CFPB Eyes Broad Expansion of Federal Credit Reporting Standards

The Consumer Financial Protection Bureau is gearing up for a major rewrite of credit reporting rules that would sweep in additional companies and set new standards for data security and investigations of disputes.

The CFPB and the White House floated a potential ban on the use of medical debt in consumers’ credit reports as part of a proposal unveiled Sept. 21 to rewrite the rules for implementing the 1970 Fair Credit Reporting Act.

But the outline, submitted to a review panel of small business representatives, goes much further than the medical debt prohibition. The plan—if embodied in a formal rule that survives potential court challenges—will reshape the credit reporting industry, attorneys for credit reporting firms and consumer advocates say.

“This proposed rulemaking, if it proceeds as outlined, will have a dramatic effect across the board for all businesses involved in the consumer data ecosystem,” law firm Troutman Pepper Hamilton Sanders LLP said in a client note.

Increased Coverage

In August, the agency said it planned to bring data brokers that aren’t currently covered by the FCRA under the law in a bid to limit their ability to feed data to artificial intelligence developers and marketers. It detailed an approach that potentially would encompass data brokers and aggregators that aren’t currently covered.

Some data brokers and aggregators are considered credit reporting companies and are already covered by the law.

The agency has already signaled concerns shared by privacy advocates about the use of “credit header data,” such as a person’s name and address, for identity verification. The new outline shows the CFPB may treat that information as covered data under the credit reporting law, potentially limiting when brokers can sell it for use by lenders, law enforcement, and other entities.

Expanding Liability

The CFPB is also looking to require credit reporting companies, including the three industry giants—Experian Plc, Equifax Inc., and TransUnion—to protect consumer data from breaches and make significant changes to the way they handle disputes.

Those companies would have to investigate whether consumer complaints about incorrect data or other credit reporting problems are common enough to be a systemic issue, and notify affected people, under the agency’s proposal. Alternatively, the companies could be forced to allow consumers to file complaints of systemic problems on behalf of others.

Another change under consideration would affect how credit reporting companies deal with legal disputes. While the FCRA doesn’t distinguish between legal and factual disputes on credit reports, a series of court decisions has created that distinction, allowing the agencies to avoid dealing with disputes considered legal in nature.

The bifurcation has created a “monster” that in many instances can swallow consumer protections, said Chi Chi Wu, an attorney with the National Consumer Law Center.

“The courts are saying identity theft is a legal question and the credit bureaus don’t have an obligation to investigate it,” she said.

Changes to dispute processing, should they come into effect, will “certainly open up” credit reporting companies to class actions, said Joann Needleman, the head of Clark Hill PLC’s financial services and regulatory compliance practice.

The CFPB in its outline focused only on changes it says would affect small businesses. That leaves room for even bigger changes that would apply mainly to the three largest companies.

“I don’t know if this is the end of it or not. I certainly hope not,” Wu said.

Courting Uncertainty

The changes the CFPB wants to see to credit reporting rules won’t be finished for some time. The CFPB will begin working on a full proposal only after receiving a report from the small business review panel, and it expects to release a proposed rule next year.

But many of the changes contemplated by the CFPB represent significant expansions of both the FCRA and the agency’s authority.

“We have concerns that some of the proposals may push the limits of the Bureau’s authority under federal law,” Dan Smith, the president and CEO of the Consumer Data Industry Association, which represents consumer credit reporting companies, said in a Sept. 21 statement.

Among the changes that could face the biggest fights are the extension of credit reporting rules to currently uncovered data brokers and the move to eliminate medical debt from credit reports, Needleman said.

“The FCRA doesn’t speak about data brokers,” she said.

The CFPB and its supporters contend that the credit reporting law’s language is broad enough to ensure the coming rules are legal.

But a recent string of CFPB losses in federal courts in Texas and the US Court of Appeals for the Fifth Circuit would put any potential rulemaking on shaky ground.

“Of course the CFPB could run into trouble with legal authority because somebody will sue them in Texas,” Wu said.