009).

While authorization language may always accompany the disclosure language, as per § 1681b(b)(2)(A)(ii), what else is allowed? Recent decisions from the Ninth Circuit have strictly interpreted the requirement that the document consist “solely” of the disclosure a/k/a the standalone requirement.

  • Gilberg v. Cal. Check Cashing Stores, LLC, 913 F.3d 1169 (9th Cir. 2020): Plaintiff brought suit for violations of the FCRA standalone requirement and identical provisions under California’s Investigative Consumer Reporting Agencies Act. The court found for plaintiff, adopting a strict interpretation of the standalone requirement that excludes even surplus language that is directly related to the disclosure. Such information, the court concluded, could distract or confuse the reader.
  • Walker v. Fred Meyer, Inc., 953 F.3d 1082 (9th Cir. 2020): In this case, the court considered what language can be considered part of an employer disclosure. It found that, in addition to a plain statement disclosing that a consumer report may be obtained for employment purposes, an employer may also include a concise explanation of what that phrase means – for example, describing what a consumer report is and how it may be obtained. That explanation would not be considered “surplus” under Gilberg.
  • Luna v. Hansen & Adkins Auto Transp., Inc., No. 18-55804, 2020 U.S. App. LEXIS 13215 (Apr. 24, 2020): This decision affirmed the standalone requirement, finding that a disclosure form must contain nothing but the disclosure itself, but found that the standalone requirement was not temporal – the disclosure does not have to be distinct in time. It was sufficient for an employer to send the disclosure form, containing only the disclosure language, along with other application materials for a job.

The standalone requirement has also begun to crop up in district courts across the country. For example, the Middle District of Florida found – similar to Luna – that the standalone requirement applies only to the disclosure form itself; employers can provide the disclosure form along with other application materials, as long as the disclosure form only contains the disclosure (as always, authorization language is also allowed). Jones v. Salvation Army, No. 3:18-cv-804-J-32JRK, 2019 U.S. Dist. LEXIS 198352 (M. D. Fla. Nov. 15, 2019).

Courts have also considered whether including a liability waiver with the disclosure document violates §1681b(b)(2)(A)(ii). Some, including the District of Maryland and the Western District of Pennsylvania, have found that the inclusion of a liability waiver makes the disclosure and authorization non-compliant with the FCRA. Singleton v. Domino’s Pizza, LLC, No. No. DKC 11-1823, 2012 U.S. Dist. LEXIS 8626, at *3-4 (D. Md. Jan. 25, 2012); Reardon v. ClosetMaid Corp., No. 2:08-cv-01730, 2013 U.S. Dist. LEXIS 169821, at *26-27 (W.D. Pa. Dec. 2, 2013). In the case of Reardon, the court also found, based on prior guidance by the FTC, that the inclusion of the waiver was willful – allowing plaintiff to recover damages. Id. at *32. But some courts – like the Western District of North Carolina – have found that even if a waiver is “statutorily impermissible,” the disclosure and authorization it accompanied were valid where the waiver was “not so great a distraction” as to render the disclosure and authorization ineffective. Smith v. Waverly Partners, LLC, No. 3:10-CV-00028-RLV-DSC, 2012 U.S. Dist. LEXIS 119403, at *24 (W.D.N.C. Aug. 23, 2012).

These variations can make all the difference for employer liability – which is why, here at CPWorld, we’re keeping track of how this aspect is unfolding in courts across the country for you.

While FCRA litigation is certainly a CPWorld’s priority focus – including how to keep you out of court – new compliance risks came on the scene this year when the California Consumer Privacy Act (“CCPA”) became effective.  Although the CCPA contains an exemption for personal information that is regulated by the FCRA, most CRAs also collect and sell personal information that is not regulated by the FCRA and so must know and understand the CCPA. Wait, what?  Read HERE to learn more.