In this episode, Chris Willis and Julie Hoffmeister discuss the CFPB's recent request for information about data brokers and the potential interplay with the FCRA.
Please join Troutman Pepper Partner Chris Willis and his fellow Partner Julie Hoffmeister as they discuss the Consumer Financial Protection Bureau's (CFPB) recent request for information about data brokers and the potential interplay with the Fair Credit Reporting Act (FCRA). During this episode, they expand on the CFPB's potential FCRA rulemaking regarding data brokers, the CFPB's intent to monitor data brokers and its desire to have greater oversight on the data broker industry, and the steps that the CFPB may take in response to the request for information.
As part of the firm's Privacy + Cyber Practice Group, Julie focuses her practice on defending consumer-facing companies of all types in individual and class actions, including claims under the FCRA and other federal and state law-related privacy claims.
The Consumer Finance Podcast: CFPB Request for Information About the Status of Data Brokers Under the Fair Credit Reporting Act
Chris Willis:
Welcome to The Consumer Finance Podcast. I'm Chris Willis, the co-leader of Troutman Pepper's Consumer Financial Services Regulatory Practice, and today we're going to be talking about a new CFPB request for information about the status of data brokers under the Fair Credit Reporting Act. But before we jump into that topic, let me remind you to visit and subscribe to our blog, consumerfinancialserviceslawmonitor.com, where you'll see daily updates about everything that's happening in the industry. Check out our other podcasts, we have lots of them. We have the FCRA Focus, which is all about credit reporting, The Crypto Exchange about all things crypto, and our privacy and data security podcast called Unauthorized Access, all of which are available on all popular podcast platforms.
And speaking of podcast platforms, if you like this podcast, leave us a review on your platform of choice and let us know how we're doing. Now, today, as I said, we're going to be talking about a recent CFPB request for information dealing with the role of data brokers in the Fair Credit Reporting Act, and I'm joined by one of our many credit reporting experts in our consumer financial services group, my partner, Julie Hoffmeister. So, Julie, welcome to the podcast. Thanks for being here.
Julie Hoffmeister:
Thanks, Chris, for the opportunity to talk to you today.
Chris Willis:
I'm really curious about this because the CFPB has been making noise about potential rule making under the Fair Credit Reporting Act for seems like over a year now, and the Bureau recently released a request for information. So give the audience some background and tell us about this recent request for information that came out.
Julie Hoffmeister:
Yeah, this recent request came out mid-March, around March 15th, and it's seeking public comment on what the CFPB is calling, “data brokers.” So the CFPB in its request is defining data broker as an umbrella term to describe firms that collect, aggregate, sell, resell license, or otherwise share consumer's personal information with other parties. So in the request, CFPB is saying it wants to gain insight into the full scope of the data broker industry. They're seeking public comment on the business practices of these data brokers, how they may impact the daily lives of the consumers. So in the request, the CFPB is posting about 30 questions. Some of those questions are things like, what types of data do data brokers collect? What do they do with the data? What controls are in place to ensure the accuracy of the data they're collecting? Have consumers experienced harm from the data broker industry?
This request is really interesting in terms of the CFPB's, at least what they're hinting at their view is on data brokers, and they seem to be going after the standard FCRA framework with their questions, right? So they're talking about things like accuracy and having a dispute process and requiring reinvestigations, and that's, as we know it, the standard FCRA compliance framework. The data, like you said, is being gathered in response to the CFPB's plan rulemaking under the FCRA, although the CFPB hasn't provided really any details about the rules it thinks it's going to revise or implement. Overall, the request for information certainly indicating to us the CFPB's desire to have greater oversight on the data broker industry and maybe even on personal data overall.
Chris Willis:
Well, hang on a second though, because you mentioned that the request for information sort of tracks some of the statutory duties in the FCRA, like accuracy, integrity and disputes, and stuff like that. But I have read the Fair Credit Reporting Act on occasion, and I didn't see any mention of data brokers in the statute. So where is the connection between data brokers generally and the FCRA? Why is the CFPB talking about them?
Julie Hoffmeister:
That's right, and that's a great question, Chris, and one we're wondering about as well. The request makes clear the CFPB views data brokers as falling within FCRA regulation. So in the press release, for example, CFPB says they want to know if data brokers are, "playing by the same rules," and then they go on to say the data brokers share some of the same characteristics as consumer reporting agencies, so entities that are regulated by the FCRA. But you're right that the FCRA doesn't mention or reference data brokers at all. The FCRA, as you know, Chris, is intended to regulate consumer reporting agencies, consumer reports, users, furnishers of information. Those specific definitions in the FCRA that we've all become well acquainted with.
For example, a consumer report in the FCRA says that the report has to be used to establish a consumer's eligibility for credit, insurance, employment or another benefit defined under the statute. But the CFPB, at least their questions in their requests for information, seemed to be pointing at the fact that they think the FCRA's reach extends beyond that, that maybe every report that contains personal information is regulated under the FCRA, or maybe even so far as every piece of personal data that's collected is regulated under the FCRA. But, obviously, the FCRA has been around for 50 plus years now, and we've all been operating under those definitions set forth in the law. So, it seems like the CFPB may be trying to expand on those standards.
Chris Willis:
Likewise, too, I mean if we think about other potential sources of rulemaking authority for the Bureau, we have UDAP. But the thing is the CFPB's UDAP authority extends to my understanding only to consumer financial products and services, and there's a definition of consumer reporting in Dodd-Frank that talks about consumer reporting used in connection with consumer financial products or services. Is this RFI limited to the data brokers that may gather and provide information relevant to consumer financial products or services, or is it just data brokers writ large?
Julie Hoffmeister:
It could be data brokers writ large. I think it's really left to be seen. I mean, we'll have to see what the comments come back with in response to the requests for information and how broad the interpretation goes and where the CFPB takes that.
Chris Willis:
Let's assume for a second that the CFPB is proceeding down the road of a rulemaking that would seek to include data brokers as governed by the FCRA, leaving aside for the moment the annoying lack of coverage in the definition of consumer report that may apply to some of this stuff. What would be the potential impact to the industry of the CFPB doing that?
Julie Hoffmeister:
So I would start, Chris, by saying we don't exactly know where the CFPB's proposed rulemaking may go. Like I said, the request for information certainly hints at the fact that the CFPB thinks these data brokers may be covered under the FCRA in certain types of data uses, which by the prevailing industry standard says are outside of FCRA regulation. CFPB may view that within the FCRA scope. But, ultimately, the request that we're looking at right now itself is just an inquiry into these business models and we don't know if the future CFPB will go as far as to say data brokers are consumer reporting agencies and they are covered by the FCRA.
But I'd say that even if it doesn't go that far, it could still have a major disruption in the industry. For example, a lot of companies have structured their businesses around the FCRA's requirements. Some companies may have developed separate business models between FCRA and non-FCRA, for example, based on their understanding of the FCRA's reach, but the CFPB's rulemaking, and again, depending on how far the CFPB takes this could potentially throw a wrench into that understanding, to the extent it seeks to modify what we know is within the FCRA scope.
Chris Willis:
Sure. And to think about maybe a little more grounded example, there are companies, for example, that will take consumer's bank account information and provide it to creditors for use in evaluating credit applications. But I think some of those companies take the position that they're not governed by the FCRA because that information isn't a compilation or report, it's just a pass-through of data from your checking account records. I wonder is there any thought that the CFPB may be trying to bring entities like that into the ambit of the FCRA, even though they think they may be excluded from it?
Julie Hoffmeister:
Potentially, based on what the CFPB in defining as data broker. They define it so broad in this request for information. Again, any firm that collects, aggregates, sell, resells, licenses or otherwise shares consumers' personal information with other parties. I mean, you think about that definition, that could cover a lot of different companies.
Chris Willis:
Yeah. There's lots of products that are used in the consumer financial services marketplace that are designated as non-FCRA products because they're not supposed to be used and are not used to determine eligibility, as you said, for say, an extension of credit. The whole industry is built around that 50-year-old definition in the statute. So it'll be interesting to see what the bureau does with that. Julie, assuming for a second that the CFPB does try to promulgate a rule that goes beyond either the reach of the Fair Credit Reporting Act in terms of defining what's a consumer report or a consumer reporting agency or that goes beyond the definition of consumer reporting that's a consumer financial product or service in Dodd-Frank, which, again, is tied to its use in connection with a consumer financial product or service, would there be an opportunity for the industry to challenge the rulemaking?
Julie Hoffmeister:
Definitely. CFPB's rulemaking and other actions can be challenged. Anyone in the industry who has standing to challenge the issue can do so. The challenge could be that the agency acted in excess of its authority. Obviously, here to the extent the CFPB goes as far as to say that all data brokers, as they've defined them in this request, are covered by the FCRA, adding provisions to the law that are actually not stated in the law today, that could arguably be beyond the agency's authority. So, there'd be an opportunity there to challenge the rule.
Chris Willis:
Okay. And as I said, we've been hearing about this potential rulemaking under the Fair Credit Reporting Act for a while now, but we did notice that potential FCRA rulemaking was listed in the unified agenda that the CFPB put out at the end of 2022 in December. What do you think the next steps are here after this RFI plays out? What do you think will happen next and when?
Julie Hoffmeister:
The RFI is seeking comments by June 13th, and it's seeking comments both from market level perspective and from a consumer perspective. The market level inquiries, for example, they're aimed at the "data broker industry." How do these organizations function? What kinds of data do they collect? How are they using it? What are the sources of the data? And on the other hand, the individual inquiries are focusing on the consumer's experience. So, have they experienced alleged harm? Have they tried to correct or delete their personal information held by these companies?
We expect a significant amount of comments on this request for information, both at the market level and potentially at the consumer level too. The comments on the request will definitely be interesting. We'll likely see a wide variety of interpretations of the FCRA, and the comments may provide some insight as to where the CFPB may ultimately head. So we won't know exactly what the CFPB is thinking in terms of data brokers and coverage under the FCRA until we see a notice of proposed rulemaking. But I think for now it's safe to say at least that the request highlights the CFPB's intent to monitor these data brokers, and those with a stake in the outcome should definitely make their voice known during this process.
Chris Willis:
Got it. It makes sense. And, honestly, it makes a certain amount of sense because a lot of the comments of the director of the CFPB, Rohit Chopra, have been oriented around the idea of collection and misuse of consumers' personal information through various internet and social media type of channels, so it's obviously an area of interest to the director and therefore the Bureau. The question that you've raised, and I think is the good one, is what can the Bureau actually do in this area that's within statutory authority? So we'll have to stay tuned and see what happens and when with respect to that. Julie, thanks for coming on the podcast today and sharing this news and your insights about it. And, of course, thanks to our audience for listening to today's episode.
Don't forget to visit our blog, consumerfinancialserviceslawmonitor.com, and be sure to hit that Subscribe button so that you can get all of our daily updates about everything that's going on in the consumer financial services world. And while you're at it, go over to troutman.com and visit us and subscribe to our email list for the Consumer Financial Services Group, so you can get notice of our webinars and our alerts. And, of course, stay tuned for a great new episode of this podcast every Thursday afternoon. Thank you all for listening.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.