Please join us for a special cross-over episode of FCRA Focus and The Consumer Finance Podcast, where Troutman Pepper Partners Chris Willis, Dave Gettings, Kim Phan, and Ron Raether look at the latest developments in the CFPB’s FCRA rulemaking process.
Please join us for a special cross-over episode of FCRA Focus and The Consumer Finance Podcast, where Troutman Pepper Partners Chris Willis, Dave Gettings, Kim Phan, and Ron Raether look at the latest developments in the CFPB's FCRA rulemaking process. Topics include:
The Consumer Finance Podcast and FCRA Focus Crossover Episode:
New Developments in the CFPB’s FCRA Rulemaking Process – What’s Next?
Hosts: Chris Willis and Dave Gettings
Guests: Kim Phan and Ron Raether
Date aired: December 7, 2023
Chris Willis:
Welcome to a special crossover edition of The Consumer Finance Podcast and FCRA Focus. I'm Chris Willis, the co-leader of Troutman Pepper's Consumer Financial Services Regulatory Group, and today, we're doing this crossover episode to talk about the elephant in the room, which is the CFPB's ongoing FCRA rulemaking. But before we jump into that topic, let me remind you to visit our blogs and subscribe to them, TroutmanPepperFinancialServices.com and ConsumerFinancialServicesLawMonitor.com. And don't forget about our other wonderful podcasts.
In addition to the two that we're recording today, we also have Unauthorized Access, which is our Privacy and Data Security podcast, and Payments Pros, which is all about the payments industry. And those podcasts like these are available on all popular podcast platforms. And speaking of those platforms, if you like this podcast, let us know. Leave us a review on your podcast platform of choice and let us know how we're doing. And finally, don't forget about our really nifty mobile app. It's the best way to access all of our thought leadership content in one place.
It has all of our blogs, all of our alerts, and all of our podcasts, all in a convenient package, all in one mobile app on your device, and it's available for both Android and iOS. Just look in your app store for Troutman Pepper, and you'll find it with no problem. Now, as I said, we're recording a crossover episode today. So let me just let Dave Gettings, who's the regular host of FCRA Focus, weigh in and welcome you to the podcast as well. Dave, are you out there?
Dave Gettings:
I am. Thanks, Chris. Appreciate the transition. We always love co-hosting a podcast with the Consumer Finance Podcast. We've had a lot of opportunities to do that recently with the CFPB’s work and proposed rulemaking, so it's always good to be here. Also, given the guests today, Ron Raether and Kim Phan, I thought it'd be a really good time for our grand announcement that Kim will be assuming a larger co-hosting role of the FCRA Focus podcast.
She's been a guest so many times and does such a great job, and frankly, I need the help, that we thought it'd be fantastic if she'd co-host. She also brings a really unique regulatory experience to FCRA Focus, given my predominant focus on litigation and compliance. So we think it'll be a great angler for listeners. My only hope is that she does not transition me completely out of this volunteer, unpaid hosting job. So Kim don't do too good a job. And with that, Kim, do you want to introduce yourself briefly?
Kim Phan:
Thank you very much Dave, and I'm so excited to be able to co-host with you. You've been such a great host over the past year, and I am honored and feel privileged to be able to join you in that role in the coming years. It's been a long road with the FCRA. I've been working on that my entire career and working on it from the perspective of both consumer reporting agencies as well as end users and furnishers.
So being able to offer some of the regulatory perspective to offset and compliment the litigation focus that you bring, I think, is going to be a great opportunity for our listeners to get a full picture of what's going on with the FCRA. And this is, again, the perfect podcast to talk about that since we'll be talking about the upcoming rulemaking. But before we jump into that, I wanted to make sure that Ron Raether, my co-speaker for today, also has the opportunity to introduce himself.
Dave Gettings:
Look at you co-hosting already transitioning to introducing Ron. That's very nice. Well done.
Ron Raether:
Yeah, I'm just happy that the surprise announcement wasn't something that was unexpected to me. I'm glad, Dave, you didn't throw something new in my desk and my table.
Dave Gettings:
Ron, you're also co-hosting. Congratulations.
Ron Raether:
We'll fit that into the schedule somewhere, Dave. So I'm Ron Raether. I co-lead the Privacy and Cyber Group here at Troutman. I am excited to be able to participate in this podcast, especially on a topic that's near and dear to me, and that's pushing back on the attempts to over-expand the Fair Credit Reporting Act into areas that Congress never intended it to apply. I think that's a fight that I've been embattled in for almost 15 years now, and I think it's going to be an interesting podcast for the audience to hear how that SBREFA process went and Kim's perspective, as well as my perspective on that process.
Chris Willis:
Okay. Well, Ron, welcome to the podcast, and Kim, congratulations on FCRA Focus. Listeners to The Consumer Finance Podcast also know that Kim is a regular participant on our podcast, so I hope she'll still see fit to join us on The Consumer Finance Podcast from time to time.
Dave Gettings:
She signed a non-compete, actually, Chris, when she agreed to co-host. So I don't think that's going to happen anymore.
Chris Willis:
Damn you, Dave. Well, while we're all together, let's talk about what we did come together to talk about, which is the FCRA rulemaking. Just by way of background, on September 21st, the director of the CFPB, Rohit Chopra, and the Vice President Kamala Harris announced this rulemaking effort under the FCRA, and the CFPB quickly got to work and convened a small business review panel, which met over the course of October 2023, and the small business entities that participated in the SBREFA panel had their comments due at the beginning of November 2023.
With that little bit of background, we wanted to get together and talk about what's going on with the FCRA rulemaking, what does the SBREFA process tell us. In other words, what do we know and what do we think is coming next? So, Dave, why don't I let you take over and start going through some of the questions we're going to talk about today?
Dave Gettings:
Yeah, of course. The CFPB press release really focused a lot on the removal of medical debt from credit reports kind of burying the lead. So Ron, would you mind talking a little bit about what the CFPB’s plans are for data brokers who have not generally been regarded as... Well, not generally. Have not been regarded as CRAs? How is the world potentially changing for data brokers, and what have we learned from the SBREFA process?
Ron Raether:
Dave, what I would start with is what did we learn from the SBREFA process. And I would say not much. The CFPB’s approach in this particular instance in terms of disclosure being open and frankly allowing for an honest and constructive dialogue with the SBREFA participants, the SCRs, is quite remarkable to me how little we actually learned from the CFPB as to their intents with respect to, I would say, with all of the topics, but with your question with respect to data brokers and data aggregators especially.
And I think it's remarkable in other respects because the CFPB seems to be blindly following direction from pundits on the consumer side that, to me, are arguing for an over-expansion, an application of the Fair Credit Reporting Act, and they're almost doing so blindly without acknowledging the plain text and the language of the FCRA. What's interesting to me, and we'll talk a little bit more about this later, is courts continue to read the FCRA consistent with its plain language. Recently, the Western District of Washington denied a plaintiff's attempt to amend their complaint.
And Dave, from doing litigation, making a futility argument in the context of a motion to leave is a steep hill for a defendant to climb. But the court in the Western District of Washington denied leave to add to a complaint a data broker, finding that plaintiff had failed to establish overcoming the futility point that that data broker and providing medical information to a consumer reporting agency fell within the definition of consumer report.
I use that as an example to go back to your original question of how remarkable it is that the CFPB didn't attempt to try to tackle that question at all. And I know Kim, who was intimately involved in the SBREFA process and did an amazing job helping shepherd that process on behalf of a number of participants in that process can add even more light in context to my comment.
Kim Phan:
Well, thanks for that, Ron. And it was certainly an interesting but frustrating experience working with the CFPB through this. And while the CFPB prides itself on pursuing UDAP, Unfair Deceptive Acts and Practices, across various industries, I think you could argue that their rulemaking process thus far could potentially be argued as a UDAP. As far as unfairness, they rushed these small businesses into this SBREFA panel process to provide feedback on a very generalized outline. They gave no concrete or specific ideas about what the CFPB's actual plans are.
And keep in mind these are small businesses. These are folks who run their own companies, have a full-time job, can't drop everything and review hundreds of pages of outline, put together concrete numbers on the potential impacts of these rulemakings on them. And one of the questions that was raised during the panel process was, "Hey, CFPB, you really haven't given us a ton to work through. It's only been a couple of weeks for us to digest this. Once you have more concrete proposals to present, will you be calling us back?"
And the CFPB's clear and resounding answer was no. The other potential UDAP I see here in this process is that the CFPB, Dave, as you noted, focused very much on just the medical debt aspect of the rulemaking in their press release and also in comments in subsequent remarks and public statements, which I think is broadly deceptive as to the nature of this rulemaking, which will be a broad-based revamping of the FCRA, which hasn't been substantively amended since the FACTA amendments back in 2003, so over 20 years. And not only are they addressing medical debt. They're changing the interpretation of definitions like what constitutes a consumer reporting agency? What constitutes a consumer report?
They are imposing new obligations on furnishers with regard to disputes, legal disputes, and what they characterize as systemic disputes, as well as new obligations on end users with regard to permissible purpose, revamping entirely what it requires to get the written instructions of a consumer as well as narrowing the scope of the catchall permissible purpose, legitimate business need, which has been around forever. And again, the CFPB has decided they're just going to override 50 years of interpretive guidance from the FTC and case law and just come up with their own interpretations. Again, they're not telling anybody, especially the small businesses, what those exact changes are going to be, but it is clear that they're going to be significant.
Dave Gettings:
Yeah, it's a good point, Kim. In terms of the CliffsNotes version, I think the biggest issues that we see coming down the pike are, one, data brokers and whether the CFPB tries to say that they are consumer reporting agencies. Two, credit header data and whether the CFPB tries to say that it constitutes a consumer report. Three, the potential narrowing or more significant restrictions of permissible purpose and permissible purpose documentation related to written instructions.
And then four. For furnishers, the possibility of purported class actions for, quote, unquote, systematic disputes. The construct of 1681s-2(b) has always been a real barrier to class actions for furnishers, maybe to the CFPBs dismay, but I think that's something furnishers really need to focus on going forward because it could be a significant issue. Ron or Kim, did the SBREFA process provide any insights that we didn't already know from the press releases and from the SBREFA outline, or are we just sort of waiting now on a proposed rule?
Kim Phan:
The challenge, I think, and the frustration that I observed representing some of the small entities through this process was the CFPB, as Ron had already noted, was not what I would consider forthcoming about what their plans are. They were very opaque about what their intentions were with regard to specific changes that they plan to put into the draft rules. However, I think one thing that the small businesses specifically found to be frustrating was the reality that the CFPB essentially said this was a check-the-box exercise on their part. This SBREFA process is required by law for any agency that is planning a major rulemaking that will have significant impact on small businesses.
And while it is required by law, it seemed like the CFPB was not taking it as seriously as they might to understand how these potential changes to the FCRA could impact smaller entities in the marketplace. Certainly, the CFPB has had plenty of fun jumping all over the big three credit bureaus over the last few years since it opened its doors really. But there are many other entities in the consumer reporting marketplace that could potentially be impacted, and considering what material consequences could be to those entities, whether that's market consolidation or exit from the marketplace altogether, that could have potentially negative impacts on consumers that we would've hoped the CFPB would take into consideration, but unclear to what extent they're going to be listening to any of that.
And we will see to what extent they decide to consider these in the draft rules. There will be a SBREFA report that is released in the coming months. The CFPB’s required to release that SBREFA report within 60 days of impaneling the small business panels. So, hopefully, it will show some consideration by the CFPB into the concerns and issues that were raised by the small businesses, but it doesn't seem like there's much hope there. The CFPB seemed pretty set in what they're deciding to do and did not look like they were going to take much into account as far as steering the ship away from where their current course is because of those concerns raised by the small entities.
Dave Gettings:
Kim, one quick follow-up just on the proposed rulemaking, will the CFPB circle back to the small businesses once there's actually a proposed rule, or is this the last we're going to hear from that with respect to small businesses?
Kim Phan:
We asked that question. Are you going to bring back the small businesses once you have draft rules, once you have something more solid for us to assess with regard to potential financial impacts to the smaller entities? And they said no. This was the one bite of the apple for those entities. And while they can submit public comments like everybody else down the road when draft rules are released, they won't have another opportunity to voice those concerns directly with the CFPB in the same kind of small business panel discussion.
Chris Willis:
Thanks for that, Kim. And Ron, I'd like to talk with you now for a minute about potential fallout from the rule if it gets finalized along the lines that's been suggested by the CFPB and the SBREFA outline. You, of course, defend a lot of FCRA litigation, as you referenced when introducing yourself. And a lot of times, in situations where consumers are asserting that someone's a CRA when really they're not. But given the many new compliance obligations that look like they would be imposed if this rule were finalized, do you think we should anticipate an increase in FCRA litigation if and when the rules are finalized and if they survive a legal challenge?
Ron Raether:
Chris, based on my experience, we can anticipate an increase in FCRA litigation regardless of what the CFPB does. There's certainly a sufficient ecosystem already out there of individuals that are willing to bring cases. And I will say regardless of the merit or, frankly, whether it's actually offensive, which kind of brings me back to a couple of points to make. One is my grandfather used to say, "If it ain't broke, why fix it?" And one of the things that the CFPB, I think, has failed to do in the SBREFA process was, I think, the forum in which to have that discussion because it does allow for a discussion, it's just not as a formal process as the rulemaking. But that's what is broke? And I don't think anything is broke. What I will say is that the FCRA is probably one of the oldest privacy statutes out there.
It's based on a lot of core privacy issues. The attempt to try to extend the Fair Credit Reporting Act into unintended spaces could have dramatic consequences. And I think likewise in terms of how we end up dealing with those issues in litigation, should the CFPB pass the expansive rulemaking as suggested in the outline provided during the SBREFA process. If we're going to break the mold, because I think the FCRA is a very well-established 50-year mold of how our society has been dealing with these issues. So if they're going to crack that mold with respect to the definition of consumer report, for example, and expand that now to products that were never intended to be covered by the FCRA. Let me give you an example. Identity verification products. If we're going to crack that mold and say, "Those are now covered by the FCRA," you've got to shatter the mold entirely. And what do I mean by that? The accuracy requirements have to relate to the utility of the product. And to me, a product that is being used to determine is somebody eligible for credit or housing. The utility of that and the accuracy requirements of that have to be different than a product that's being determined whether the person applying is using a synthetic identity to try and game the system or they've stolen somebody else's identity and they're working to harm that individual. And frankly, are client's products designed and built to mitigate against those risks will be shattered if the CFPB extends the definition of consumer report.
So in litigation, we're going to have to adjust, and that's one adjustment that I just mentioned, that courts are going to have to frankly rethink 50 years of jurisprudence as to what the 1681e(b) requirements impose. You can't take a square peg of what's required for determining eligibility for credit and shove it into the round hole of what's required for an identity theft identity prevention product to function adequately in the market. And I'll circle back to why that's relevant to my privacy point is that when you look at what states have done in the privacy realm when they've looked to regulate data broker and data aggregators, they have universally carved out identity theft fraud prevention products from the rights of access, the rights of dispute, the right to delete. The concern for me is the CFPB should be acting responsibly with respect to this ecosystem.
It shouldn't just be parroting what the plaintiff's attorneys have been saying. While I can understand a plaintiff attorney looking at a micro level, I'm just interested in how this affects my particular client. The CFPB should be looking at the macro level. The CFPB should be looking at how its conduct, its rulemaking is going to affect these markets as a whole, not just the individual consumer, but the effect that it's going to have on not just the identity theft and identity prevention markets, but frankly this entire data ecosystem and how I think the industry has already been acting responsibly. Closing again with, "If it ain't broke, why fix it?" And I don't think that question's been answered adequately by the CFPB.
Chris Willis:
Well, and Ron, I mean, I have to say I'm struck by one aspect of your comments, which I agree with, which is, if this rulemaking breaks the mold and dramatically reshapes the FCRA, it doesn't seem like an interpretation of the statute. It seems like re-legislation of the statute that, if it's going to get done, has to be done by Congress.
It seems, at least to my personal way of thinking, this is likely beyond the power of an agency to do. And I think the mood of the current Supreme Court is probably generally in the direction of restricting the ability of agencies to engage in this kind of dramatic change in the interpretation of a statute that's been around for more than 50 years.
Ron Raether:
Yeah. No, I don't disagree, and I think that's going to be important. Although the practical reality is once the CFPB puts this chaotic rule, and I mean, it'll create chaos in the market. If this rule gets passed, it will take time before we get that clarity from the courts, whether the CFPB and the legislative mandate and from an administrative law perspective acted improperly.
And during that time, our clients, the industries, these markets that we've been talking about will be thrown into chaos. And I think that's an irresponsible act. I think it's an irresponsible act to create that level of uncertainty and chaos in the market. Again, where I don't think there's been a clear explanation as to what is broken and what needs to be fixed other than maybe the CFPB is frustrated that Congress hasn't passed a federal privacy statute. But this rulemaking is not the means by which to address that issue. And I agree wholeheartedly with you, Chris, on that point.
Chris Willis:
Kim, you'd made some comments earlier in the episode about the fact that the SBREFA process is unusual in the sense that seemed to have been rushed forward with not much opportunity for the small business panel members to provide real input into whatever the CFPB is eventually going to propose, and they're not going to redo the process once they actually decide more the direction that they're taking. It sort of makes me want to ask a more general question. Does this rulemaking in the timeline that we know about it seem rushed compared to other comparable CFPB rulemakings?
Kim Phan:
That's probably one of the most shocking aspects of what the CFPB is planning here. The CFPB, I think we all know, has not been shy about asserting their authority in various places. But they have had a very deliberative process when they have been undertaking major rulemakings. For example, when they issued Regulation F on the FDCPA rulemakings, that took them seven years, and the recent open banking rules under Section 1033, the draft rules that they recently released as well. That was also a process that started in 2016, and now we're only seeing the draft rules now seven years later.
The fact that the CFPB, as announced by Chopra, their timeline is to not only announce this rulemaking, get through the SBREFA process and then introduce draft rules within one year. They want to have these draft rules out by next summer in advance of the 2024 elections. That is incredibly fast.
And as Ron was noting, is potentially not taking into consideration some of the many potential downstream and unintended consequences that could spiral out from this rulemaking. So it just seems incredibly rushed. Maybe that's because of the election timeline. Maybe that's because of other factors happening at the Bureau with the Director Chopra, but it just seems unusual how rapidly they're trying to roll out what will be a major undertaking.
Chris Willis:
Well, let's just wrap up by letting me ask you, what are the next steps in the process for the rulemaking? You mentioned the accelerated timeline, but what do we think are the next steps in the rough timeframe on which we would expect them to occur?
Kim Phan:
So they've already announced that they want to have the draft rules out by mid-year 2024. That is the first step likely in either an advanced notice of proposed rulemaking process or an actual notice of proposed rulemaking with draft rules. They, as an agency, could move rapidly. They could accept public comments and then finalize the rule quickly, but that's probably unlikely.
They will be almost certain to receive hundreds if not thousands of comments from the public on this particular rulemaking, which could delay the finalization of the rules until 2025, maybe even later. So the soonest we could ever expect something that would have an effective date would be probably 2026. So we're still a few years out. But this is important enough that for those companies that will be impacted by this rulemaking, they should be thinking about how to get involved early in the process rather than trying to change the CFPB’s course further along.
Chris Willis:
Okay. Well, thanks, Kim, and thanks to you too, Ron, for sharing your comments and expertise on this rule and what its potential effects are. Dave, do you have any parting comments before we close out?
Dave Gettings:
No, the only thing I would just echo is Kim's thought about clients starting to think now. It may be a little too early to start implementing compliance changes because we really don't know what the rule is going to look like yet, but we should at least be thinking about implementing compliance changes or our process for how we would go about that process, including when necessary, educating our boards, educating decision makers on the significant changes that may be coming down the pike.
Chris Willis:
That's a great point to end on, Dave. So thanks very much. Thanks for letting me do this crossover episode with you for both Consumer Finance Podcast and FCRA Focus. And thanks, of course, again to Kim and Ron for sharing their expertise. And, of course, thanks to our audience for listening today. Don't forget to visit and subscribe to our blogs, ConsumerFinancialServicesLawMonitor.com and TroutmanPepperFinancialServices.com. And while you're at it, why don't you head over to Troutman.com and add yourself to our Consumer Financial Services email list.
That way, you can get copies of the alerts that we send out and invitations to our industry-only webinars. And if you enjoy reading and listening to our thought leadership content, don't forget to check out our mobile app, where you can find all of it in one easy-to-access package. It's under each app store, both iOS and Android, under Troutman Pepper, and I know you'll enjoy it if you try it out. Of course, stay tuned next week for a great new episode of The Consumer Finance Podcast on this same podcast feed. Thank you all for listening.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.