CFPB Proposes Rule to Expand FCRA to Cover Data Brokers

The CFPB issued a proposed rule that would amend Regulation V to expand the definitions of consumer report and consumer reporting agency, as well as modify when consumer reporting agencies (CRAs) may furnish consumer reports.  According to the Bureau, these proposed modifications will ensure that the protections of the Fair Credit Reporting Act (FCRA) apply to all data brokers who transmit sensitive personal information of the type that Congress intended to protect when it enacted the statute.

Most notably, the proposed regulation would expand the definitions of a CRA and consumer report as follows:

• Define as a CRA a data broker that sells information about a consumer’s credit history, credit score, debt payments, income, or financial tier generally, regardless of the purpose for which that information is used or expected to be used;
• Define as a consumer report any communication made by a CRA that involves a portion of the consumer report that consists of personal identifiers — such as the consumer’s name, address, or age — if the information was collected for the purpose of preparing a consumer report about the consumer;
• Define as a consumer report any communication made by a consumer reporting agency that involves information about a consumer that is used for a FCRA-covered purpose, regardless of whether the consumer reporting agency knew or expected that the information would be used for that purpose;
• Define as a CRA an entity that otherwise meets the definition of a CRA but would not currently qualify as a CRA because it only assembles or evaluates information about consumers, such as through the collection or verification of that information.

Additionally of note, the proposed regulation would:

• Clarify that, when a CRA facilitates a person’s use of a consumer report for the person’s financial gain (regardless of whether the CRA physically transfers the consumer report to that person), the CRA is considered to have furnished a consumer report to that person within the meaning of FCRA;
• Clarify that, although FCRA permits a CRA to furnish a consumer report to a person if the report relates to that person’s legitimate business need, this provision does not authorize a CRA to furnish a consumer report for marketing purposes;
• Require that, for a CRA to be able to furnish a consumer report pursuant to the consumer’s written instructions, the consumer must sign a separate authorization that is not hidden in fine print and that discloses specified information to the consumer, such as the reason for which the report will be obtained.