In the first episode in a three-part series covering the CFPB's intention to propose new rules under the FCRA, we explore the historical events that led us to this point, next steps in the rulemaking process, expected timeline for a final rule, how the CFPB is coordinating with the FTC and other regulators, and expected proposed rulemaking regarding credit header data and data brokers.
Join us for the first episode in a special three-part series covering the CFPB's intention to propose new rules under the Fair Credit Reporting Act (FCRA). In this episode, Troutman Pepper Partners Chris Willis, Dave Gettings, Ethan Ostroff, and Kim Phan explore the historical events that led us to this point, the next steps in the rulemaking process, the expected timeline for a final rule, how the CFPB is coordinating with the FTC and other regulators, and the expected proposed rulemaking regarding credit header data and data brokers.
Stay tuned for the next two episodes in this series. In our second episode, our panel will discuss the regulation of credit header data and the potential impact on the FCRA and consumer reporting agencies, as well as users and data brokers. And the final episode of our series will focus specifically on data brokers and the possibility of regulating data brokers under the FCRA, the effect it can have on data brokers as well as other types of entities, users, consumer reporting agencies, and resellers.
CFPB’s Rulemaking Under the FCRA
Hosts: Dave Gettings and Chris Willis
Guests: Ethan Ostroff and Kim Phan
Date Aired: 9/7/2023
Chris Willis:
Welcome to this special joint edition of The Consumer Finance Podcast and FCRA Focus. I'm Chris Willis, the co-host of today's podcast and the co-practice leader of Troutman Pepper's Consumer Financial Services Regulatory practice. Dave Gettings, who's your normal host of the FCRA Focus, and I will be co-hosting today's episode as well. This is part one of a special three-part series. We're going to take a very deep dive into the CFPB's forthcoming rulemaking proposal under the Fair Credit Reporting Act, which we think will be incredibly impactful to the industry and requires a lot of discussion.
Today's episode is going to feature a discussion about the background of what led us to this proposed rulemaking and the process to come so that the industry will be educated about what's going to unfold as this rulemaking moves forward. But before we jump into that topic, let me remind you to visit and subscribe to our blogs, troutmanpepperfinancialservices.com and consumerfinancialserviceslawmonitor.com, where we cover all the relevant events about the financial services industry and the CFS industry as well.
And in addition to The Consumer Finance Podcast and FCRA Focus, our two podcasts that you're listening to right now, don't forget about our others. We also have The Crypto Exchange, which is about all things crypto. We have Unauthorized Access, which is our privacy and data security podcast, and we have our newest podcast called Payments Pros, all about the payments industry. So those are available on all popular podcast platforms. And speaking of those platforms, if you like this podcast, let us know. Leave us a review on your podcast platform of choice and let us know how we're doing. And of course, don't forget about our incredible new mobile app, which serves as a one-stop shop for all of our thought leadership content. You can listen to all our podcasts, read all the blogs, all of our alerts, and there's even a handy calendar to show you what conferences we'll be attending and speaking at and a great directory of all of the members of our very large financial services industry group. So please check it out. It's available for both iOS and Android in the app store under Troutman Pepper.
Now, as I said, Dave Gettings and I are co-hosting today's episode, but we're also joined by two other of our partners, Ethan Ostroff and Kim Phan, both of whom are extremely knowledgeable about these Fair Credit Reporting Act issues. And with that, let me turn it over to Dave.
So, Dave, why don't you kick us off in our discussion of what led us up to this proposed rulemaking?
Dave Gettings:
Thanks, Chris. Appreciate it and appreciate the opportunity to do another joint podcast. We are like peanut butter and jelly. When we finally got together, the rest is history. It's going to be a good episode. So again, I'm your host of FCRA Focus. I'm a partner at Troutman Pepper who focuses on all things FCRA. Before we actually dive into the details, maybe I'll give Kim and Ethan just a brief minute to introduce themselves. I know they've both been podcast regulars in the past, but I think it couldn't hurt to have the listeners understand the perspective they're bringing today.
Kim Phan:
Thanks, Dave. I'm pleased to be here, happy to be speaking on this topic because I think it will be a major shift in the FCRA regulatory and litigation environment. It's going to be one of the biggest substantive changes to the FCRA in almost 10 years, since it's been amended by the Congress. The CFPB took over rulemaking of the FCRA. They of course reissued Reg V, but otherwise have not touched it substantively. So excited to see what they're going to be doing and happy to be here to talk about it.
Ethan Ostroff:
Hey, good morning. It's good to be with you guys as well. Dave, I'm looking forward to the discussion today. I'm also looking forward to dominating you in our office fantasy football league.
Dave Gettings:
Spoken like someone who knows he's going to lose, Ethan. Ethan, last time we talked you were a little hesitant on the Orioles and how they were doing this year. So now that we're recording the podcast toward the end of the baseball season, what's your prediction?
Ethan Ostroff:
My prediction, I think the Orioles will make the playoffs. I think the Orioles starting pitcher will be the key to them actually winning a series. We'll see. I hope they'll get themselves home field, which would be great. I won't ask you about the Mets.
Dave Gettings:
I was cautiously optimistic about the Mets during our last podcast and then the trade deadline happened, so looking forward to talking about them in 2024.
Today, we're talking about the CFPB and its forthcoming regulation of data brokers, well potentially regulation of data brokers, and it's handling of credit header information. So we thought it'd be good for the listeners to get a little bit of background very briefly as to how we got here. We can't start until we start in the 1970s, back before I was born, when people drove cars without seat belts and kids rode bikes without helmets. That's a time that Congress passed the Fair Credit Reporting Act and it led to 50 years of litigation, of regulation, of compliance work. And skipping all that, we get to 2023. In 2023, the CFPB issued its 2022 fall rulemaking agenda. It came out in January of 2023, and this contained a pre-rule, a proposed rule, and some final rules under consideration.
The CFPB generally releases its regulatory agendas twice a year in voluntary conjunction with a broader initiative led by the OMB to publish a unified agenda of regulatory and deregulatory actions across the federal government. In the preamble to the notice, the CFPB stated that the information was current as of September 30th, 2022, and it identified regulatory matters the CFPB reasonably anticipates having under consideration during the period from December 2022 to November 30th, 2023. And as part of that as relevant to this podcast, the CFPB sort of cryptically stated that it's considering whether to amend Regulation V, which is what Kim mentioned during her intro a few minutes ago.
Flash forward to March 15th, 2023, the CFPB issued a request for information regarding data brokers and other business practices. And whenever the CFPB issues a request for information regarding X, if you are part of X, you should look out because there's a decent chance the CFPB is going to issue some regulations. So, in the press release that accompanied the release of the RFI, the CFPB's director talked about modern data surveillance practices, allowing companies to hover over your "digital lives" and monetize our sensitive data. He also noted that the CFPB's inquiry will inform whether the rules under the FCRA reflect these market realities.
The CFPB also previewed its legal position stating that the FCRA broadly applies to data brokers like credit reporting companies and background screening firms as well as those who report information to these firms. So, the CFPB, in March of 2023, definitely gave some significant foreshadowing as to what it was planning to do and who is potentially in the CFPB'S crosshairs. Anytime the CFPB combines the phrases, “broad definitions of consumer report and consumer reporting agency,” with the phrase, “collecting information on consumer harm and any market abuses,” it's a pretty good chance the CFPB is going to start interpreting things broadly to bring within its reach anything it can.
Also, in this March 15th request for information, the CFPB suggested that many data brokers who "act as consumer reporting agencies under the FCRA, nevertheless disclaim FCRA coverage." And with all that background, the CFPB sought public comment on the business practices of data brokers and how they impact the daily lives of consumers. The CFPB specifically wanted to hear details about the types of data and types of data brokers that collect and sell information, the sources they rely on and how those really fit within the construct, if at all, of the FCRA. And according to the CFPB, it received more than 7,000 responses that "echo the same concerns raised by Congress when passing the FCRA in the 1970s, about which the FCRA was initially designed to address."
Chris Willis:
It's amazing, Dave, how that happens, right? The CFPB thinks there might be a problem and lo and behold, all the comments confirm that the problem does in fact exist and urgently needs to be addressed.
Dave Gettings:
It is remarkable how that happens, Chris. See a problem and remarkably 7,000 comments support what you see as the problem. Chris, in our experience too, when you make FOIA requests and things like that for these CFPB proposals, it's remarkable how often interested groups, like for example, the plaintiffs’ bar and plaintiffs’ bar groups tend to submit comments that, lo and behold, tend to support what the CFPB is trying to do. And then once you get CFPB regulation, well then the plaintiffs’ bar tends to sue on those same regulations that the CFPB issued. So, you can tell I'm not a cynical defense attorney at all, Chris, but it's the process we've seen repeat itself over and over again.
Chris Willis:
It's not cynical if it's all true, Dave.
Dave Gettings:
Spoken like a true defense lawyer, Chris.
All right, so we've got March 15th, 2023, the RFI and then most recently, which was probably the biggest genesis for this podcast is on August 15th, the White House convened a round table on protecting Americans from the harmful data broker practices. Again, that's some foreshadowing of where the CFPB was going. And in these remarks, the CFPB talked about what it was envisioning regulating and the two areas it was focusing on were credit header data and whether credit header data is regulated under the FCRA and then also data brokers and whether data brokers should be regulated under the FCRA as consumer reporting agencies. So that's really what gets us to where we are now and the process of going forward and what we expect to see with respect to CFPB regulations coming forward.
Ethan, to kick it off a little bit before we talk about process and maybe where the process fits in, when we were talking offline, you had talked about some of the interesting impacts for non-data brokers, for example, for users for potentially other consumer reporting agencies if data brokers are regulated by the CFPB's consumer reporting agencies. You want to talk a little bit about some of those next level effects that people may not see coming?
Ethan Ostroff:
Yeah, I think, David, generally speaking, if folks simply hear the phrase data broker and think that doesn't apply to them, they might want to take a moment and think about whether or not they're a user and or a furnisher as defined under the FCRA. Because if different entities become subject to a definition consumer reporting agency such that they become obligations on users of information received from that entity or furnishers of information to that entity, then they're going to have to be aware of some differing and significant types of obligations.
Dave Gettings:
Just some items we were thinking about. For example, if data brokers are CRAs, does that then mean then the traditional CRAs are often resellers and can they then make arguments that the only the provisions of the FCRA particular to resellers apply to them? For example, the particular dispute procedures. So there's a lot of down the line impacts on entities besides just data brokers if the FCRA applies to them.
Ethan Ostroff:
Yeah, I also thought the reference in the FAQs to a set a fundamental right that will provide essential protections to consumers, including the right to obtain their data and dispute inaccuracies was a very interesting choice of words. It'll be very interesting to see how that ends up playing out considering the potential expanse of who could fall under the definition of a consumer reporting agency.
Kim Phan:
And I'm very concerned that companies are not thinking of this in the way that, Ethan, you and Dave are thinking about it. Again, the actual data brokers are certainly going to be very focused on this, but again, any company that is potentially a data source potentially becomes a furnisher with all of the reinvestigation obligations that come with that. The accuracy obligations, things of that nature, which right now they don't necessarily have to do with regard to this is what we think might be a risk of fraud that a data broker might be compiling and selling, but it may not actually be fraud, but it could be a good indicator. And removing that from the sources of data the data brokers are currently providing into the marketplace could have downstream negative impacts. And then, of course, the entities that purchase any data from data brokers, they now become users that are subject to requirements like providing notices of adverse action.
That could definitely, again, also chill some of the market uses that are out there for the data brokers make available. And I found it interesting that it seems very clear what direction the CFPB is going, that they're talking about the harms of data brokers, they're talking about the market realities of this surveillance state that we're living in. They don't really address the benefits. The idea that the CFPB is supposed to be a balanced data-based agency that regulates looking at both sides. None of that seems to have appeared in some of the most recent materials, especially in Director Chopra's remarks.
Chris Willis:
Well frankly, Kim, for that matter, I don't see any reference to the legal difficulties of interpreting brand new things into the FCRA that aren't clearly covered by the definition of a consumer report.
Dave Gettings:
And the definition has always been circular. A consumer reporting agency is one that prepares consumer reports and a consumer report is one thing that's prepared by a consumer reporting agency. So this will probably introduce a new level of potential circularity, if that's even a word, into the definition.
So Chris, before we start talking too much about substance, since you are one of our process experts, do you want to talk a little bit about what the next steps are in the CFPB's rulemaking process and what we can expect?
Chris Willis:
Of course. Yeah, because seen the CFPB do a lot of rulemakings over its 12-year history, so we have a pretty good idea about how the process is going to unfold, both in terms of what the steps are and the rough timeline to potentially expect. The first step in a rulemaking process has already occurred. The Bureau's put it on its rulemaking agenda and has said we're going to do rulemaking on this issue with now the detail provided by the White House event that we were just talking about. And as Director Chopra stated at the White House event, the next thing that the Bureau is going to do is convene what's called the SBREFA process. SBREFA is an acronym that stands for Small Business Regulatory Flexibility Act or something like that. But it's essentially a required part of any rulemaking that requires the agency to assess the impact of the rulemaking on small businesses and try to minimize that impact.
And so what the Bureau does in order to comply with that requirement is to convene a small business review panel made up of representatives of small business who might be impacted by the rule that they're thinking about promulgating and then publishing an outline of the proposals that they are considering. Or if you're cynical, that they've already made up their mind on as announced by the director at the White House event, and they are supposed to get feedback from small businesses and take that into account in formulating a proposed rule. We think, based on the statements at the White House event, that SBREFA outline, which will give us the first detailed preview of what the proposed rule may look like, would come out relatively soon, and then they'll go through the small business review process, which is typically about a three- or so-month process.
It doesn't take a huge amount of time and it doesn't result in any sort of published report or anything, they just do the process. After they finish the SBREFA process, which will probably carry them through till the end of this calendar year, 2023, then you would expect them to release a proposed rule.
Ethan Ostroff:
With the FAQs that were released, there was this reference at the very end saying that small businesses interested in participating as a panelist should contact the CFPB within the next week. Do they really expect to determine who's going to be on a SBREFA panel by whoever contacts them within seven days?
Chris Willis:
It seems very unrealistic to me, actually.
Ethan Ostroff:
Is that how you get a fair representation of the different types of entities that could qualify to participate on that SBREFA panel? Is there a way to figure that out?
Chris Willis:
I don't think that the Bureau has any formal process for identifying and recruiting small business panel members. I think they rely on entities to volunteer themselves or for trade associations to be paying attention to their every word and react rapidly to a request like the one that you repeated from the White House event.
Ethan Ostroff:
How do they define who can and cannot fit within the definition of small business?
Chris Willis:
Typically, they would use the Small Business Administration size thresholds that are set forth by NAICS code. So depending on the type of business you are, you have a different sort of income or asset size that qualifies you as a small business under the SBA's rules.
Ethan Ostroff:
Interesting. And so then will they announce at some point like, "Hey, we formed the panel. Here's who's on it."
Chris Willis:
They will definitely announce that they form the panel and they'll release an outline of the proposed rule that will be discussed by the panel. I'm not clear on whether they'll announce the members of the panel publicly.
Ethan Ostroff:
So that outline, how in depth does that go? Is that going to be something that we should be focused on seeing?
Chris Willis:
Yes, it provides valuable information about the proposals that they're already sort of got in their minds with whatever degree of finality you'd like to assign to that. And it will be more detailed than what we've gotten so far from the White House event and from the FAQs. But it's not like a thousand-page document like the proposed rule is going to be. It'll be 3, 4, 5 pages, something like that. It'll be important for us to pay attention to and it'll be important as a sign of where things are going, but it won't have the granular detail that a proposed rule will have, but we won't get that proposed rule until next year.
Ethan Ostroff:
So the SBREFA panel formation, is all that something that will be finished this year, like this calendar year?
Chris Willis:
Maybe, but maybe it'll bleed over into the first quarter of next year.
Ethan Ostroff:
Gotcha.
Chris Willis:
It depends on how fast they do it.
Ethan Ostroff:
In other words, within the next six months, this process is going to be finished.
Chris Willis:
I believe so, yes. Based on their past performance with these exercises.
Ethan Ostroff:
Gotcha.
Kim Phan:
They did say that they were going to release a report that summarizes the feedback that they're going to get from the SBREFA panel. Now in the past, they have not identified the participants in that summary report, but they do say a trade association of this type had feedback of this sort or a company of this characterization offered the following comments. They don't actually call out individual companies.
Dave Gettings:
Chris and Kim, I'm kind of excited to ask this very loaded question that we didn't honestly plan before this, but Chris mentioned that he feels like the CFPB often has already made up its mind. I can't imagine that the SBREFA panel is going to give the CFPB a bunch of comments that say yes, regulate data brokers as CRAs to give us more obligations and regulate credit header data as a consumer report to give us more requirements. So how much give and take is there really in this panel or is it just to make the regulatory check mark and then move on?
Chris Willis:
I believe it's the latter, Dave. It's a requirement. It's a legal requirement to do this panel process as part of any rulemaking, and so the CFPB does it because it has to. But I would say that the give and take and influence on the rule that we see from the SBREFA process historically with the CFPB is just as significant as the give and take and changes to rules we see through the public comment process when they receive comments from industry, which is not very much, by the way.
Kim Phan:
I wouldn't typically think of myself as quite as cynical as Chris, but in this case, I-
Ethan Ostroff:
But in this case, you are, wow.
Kim Phan:
In this case, I would find that I am. And the reason is because of the timeline that the CFPs already announced. They've had these remarks at this White House round table, and it's already August. They said they're going to have the SBREFA process, which takes somewhere between three to six months. But they're going to have a proposed rule, they're going to analyze all of those comments and then consider those in developing a proposed rule that's going to come out sometime next year. That is lightning fast for the CFPB as far as giving these fair weight. And it leads me to the conclusion that they've already reached what they've decided they're going to do, and they're just looking for validation before they release what their proposals are going to be. Otherwise, it would be a longer timeline for them to take not only into account the SBREFA comments, but other industry commentary. Right. You look at some of the other CFPB rulemakings that have taken 5, 6, 7 years and they're planning to do this whole process in less than a year.
It's surprising that they could do that unless they already had predetermined what they were going to roll out.
Ethan Ostroff:
And potentially, there are political motivations to have it done by the end of 2024, right?
Chris Willis:
Well, I don't think they're going to have the final rule done by the end of 2024. They'll have a proposed rule out, and that is where I think they're looking for the political benefit. And keep in mind, this isn't the only rulemaking where the Bureau was working hand in hand with the White House. You may recall earlier this year, the President talked about a forthcoming CFPB rulemaking in the State of the Union address dealing with credit card late fees, announcing that his administration was going to reduce those fees, thereby giving the conclusion of a rulemaking where the public comment process had not even started at that point. So the idea that the Bureau is doing this rulemaking in conjunction with political advantage to be had to the current administration is something that has been well worn already this year.
Dave Gettings:
To continue this baseball reference, this SBREFA process to me feels a little bit like Major League Baseball pitchers have the unilateral authority to enlarge the strike zone, but they want to hear input from the batters before they do. So it's like, “What are the batters possibly going to say that's going to make them change their mind?” I don't know. We'll see. How is the CFPB director coordinating with the FTC and other federal and state regulators on this topic? Kim or Chris, any input on that?
Kim Phan:
The CFPB has said that they are developing these rules. When the Dodd-Frank Act was first enacted, the CFPB rulemaking was transferred from the Federal Reserve from the FDIC, from the FTC and others to the CFPB. But these other agencies, of course, continue to have rulemaking in their specific areas over their covered supervised entities as well as enforcement authority. So we know that Director Chopra and the current FTC chair, Lina Khan, are very close friends personally, as well as working very closely professionally. We anticipate, of course, that they're probably working very closely with them and the other regulators to see how this will be rolled out, not only for purposes of the rulemaking, but downstream enforcement in consent order, settlements, other things that the related agencies will also be bringing.
Ethan Ostroff:
Chris, Kim, I think it might be helpful for our listeners. There's specific reference to the Department of Transportation and the Department of Agriculture and then a cryptic reference to other agencies that can enforce these rules for specific sectors under their jurisdiction. How do those other agencies play a role here? Why mention them?
Chris Willis:
I'm mystified. Do you know the answer, Kim?
Kim Phan:
I'm assuming the Department of Agriculture may be related with regard to the Farm Credit Bill and some of the uses by agricultural financing entities. Department of Transportation, I'm a little bit less clear on.
Ethan Ostroff:
I was just trying to think about is it somehow have to do with the types of data that is the subject to the purview of the DOT because of driver information? I don't know.
Chris Willis:
Maybe smart car information, telematics type stuff? Who knows?
Ethan Ostroff:
Yeah, I saw that and I scratched my head. That's a very interesting, they could have just said in the Federal Trade Commission and other agencies, right? Instead, they made a specific point of mentioning specifically Department of Transportation and the Department of Agriculture.
Dave Gettings:
With respect to DOT, Ethan, one of the issues we see for some of our trucking company clients is the separate provisions of the FCRA related to the trucking industry. So, the adverse action requirements, the disclosure and authorization requirements, so there may be interplay they're looking at there between those requirements, between whether, for example, the FMCSA has regulatory changes related to this. I know that's one of the areas that our trucking company clients are particularly concerned about. So that may be the direct reference to DOT.
Kim Phan:
That makes sense too. If they're thinking about downstream negative implications for consumers, we know they care about tenant screening. We know they care about, because they mentioned it, survivors of domestic violence. If they're thinking about vulnerable populations, employment would certainly be an area that they would also want to highlight.
Ethan Ostroff:
Very interesting.
Dave Gettings:
Let's preview our next two forthcoming podcasts on this topic. We're going to be doing a separate podcast coming up in the near future, discussing specifically the regulation of credit header data and the potential impact on the FCRA and consumer reporting agencies, as well as users and data brokers. And then another podcast talking specifically about data brokers and the possibility of regulating data brokers onto the FCRA, the effect it can have on data brokers as well as we mentioned, other types of entities, users, consumer reporting agencies, resellers. We hope that you join us on the next edition of FCRA Focus and The Consumer Financial Services Podcast. Ethan, Kim, any parting comments on the process we expect to see going forward?
Kim Phan:
I did have a thought about, when we were talking about the [inaudible] elections. If we're trying to tee this up against the 2024 elections, if there's some activity in this area, it's almost certainly going to benefit Democrats, who across the board are the ones who are introducing and proposing bills on a regular basis in Congress. They implicate the FCRA with regard to things like human trafficking, which is something that was enacted in 2022. Domestic violence, student loans, military, protections for older Americans. So across the board, if there was going to be action in this area, it would benefit Democrats who are already active in introducing bills regarding to the FCRA.
Ethan Ostroff:
And likewise, if we're going to see activity on the Hill, I think it's going to be led by the Republican leadership in the House, and we could very well see some hearings towards the end of this year and the next year with the director that don't particularly take a nice perspective on the activities of the CFPB.
Chris Willis:
Yeah. And Dave, just one last point from me. We do expect a proposed rule in 2024 because the Bureau told us to expect one. And that of course, coincides with the election next year, and so has some political advantage to it, but I don't think there's any way that the Bureau could complete the rulemaking process and finalize this rule prior to the election or even the next administration taking over. So, there's a question about whether or not the rulemaking would be affected by the outcome of the election. If the president wins reelection, you could still have a different director of the CFPB who might go in a different direction. Or if a Republican wins the White House, you might see the rulemaking go away or go in a different direction. These rulemakings don't go off quickly. A major rulemaking like this probably takes at least 18 months between proposed and final rules. And so, I don't think we should expect a final rule on this issue until, say, mid-2025 at the earliest, and by then, who knows what the political landscape or the leadership of the Bureau will look like. So that's a major X factor in this rulemaking that we need to keep in mind.
Dave Gettings:
Thanks, Chris. I appreciate everyone's time. I'd like to thank everyone for listening to another joint session of FCRA Focus, the podcast that focuses on all things FCRA and The Consumer Finance Podcast that's hosted by Chris Willis. And please do not forget to head over to Troutman's blog, the Consumer Financial Services Law Monitor for much more great content discussing credit reporting, debt collection, and all things in between.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.