The Consumer Financial Protection Bureau (CFPB) is currently considering a rulemaking to address various consumer reporting topics under the Fair Credit Reporting Act (FCRA) and has released an Outline of Proposals and Alternatives Under Consideration. These proposals are intended to enhance consumer protection, improve data security, and ensure fair and accurate credit reporting.

The proposal was released in connection with a Small Business Review Panel that will consult with representatives of small entities that likely would be subject to the rule, if it were adopted, in accordance with the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA).

Below is a closer look at the proposal:

Data Brokers as Consumer Reporting Agencies: One proposal under consideration is to define data brokers as consumer reporting agencies. Data brokers are entities that collect and sell consumer information to third parties. By defining data brokers as consumer reporting agencies, they would be subject to the same regulations and obligations as traditional credit reporting agencies. This proposal aims to ensure that data brokers are held accountable for the accuracy and security of the consumer information they collect and sell.

Credit Header Data: The extent to which credit header data is considered a consumer report is another area of focus in the proposals. Credit header data includes consumer-identifying information such as names, addresses, and Social Security numbers. The proposal aims to clarify whether credit header data should be treated as a consumer report under the FCRA. This clarification would help ensure that credit header data is treated with the same level of protection as other consumer reports.

Targeted Marketing and Aggregated Data: The proposal would clarify that certain activities that consumer reporting agencies undertake to help third-party users market to consumers violate the FCRA prohibition on furnishing consumer reports to third parties without a permissible purpose. Additionally, the proposal would clarify when aggregated or anonymized consumer report information constitutes or does not constitute a consumer report.

Permissible Purposes for Consumer Reports: The FCRA outlines the specific purposes for which consumer reports can be obtained, such as for credit decisions or employment screening. The CFPB is considering clarifying and updating these permissible purposes to reflect the evolving needs of consumers and businesses. This proposal aims to provide clear guidelines for the appropriate use of consumer reports and prevent misuse of consumer information.

Data Security and Data Breaches: Data security and data breaches are also addressed in the proposals. The CFPB is considering clarifying the obligations of consumer reporting agencies to protect consumer reports from unauthorized access or data breaches by third parties. This proposal aims to enhance consumer protection and ensure that consumer information is safeguarded against potential security breaches. With the increasing frequency and severity of data breaches, it is crucial to have robust security measures in place to protect consumer information.

Disputes and Systemic Errors: The proposals also focus on improving the dispute resolution process and addressing systemic errors. One proposal aims to codify that there is no distinction between "legal" and "factual" disputes under the FCRA. This means that consumer reporting agencies and furnishers would have obligations to conduct reasonable investigations of both types of disputes. The proposal also would address what consumer reporting agencies and furnishers must do to investigate and address systemic errors that come to their attention via disputes. In addition, the proposal may provide a specific process consumers could use to submit disputes relating to systemic issues affecting multiple consumers.

Medical Debt: The proposal would prohibit creditors from obtaining or using medical debt collection information to make determinations about consumers' eligibility (or continued eligibility) for credit. Likewise, the proposal would prohibit consumer reporting agencies from including medical debt collection tradelines on consumer reports furnished to creditors for purposes of making credit eligibility determinations.

An outline of proposals under consideration and alternatives considered is available here.

A discussion guide for small entity representatives is available here.