Broadening Definition of Data Subject to FCRA Not just credit report, - - PowerPoint PPT Presentation

A Worsening FCRA Environment: A Checklist for Getting

The Consumer and Employee Information You Need

March 18, 2014 Michael O’Neil, Chicago Travis Nelson, Princeton Mark Melodia, Princeton

Not just “credit report,” but “consumer report”

• Definition of the data regulated by FCRA is broad

15 U.S.C.1681a(d)(1)

• Oral, written or other communication of information delivered by a “consumer

reporting agency” (circular definition, because “consumer report” defined as data delivered by CRA)

• Bearing on a person’s credit worthiness, character, personal characteristics or

mode of living

• “Which is used or expected to be used, or collected in whole or in part for the

purpose of serving as a factor in eligibility” for credit, insurance, employment or

• ther “permissible purpose”
• Any info originally collected by a CRA for these purposes is subject

to FCRA, even if not used for such a purpose

• Using information for an eligibility decision may give rise to

application of FCRA

Broadening Definition of Data Subject to FCRA

2

• What are sources of data?
• Is it a data broker?
• Is it a CRA?
• Do other clients of data source ever use data for eligibility decisions?
• What are contractual restrictions on use of data? Basis for

restrictions?

• If user intends to use the data to make a decision on the consumer’s

eligibility for credit, insurance, employment, what are restrictions?

• Note: even if data not sole basis for eligibility decision, if used “in whole or in

part,” it may be FCRA data

• How does vendor market data (e.g., is it described as useful for

eligibility decisions?)

• If so marketed, data is “expected to be used” for eligibility decision, and may be

subject to FCRA

Questions for Vendors

3

Regulatory Examinations & Enforcement

4

“Credit reporting companies exert great influence over the lives of

• consumers. They help determine eligibility for loans, housing,

and sometimes jobs. Consumers need an avenue of recourse when they feel they have been wronged.” – Richard Cordray, Director, CFPB

• Scope of enforcement authority
• Covered persons; service providers; related parties
• Organizational issues – “Supervision, Enforcement & Fair Lending

Division”

• Sub-units can operate independently
• Enforcement by civil or administrative action
• Pros and cons of civil enforcement action
• Interagency cooperation – and information sharing
• Prudential regulators (OCC, FDIC, Fed)
• Federal Trade Commission
• State attorneys general

Overview of CFPB Authority

5

• July 21, 2011: FCRA rulemaking and enforcement transfers to the

CFPB

• Providers of consumer financial products and services
• April 13, 2012: CFPB issues guidance on service providers/vendors
• July 16, 2012: CFPB designates CRAs with more than $7 million in

annual receipts as “larger participants” – effective Sept. 30, 2012

• Extends CFPB jurisdiction to 30 companies accounting for 94 percent of the CRA

market

• Oct. 31, 2012: CFPB issues Supervision & Examination Manual –

including nearly 100 pages dedicated to FCRA examination protocols and commentary

Key Events in Build-up to CFPB FCRA Enforcement

6

• June 25, 2013: CFPB issues Bulletin 2013-06 on “enforcement

expectations

• Factors CFPB considers in determining whether to bring an enforcement

action

• CFPB’s indicia of “responsible business conduct”
• Aug. 9, 2013: CFPB Deputy Enforcement Director gives preview of

FCRA enforcement posture

• Consumer’s right to dispute consumer report is “truly fundamental”
• CFPB will supervise and regulate “the entire ecosystem” of credit reporting
• CFPB will examine and pursue service providers/vendors
• Sept. 4, 2013: CFPB issues Bulletin 2013-09 on FCRA supervisory

expectations of “furnishers” of consumer report information

• Jan. 8, 2014: Richard Cordray says in “The Daily Show” interview

that the CFPB will pursue senior executives as corporations for fines, suspensions from the industry, and criminal referrals

• “CRAs need to fix these problems and be more responsive”

Key Events in Build-up to CFPB FCRA Enforcement (cont.)

7

Regulators’ Focus on Third-Party Relationships/Vendors

• Guidance on third-party relationships
• Pre-contracting due diligence
• Essential elements of the contract
• Post-contracting on-going monitoring

8

CFPB Enforcement Powers and Actions

• CFPB formal enforcement actions can be done jointly with prudential

regulators

• Enforcement tools:
• Injunctive relief
• Civil money penalties
• $5,000/day for violations, regardless of fault
• $25,000/day for reckless violations
• Up to $1 million/day for “knowing” violations
• Representative enforcement remedies
• Prior CFPB enforcement actions
• July 2012: CFPB/OCC; $150 million in restitution; $70 million in fines
• Sept. 2012: CFPB/FDIC; $200 million in restitution; $14 million in fines
• Oct. 2012: CFPB/FDIC; $85 million in restitution; $27.5 million in fines
• Sept. 2013: CFPB/OCC; $309 million in restitution; $80 million in fines
• Dec. 2013: CFPB/FDIC/OCC; $60 million in restitution; $16.2 million in fines

9

Dealing with CFPB Examinations

• Have well-developed policies and procedures
• Including vendor management policies
• Beware of books and records violations
• Designate a central point of contact to coordinate examination

matters and deliver requested information – the “Examination Manager”

• Make sure that the examiners’ requests are promptly met
• Have a plan for responding to requests for privileged material
• Consult outside regulatory counsel
• Clearly document minutes of exit meetings and forward to

regulatory counsel

10

What to do and not do when the gov’t comes calling!

• Know the rules: Must be

familiar with the examination policies and informal guidance

• f the regulators
• Involve counsel

immediately: Comments in exit interview or supervisory

• correspondence. Protection of

privilege and document control.

• Review comparable

enforcement actions: What remedies have the regulators sought in the past? Consider corrective action.

• Do not overreact:

Sometimes more regulators/ enforcement counsel are brought than are necessary – Shock and Awe!

• Know the players: Learn

the relative authority and roles

• f the supervisory staff.

Partner with local examiners to avoid escalation.

• The examiners do not

just “go away” – remember their unique role

11

Surviving a CFPB Investigation/Enforcement Action

“Perfect storm” of several phenomena gives rise to increased FCRA class litigation

• Generous remedies available under the FCRA
• Statute allows lawsuit for violation of ANY provision of the broad statute
• Statute allows for recovery of statutory damages of $100 - $1,000 (in lieu of

“actual damages”) and punitive damages

• Statutory damages are awardable even if the consumer did not suffer any

damages as result of willful violation

• U.S. Supreme Court decision in 2007 (Safeco Insurance v. Burr)

lowered standard for “willfulness” to “recklessness,” i.e., something more than negligence but less than knowing

• Therefore, for example, proof that a business practice was brought into

question by an FTC staff opinion letter or court may establish “willfulness”

• Constitutional “standing” requirement that federal court plaintiff must

have suffered harm met by allegation that statute violated

• Spokeo; SCOTUS in Edwards v. First American ducked issue of whether

Congress can manufacture constitutional standing by reversing decision to take case after briefing

Explosion of FCRA Class Litigation

12

• FCRA claims are ripe for class treatment under existing caselaw
• FCRA class claims often challenge the standardized business practices that treat

a group of consumers similarly (e.g., obtaining same data on all credit applicants

• r employees). Therefore, there is a common nucleus of facts.
• No individualized issues in establishing that each class member was harmed

(since no statutory harm requirement)

• No individualized issues in determining each class member’s “damages”

(because statute sets range of damages that, in theory, can be applied across the class)

• Courts have reversed prior caselaw, and now refuse to consider the annihilating

effect of a class-wide statutory damages claim, regardless of the obvious constitutional problems with such awards in the face of technical violations of the law that cause no harm. E.g., Bateman v. American Multi-Cinema, 623 F. 3d 708 (9th Cir. 2010) (FACTA case for including more than last 5 digits of account number on credit receipt; 290,000 receipts could lead to $290 million award; Murray v. GMAC, 434 F. 3d 948 (7th Cir. 2006) (court should deal with due process issue post-trial)).

• Unlike other federal consumer protection statutes (e.g., FDCPA), there is no cap
• n class award (e.g., $500,000 or 1 percent of defendant’s net worth) in FCRA

Explosion of FCRA Class Litigation (cont.)

13

Questions

Michael O’Neil

Partner Chicago michael.oneil@reedsmith.com +1 312 207 2879

Travis P. Nelson

Counsel Princeton tnelson@reedsmith.com +1 609 524 2038

Mark S. Melodia

Partner Princeton mmelodia@reedsmith.com +1 609 520 6015

14