With Four New Opinions, the CFPB Strengthens Legal Protections for Consumers under the FCRA

With the issuance of four recent advisory opinions, the Consumer Financial Protection Bureau (CFPB) signaled its continued commitment to protecting consumer interests in the for-profit data industry, making it easier for consumers to hold consumer reporting agencies (CRA) accountable under the Fair Credit Reporting Act (FCRA) for egregious reporting errors. 

With available statistics estimating that one-third of Americans are impacted by reporting errors, this clarification from the CFPB directly benefits a large segment of the consumer population, adding wind to the sails of lawsuits aimed at holding consumer reporting agencies accountable. In other words, for certain lawsuits, it just got even easier for courts to find that a CRA failed to meet its legal obligations to prevent certain reporting mistakes.

What is the CFPB, and why do these opinions matter? 

The CFPB is an independent agency of the federal government that “implements and enforces federal consumer financial law” and looks out for consumers' best interests regarding commercial practices that directly impact them. One of the ways that the CFPB plays a consistent role in protecting consumers is through the issuance of advisory opinions that clarify different aspects of consumer law. 

For instance, each new advisory opinion discussed below clarifies some aspect of the legal rights, obligations, or standards established under the Fair Credit Reporting Act (FCRA). When consumers pursue justice against consumer reporting agencies (CRAs) for problematic reporting practices, courts can use these CFPB advisory opinions to analyze whether a particular CRA violated the FCRA through its reporting practices. 

In real terms, this means that in certain circumstances, when people bring lawsuits against companies for causing them financial and emotional harm by reporting false information about them, there is now more legal support for establishing that the CRA violated the law. The easier it is to establish an FCRA violation, the easier it is to hold a company accountable, and the easier it is to get error corrections and compensation.

What is the FCRA and a Consumer Report? 

The Fair Credit Reporting Act (FCRA) is one of several key federal laws that protect consumers whose data and finances are directly impacted by companies operating in both the brick-and-mortar world (storefronts in buildings) and the world of online commerce (or e-commerce). The FCRA covers the breadth of practices associated with buying and selling consumer data and packaging it as a consumer report, such as a credit report, background check report, tenant screening report, etc. 

Under the FCRA, the companies that generate these reports are called Consumer Reporting Agencies (CRAs). They gather data by purchasing it from companies that deal directly with consumers (such as banks, credit card companies, service providers, and loan financers) and third-party companies that scour public records and sell the resulting data to CRAs for use in a consumer report.

What do the New Advisory Opinions State? 

The new CFPB advisory opinions address several data reporting issues, including those that arise specifically in background screening reports and those that occur across all consumer reports, generally. 

It is helpful to know that under the FCRA, the legal standard governing consumer data reporting says that CRAs must “use reasonable procedures to assure maximum possible accuracy.” The FCRA also gives consumers the specific right to have only accurate information included in their consumer reports. Together, this places a legal burden on CRAs to not only report accurate information but also to have specific procedures in place to ensure that only accurate information gets reported. In other words, saying “oops” after the fact and attempting to correct an error is not enough. The CRA must have built-in safeguards to prevent mistakes in the first place.

Most of the lawsuits brought under the FCRA arise from a routine failure of CRAs to meet this basic standard. In addition, and likely not surprisingly, the presence of inaccurate, misleading, or false information in consumer reports is an understandably huge problem.

Background Screenings

CRAs Can’t Report What Shouldn’t Be Reported.

CRAs that gather, review, and compile consumer data for background screenings (such as an employment-related background check) must have procedures that ensure the report does not include information that is duplicative, “expunged, sealed, or otherwise legally restricted from public access.”

This is a refinement and clarification of the existing standard. Not only must CRAs have a procedure to ensure accuracy, but now the procedure must specifically ensure that no duplicative information or information that is, by law, not meant to be in the public domain is reported. 

Much of this is most relevant in the context of reporting criminal history. For instance, relatively common reporting errors include the reporting of the same criminal offense more than once (giving the impression of multiple charges) and the reporting of criminal information that was never meant to be reportable in the first place (such as a crime that was expunged, which means removed from someone’s record by the court).

CRAs Must Report What Should be Reported.

CRAs must include “existing disposition information if it reports arrests, criminal charges, eviction proceedings, or other court filings.” In other words, if a background screening includes reportable events like arrests, convictions, and evictions, it must also report the final outcome of those events. 

This clarification responds directly to a persistent reporting error in which CRAs include potentially disqualifying information, such as an arrest, without including critical information about what happened next. 

For instance, if someone is arrested for driving under the influence, the charges may be subsequently dropped, and no further action taken. Without reporting the additional information about the charge being dropped, an employer could easily (and likely would) assume that the person was charged and convicted. 

Notably, a new clarification on reporting periods, discussed below, has implications for this requirement.

CRAs Must Know When the Clock Starts and Stops for Reporting Periods.

The new CFPB advisory opinion clarifies a few points arising from time-bound reporting restrictions. For context, CRAs are bound by certain restrictions on whether something is, in fact, reportable. Reporting periods for different types of information may differ under relevant state and federal law.

The new opinion states that when CRAs include “adverse event reporting” in a background screening (i.e., something that will likely be held against the consumer), the clock starts on the date the event occurred, the clock is not restarted because of a subsequent action arising from the same event, and if the event in question is a criminal charge, “a non-conviction disposition” cannot be reported once the clock has run. 

What does this mean in the real world? Here’s an example: If you were arrested for a crime on January 1, 2014, and there is a seven-year reporting window for criminal events, then the reporting clock runs starts on January 1, 2014, and expires on January 1, 2021. The reporting period is not restarted or pro-longed because additional information later becomes available. 

In other words, no matter what else happens with respect to this crime and the legal system, only those events that take place between January 1, 2014, and January 1, 2021, are reportable. This might include being charged, convicted, sentenced, serving jail time, being released from jail, being sentenced to probation, being released from probation, etc. If any of these events occur after January 1, 2021, they are not reportable because the seven-year window from when the reporting clock started has expired. 

The only exception is for convictions arising out of that original event. If it takes longer than seven years to convict you, the conviction is reportable at the time that it is entered against you. But, if it takes longer than seven years to dismiss the case against you, that is NOT reportable.

This is significant because reporting windows (aka look-back periods) limit how long an adverse event can haunt someone. Despite specified reporting periods, CRAs have been carelessly reporting every action arising from a single event, which has resulted in the absurd outcome that the reporting clock seemingly never stops running. 

With this clarification, the CFPB has set the standard for when the clock starts, when it stops, and what the single exception to this rule is. 

All Consumer Reports

CRAs Must Provide Consumer Files Without Hassle.

Under the FCRA, a consumer's request for their file from a CRA triggers an obligation by that CRA to provide the consumer with a copy of the information. However, CRAs frequently withhold information under the pretext that the consumer did not request the information in the right way to trigger the CRA’s legal obligation to provide the complete file. 

With the new advisory opinion, the CFPB makes clear that a CRA’s obligation to provide consumers with all of the information that they are legally obligated to provide (there are a few exceptions) is triggered by the consumer’s request for their information, regardless of the specific words the consumer uses to make the request.

The CFPB states that CRAs can no longer avoid performing this obligation by saying the consumer failed to trigger it because they didn’t ask for their “complete file” or “file,” and instead asked for their record, documents, information, or some other iteration of the same idea.

CRAs Must Disclose All Sources Through Which Information Traveled.

In a further clarification of the above, the CFPB advises that the CRAs’ obligation to provide consumers their file upon request includes the “identification of each person…that produced a consumer report.” 

For instance, a CRA may purchase court records from a third-party company (not affiliated with the consumer in any way) that bought the data from another third-party company that obtained the data from a public source. Before this clarification, only the court from which the records originated might be revealed as the “source” of the information without identifying the two companies that bought and sold the data along the way.

Now, the CFPB makes clear that a consumer’s file “must disclose to a consumer both the original source and any intermediary source (or sources) that provided the item of information” to the CRA.

CRAs Must Proactively Prevent Reporting Obviously Wrong Information.

As discussed above, under the FCRA, CRAs are legally obligated to “use reasonable procedures to assure maximum possible accuracy.” The CFPB now advises that CRAs must “implement reasonable internal controls to prevent the inclusion of facially false data, including logically inconsistent information.” 

In other words, CRAs must take a proactive approach to prevent obviously false or illogical information from being reported. They must implement actual review protocols to filter and remove this type of data from a consumer’s report prior to publishing the report. This is significant because it requires CRAs to actively and intentionally take steps to eliminate these errors upfront as part of a process improvement measure rather than simply responding to or correcting them after the fact.

CRAs Must Properly Investigate Consumer Disputes.

Not only does the law require CRAs to report accurate information, but it also requires CRAs to investigate consumer disputes. With a new clarification aimed at CRAs and “data furnishers” (the companies that provide data to CRAs), the CFPB emphasizes that “shoddy investigation practices” are not permissible.

Specifically, when a consumer disputes information in their report, the CRA that produced it must notify the data furnisher that provided the disputed information within five business days and must pass along any information and supporting documentation provided by the consumer. 

In addition, both CRAs and data furnishers must adequately investigate indirect disputes (ones that they are informed of by parties other than the consumer) and disputes filed by consumers who don’t adhere to the specific dispute protocol preferred by the CRA or data furnisher. 

What does all of this actually mean? CRAs and data furnishers can’t play games by pretending that their investigatory obligations aren’t triggered because a consumer didn’t notify them directly, didn’t file a dispute in the right way, or had an obligation to inform other implicated parties. If a CRA or data furnisher learns of a dispute, it must inform any downstream data providers within five days and must properly investigate. 

Our Take on This News

With these advisory opinions, the CFPB is taking a much-needed stand for consumers, and we welcome and applaud the action.

We believe the FCRA has always been clear about the legal rights and obligations regulating the consumer reporting industry. Each of the items addressed in these CFPB advisory opinions marks a clarification that was needed solely because CRAs have a long-standing pattern of looking for ways to thwart, dismiss, avoid, and otherwise deflect their obligations under the law. 

The number of lawsuits filed against CRAs for reporting obviously unreportable, inaccurate, misleading, illogical, and facially false information is a testament to the systemic, industry-wide failure to meet the FCRA’s basic legal burden of accuracy in reporting. For the CFPB to essentially call out CRAs for this failure and point to the mechanisms for improvement, like internal controls (i.e., proper review protocols), is a welcome and necessary step in the right direction. 

As consumer protection lawyers in practice for a combined seventy-five years and counting, we can attest to the fact that these types of reporting “errors” are so-called in name only. The word error implies a mistake, whereas these reporting problems are less about mistakes and more about the continued and intentional unwillingness of CRAs to prevent them in the first place.

These persistent consumer reporting problems result from a corporate cost-benefit calculation that sees battling individual consumer lawsuits as more cost-effective than plugging holes in the system itself. In other words, without CFPB intervention, CRAs would rather keep fighting FCRA enforcement one consumer at a time than fix the problems internally.

In addition, we understand that shoddy dispute investigation practices have historically been used by CRAs and data furnishers as a smoke screen against real process improvements. Ineffective investigations create a perpetual loop of self-confirmation that allows CRAs and data furnishers to claim due diligence when, in fact, they practiced strategic avoidance of their real obligations. 

By highlighting these issues, clarifying key information, and pin-pointing specific practices, the CFPB is attempting to close some of the more egregious holes created and exploited by CRAs in their ultimate quest to maximize profit at the cost of causing truly detrimental financial and emotional harm to consumers.

Whether these advisory opinions result in systemic improvements in the consumer reporting industry is yet to be seen. Ultimately, this will depend on whether or how these opinions buoy consumer lawsuits against the CRAs. If a notable financial impact is felt by the CRAs through improved consumer legal outcomes, particularly with compensatory damages, there is hope for a wave of genuine process improvement to sweep the industry. 

For now, we will use these opinions to shape and guide ongoing and future litigation, improve consumer outcomes, and hold CRAs accountable for their harmful failures.

The Role of the Consumer Protection Lawyer

Consumer protection lawyers focus their practice on areas of the law in which exploitation and unfairness are woven into the fabric of systemic problems. Though we don’t work for the government, our efforts in protecting consumers are integral to the healthy functioning of our consumer economy. 

Our role is so foundational to regulatory enforcement that the FCRA includes provisions giving consumers the right to bring lawsuits against CRAs and other industry players. And, if the lawsuit is successful, the FCRA requires those companies to pay for the legal expenses that consumers would otherwise incur in fighting these data reporting battles. This means that consumer protection lawyers and the lawsuits we file are an integrated and essential part of the process of accountability and justice that is required to protect consumer rights. 

Consumer Attorneys

As consumer protection attorneys and members of the National Consumer Law Center and the National Association of Consumer Advocates, the lawyers on our team at Consumer Attorneys are not just litigators; we are also advocates. Striving for greater legal protections for consumers is one of our highest goals. 

We have helped thousands of consumers recover from the burdensome and overwhelming toll of data reporting errors, including those addressed in the CFPB advisory opinions discussed above. And we can help you, too. 

Bring us your consumer reporting problem, and we’ll bring you a legal solution. From coast to coast, we’re right where you need us to be.

There are several ways to reach us: call (+1-877-615-1725), email ([email protected]), fill out our online intake form, or LIVE CHAT with a consultant. Our consultations are always free, and the FCRA makes the corporations pay for your legal representation if we sue them and win. If we don’t win, we don’t get paid.