Published in Law360 on January 9, 2024. © Copyright 2024, Portfolio Media, Inc., publisher of Law360. Reprinted here with permission.

The legal landscape of consumer reporting continues to evolve with courts, federal regulators and state legislatures all playing roles in shaping this area of the law.

There also are large-scale changes on the horizon in consumer reporting, driven largely by proposed regulations the Consumer Financial Protection Bureau intends to unveil in 2024.

In this article, we provide a brief overview of major events from 2023 in the consumer reporting ecosystem and the impact on its major players, including data brokers and aggregators, furnishers, users, and consumer reporting agencies.

Litigation Trends

The past year has seen a slight decrease in Fair Credit Reporting Act litigation. According to WebRecon LLC, between January and October 2023, FCRA case filings decreased by 2.1% compared to the same time frame in 2022.

Notwithstanding that slight reduction, the total number of FCRA cases still totaled more than 4,500. And compared to other types of consumer litigation, such as the Fair Debt Collection Practices Act, which saw a more than 13% decrease in lawsuits year over year, the FCRA litigation shows no meaningful signs of slowing down.

CFPB Proposed Rulemaking in 2024 for Possible Implementation of Final Rule in 2025

On Sept. 21, 2023, the CFPB released an outline of its FCRA rulemaking plans. The CFPB sets out an expansive agenda that will have major impacts on all aspects of the consumer reporting ecosystem.

First, entities known as data brokers and data aggregators may become regulated as consumer reporting agencies. These entities are not defined under the FCRA and have not historically been considered consumer reporting agencies.

For example, the CFPB states that it intends to apply the FCRA where information is used for any permissible purpose, regardless of whether a data broker knew that the information would be used or intended to be used for that purpose.

Second, consumer reporting agencies may face new limitations and duties under the proposed regulations. The CFPB seeks to reclassify "credit header data" as regulated consumer report information that can only be used for FCRA permissible purposes.

The proposed regulations would create a new duty "to protect" consumer reports from a data breach or data security incident, which the CFPB characterizes as a disclosure without a permissible purpose.

Third, the CFPB is contemplating imposing specific requirements for obtaining a consumer's written instructions to access a consumer report, as well as limit the ability of end users to rely on the FCRA "legitimate business need" permissible purpose to access a consumer report.

Fourth, the CFPB wants to amend the dispute process to require consumer reporting agencies and furnishers to conduct investigations into legal disputes and systemic disputes.

Fifth, the CFPB proposes to exclude any reporting on, or use of, medical debt collection information in consumer reports.

Draft rules are expected in 2024, although a final rule is unlikely before 2025. Based on the sweeping changes proposed to expand the reach of the FCRA, including some that contradict the plain language of the FCRA, the CFPB's proposed rules will likely face significant legal challenges.

Meanwhile, the states are not waiting. Colorado and New York have passed laws prohibiting credit reporting of medical debts.

Furnishers

Federal circuit courts and the CFPB placed continued scrutiny on the activities of furnishers in 2023.

In Aargon Agency Inc. v. Sandy O'Laughlin, the U.S. Court of Appeals for the Ninth Circuit upheld a Nevada law in June that imposes a 60-day waiting period on debt collectors before the debt collectors could take "any action to collect such debt," which includes furnishing information about the debt to consumer reporting agencies.

In doing so, the Ninth Circuit rejected challenges to the law premised on First Amendment and FCRA preemption arguments.[1]

In Frazier v. Dovenmuehle Mortgage Inc., the U.S. Court of Appeals for the Seventh Circuit held in July that the completeness or accuracy of an e-OSCAR Automated Credit Dispute Verification response is determined by the information provided in that ACDV response.

To the extent that a consumer reporting agency may incorrectly interpret information provided in that response, the CRA's interpretation would not impose liability on the furnisher.[2]

In contrast to this layer of insulation established between furnishers and consumer reporting agencies in Frazier, the U.S. Court of Appeals for the Third Circuit in October expanded furnisher responsibility in Ingram v. Experian Information Solutions Inc., holding that furnishers have a duty to conduct some measure of investigation into all indirect disputes and cannot meet their obligation to investigate by asserting that a dispute is frivolous.[3]

On the regulatory side, the CFPB entered into a consent order[4] with Phoenix Financial Services LLC in June due to alleged failures in its processes for verifying disputes of medical debt and in investigating the accuracy of its reporting.

In particular, the CFPB alleged that Phoenix neither had nor obtained documentation to support the purported debts it was attempting to collect. The CFPB further asserted that Phoenix employed so few investigators that each would spend less than 30 seconds on average investigating a dispute.

Consumer Reporting Agencies and Investigation of Legal Disputes

The debate over whether consumer reporting agencies may be held liable under the FCRA for alleged reporting of inaccuracies based on legal questions continues to be unresolved among federal circuit courts.

This year, the U.S. Court of Appeals for the Second Circuit held in two cases that consumer reporting agencies are not liable for inaccuracies that turn on unsettled legal questions but stopped short of holding that there is a bright-line rule that no legal questions are actionable under the FCRA. Instead, the court focused the inquiry on whether the alleged inaccuracy involves "objectively and readily verifiable information."[5]

It is notable that the Second Circuit rejected any notion of a legal versus factual threshold determination under the FCRA, requiring the reinvestigation of all forms of disputes. That is also the position the CFPB has taken in its publications, as well as in amicus briefs submitted across the country.

A nascent circuit split is brewing on this issue nevertheless. Indeed, in August, the Seventh Circuit in Chaitoff v. Experian Information Solutions Inc. did not question whether there may be a threshold legal or factual distinction.[6]

The circuit court instead rejected the U.S. District Court for the Northern District of Illinois' conclusion that the plaintiff's claim failed because it relied on a legal dispute, finding instead that the dispute was factual in nature.

In doing so, the court compared other Seventh Circuit cases that sharpened the distinction between legal and factual questions and noted that consumer reporting agencies "are not liable for reporting information that may be legally inaccurate."

This issue also continues to percolate in federal district courts, and we expect to see more litigation on this question in the coming year.[7] As noted above, the CFPB is considering a rule that would resolve the disagreement among courts by making it clear that consumer reporting agencies and furnishers have a duty to investigate even legal disputes.

End Users — Standing Issues Take Center Stage in 2023

Courts continued to grapple with issues of standing for claims involving end users' use of background check reports.

In Gray v. Nachurs Alpine Solutions LLC, the U.S. District Court for the Northern District of Ohio opined in April that standing could exist when a procedural violation occurs and there is inaccurate information on the plaintiff's report that causes the plaintiff to suffer an adverse employment action.

The plaintiff in Gray, however, was unable to demonstrate standing because the information in the background check report was accurate and disqualified the plaintiff from the employment opportunity.[8]

In contrast, in Messina v. S&A Solutions Inc., the U.S. District Court for the Eastern District of Michigan held in September that standing could exist when a procedural violation occurs even if the information contained in the report was accurate.

In Messina, the plaintiff established standing because the information in the background check report, while accurate, did not automatically disqualify the individual for the employment opportunity, but the individual was not provided a copy of the report or an opportunity to address the information before being denied the job in question.[9]

In Reed v. United States Postal Service, the U.S. District Court for the Northern District of Indiana ruled in May that supplying a copy of a criminal background report without additional information satisfies the FCRA's pre-adverse action requirement.[10]

Sovereign Immunity for Government Agencies

In another notable development, the U.S. Supreme Court granted a petition for a writ of certiorari submitted by the U.S. Department of Agriculture in Department of Agriculture Rural Development Rural Housing Service v. Kirtz, where it will likely settle the circuit split over whether the FCRA operates as a waiver of sovereign immunity that allows lawsuits against federal government agencies.[11]

The U.S. Courts of Appeals for the D.C., Third and Seventh Circuits have allowed FCRA litigation against the government, but the Fourth and Ninth Circuits have taken the opposite position, ruling that sovereign immunity is not waived by the FCRA. The Supreme Court's analysis and ultimate decision is forthcoming in 2024.

Conclusion

While there may have been a slight downtick in the overall volume of FCRA litigation in 2023, that did not equate to any slowdown in the continued evolution of consumer reporting law.

With the developments in the past year, particularly the outline for the CFPB's proposed regulatory actions, 2024 is set to be a watershed year for consumer reporting.

[1] Aargon Agency Inc. v. Sandy O'Laughlin, 70 F.4th 1224 (9th Cir. 2023).

[2] Frazier v. Dovenmuehle Mortgage Inc., 72 F.4th 769 (7th Cir. 2023).

[3] Ingram v. Experian Information Solutions Inc., 83 F.4th 231 (3rd Cir. 2023).

[4] 2023-CFPB-0004.

[5] See Mader v. Experian Info. Sols. Inc., 56 F.4th 264, 269–71 (2d Cir. 2023); Sessa v. Trans Union LLC, 74 F.4th 38, 42-43 (2d Cir. 2023); see also Belair v. Holiday Inn Club Vacations Inc., No. 23-10101 (11th Cir. Apr. 13, 2023) (holding contractual dispute was legal, not factual, and thus not actionable under FCRA).

[6] 79 F.4th 800 (7th Cir. 2023).

[7] See, e.g., Cunningham v. Trans Union LLC, No. 2:22-cv-3331, 2023 WL 6823182 (S.D. Oh. Oct. 11, 2023); Riser v. Cent. Portfolio Control Inc., No. 3:21-cv-05238, 2023 WL 2742075 (W.D. Wash. Mar. 31, 2023).

[8] Gray v. Nachurs Alpine Sols. LLC, No. 3:21-CV-125, 2023 WL 3004433 (N.D. Oh. Apr. 19, 2023).

[9] Messina v. S&A Sols. Inc., No. 22-CV-10706, 2023 WL 6397749 (E.D. Mich. Sept. 30, 2023).

[10] Reed v. United States Postal Serv., No. 2:21-CV-152-JEM, 2023 WL 3568111 (N.D. Ind. May 18, 2023).

[11] Dep't of Ag. Rural Dev. v. Kirtz, No. 22-846, 2023 WL 4065594 (U.S. June 20, 2023).