On September 21, the CFPB announced that it has initiated a rulemaking process under the Fair Credit Reporting Act (“FCRA”) that would remove medical bills from consumer credit reports. The CFPB also published an Outline describing the proposals and alternatives that it will consider in the FCRA rulemaking process, which, if finalized, would:

• Prohibit credit reporting companies from including medical debts and collection information on consumer reports that creditors use in making underwriting decisions.
• Narrow the exception that allows creditors to rely on medical data if it can be characterized as “financial information” and prohibit creditors from using medical collections information when evaluating borrowers’ credit applications.
• Prevent debt collectors from being able to use the credit reporting system as leverage to pressure consumers into paying questionable medical debts.

In addition to removing medical bills from consumer credit reports, the Outline also details proposals that the CFPB is considering with respect to data brokers. These proposals, which CFPB Director Rohit Chopra forecasted in August (see previous blog post here), would:

• Modify the definitions of “consumer reporting agency” and “consumer report” to clarify that the FCRA applies to data brokers and other third-party intermediaries and vendors engaged in transmitting consumer data electronically between data sources and users where such activities constitute “assembling or evaluating” consumer data under existing precedent. The proposals would also clarify whether and to what extent “credit header” data and aggregated or anonymized consumer report information constitute a “consumer report” under the FCRA.
• Clarify the “permissible purposes” for which consumer reporting agencies may furnish consumer reports to third parties under the FCRA. The proposals would also clarify the circumstances in which data breaches may result in a violation of the FCRA’s permissible purpose provision.
• Change the processes for disputing the completeness or accuracy of information contained in consumer reports for two types of disputes: (1) those that are classified by a consumer reporting agency or furnisher as involving legal matters; and (2) those involving systemic issues at a consumer reporting agency or furnisher.

The CFPB’s proposals will not take effect until a proposed rule is published, public comment on the proposed rule is received and reviewed, a final rule is issued, and the implementation period concludes.

Putting it into Practice: The new CFPB rule proposals set forth in the Outline would have a significant impact by making data brokers and certain third party vendors subject to the FCRA. Accordingly, companies engaged in transmitting consumer data electronically between data sources and users should review the Outline and any formal proposed rules published in the coming weeks to ensure compliance.