On November 4, the Consumer Financial Protection Bureau (CFPB) issued an advisory opinion, stating that a consumer reporting agency (CRA) that engages in name-only matching violates the Fair Credit Reporting Act's (FCRA) reasonable procedures requirement, 15 U.S.C. § 1681e(b). Although styled as an advisory opinion, the CFPB made clear that the opinion is considered an "interpretive rule" issued under the CFPB's authority to interpret the FCRA. The opinion will be published at 12 C.F.R. Part 1022, and will become effective as of the date of publication.
Background on Name-Only Matching
The opinion opens with a general background discussion on matching procedures that CRAs utilize to assemble and prepare consumer reports and the importance of ensuring accuracy in this process. The opinion focuses on the process of name-only matching, defined as "matching information to the particular consumer who is the subject of a consumer report based solely on whether the consumer's first and last names are identical or similar to the first and last names associated with the information, without verifying the match using additional identifying information for the consumer." Op. at 11. However, the opinion also takes the opportunity to express particular concern regarding the harm that inaccurate reporting might have on consumers seeking to financially recover in the wake of the COVID-19 pandemic.
The opinion concludes that matching on name only (first and last name) will likely lead to inaccuracies in consumer reports. The opinion cites census data regarding the frequency of common names to state that "it is not unlikely that thousands, or even tens of thousands, of consumers, might share a particular first and last name combination." Id. at 6-7. The opinion references several FTC and CFPB enforcement actions related to name-only matching, as well as U.S. Circuit Court decisions involving this issue. See Ramirez v. TransUnion LLC, 951 F.3d 1008, 1032 (9th Cir. 2020), rev'd on standing grounds, 141 S. Ct. 2190 (2021); Cortez v. Trans Union, LLC, 617 F.3d 688 (3d Cir. 2010).
The opinion further highlights a potential increased risk of inaccuracy when name-only matching is used for Hispanic, Asian, and Black consumers, based on census data showing less last-name diversity in these populations. Id. at 7-8. The CFPB's reference to this possible demographic disparity is interesting to note, as this opinion was released the same week the CFPB also released a report, indicating credit report disputes more commonly occur among consumers residing in majority Hispanic or Black areas.
The opinion further suggests that for consumers with common names, even using an additional identifier, such as a date of birth or address, may still allow for a "heightened risk" of inaccuracy because "commonly named individuals might share the same first and last name and date of birth or address." Id. at 8. In fact, the opinion specifically references the CFPB's 2019 settlement against a consumer reporting agency regarding the company's matching of criminal records to job applicants using only first and last name and either a date of birth or an address. Id.
Although many CRAs have moved away from pure name-only matching, the opinion asserts that some CRAs continue to engage in this practice, citing a 2019 report by the National Consumer Law Center (NCLC) as support. Id. at 10–11. In fact, it was the NCLC and other consumer rights and civil rights groups that requested the CFPB issue an advisory opinion on this topic.
CFPB's Analysis of Section 1681e(b)
After explaining the practice of name-only matching and its risks, the CFPB's opinion analyzes the language of 15 U.S.C. § 1681e(b) to determine whether name-only matching satisfies that provision. Section 1681e(b) requires a CRA preparing a consumer report to "follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates." Focusing particularly on the phrase "concerning the individual about whom the report relates," the opinion concludes this requirement includes "as an integral component that the information in fact pertains to the consumer who is the subject of the report." Id. at 12.
The opinion further states this conclusion is consistent with the FCRA's core purpose, the statute's definition of "consumer report," and the statute's provision regarding permissible purposes for using and disclosing consumer reports. A consumer report is intended to provide information "bearing on a consumer's credit worthiness" or other personal characteristics for the purpose of establishing the consumer's eligibility for credit, employment, or other purposes. 15 U.S.C. § 1681a(d)(1). The CFPB reasoned that information related to a different consumer would not serve this purpose. Likewise, the opinion reasons that since many of the permissible purposes for disclosing consumer reports are tied to the specific consumer, 15 U.S.C. § 1681b, this demonstrates Congress's intent that the information in a consumer report relate to the specific consumer.
Based on this analysis, the opinion concludes that "it is not a reasonable procedure to use name-only matching to match information to the consumer who is the subject of the report in preparing a consumer report." Op. at 14. The opinion supports that conclusion on "the high risk that name-only matching will result in the inclusion of information that does not pertain to the consumer who is the subject of the report and the relative lack of burden on a consumer reporting agency associated with utilizing additional identifiers or not including name-only matched information in a consumer report." Id.
Impact of the Advisory Opinion
This advisory opinion announces the CFPB's position that name-only matching violates the FCRA. As an interpretive rule exempt from the Administrative Procedure Act's notice-and-comment rules, the opinion technically does not carry the force of law, but rather is meant "only to 'advise the public' of how the agency understands, and is likely to apply, its binding statutes and legislative rules." Kisor v. Wilkie, 139 S. Ct. 2400, 2420 (2019). Nevertheless, such a rule promulgated by the CFPB may carry authority in the courts to the extent that is independently persuasive and will likely be identified by plaintiffs' counsel as regulatory guidance that could inform a finding of a willful violation of the FCRA. Thus, CRAs should take note.
Although the opinion makes clear that the CFPB considers name-only matching a violation of Section 1681e(b), it leaves several other open questions. First, the entire opinion refers consistently to "matching" procedures, but it does not address whether it is a reasonable procedure for a CRA to provide an "unmatched" record based only on an identical name if the CRA makes clear to the intended user the information has not been matched, and the user must take additional steps to investigate whether the record concerns the subject. The Eleventh Circuit recently addressed this very question in Erickson v. First Advantage Background Services Corp., 981 F.3d 1246, 1253 (11th Cir. 2020), and concluded that this procedure was reasonable under the facts of that case.
Second, the opinion does not address CRA concerns over "false negatives," whereby a record that is attributable to the subject of a report is not identified due to overly restrictive matching criteria when compared to the often very limited personal identifiers made available in the public record, and which are often constrained from publication by state and local privacy laws. While the opinion focuses on the claimed harm to consumers, it does not address the other significant harms that can result from underreporting.
Third, the CFPB does not address how many or what types of additional identifiers are necessary to comply with the FCRA. Although the opinion suggests the use of a date of birth or an address alone may still allow for a high risk of inaccuracy in the case of common names, it does not provide further guidance on this question. In its press release announcing the advisory opinion, however, the CFPB stated that "the advisory opinion does not create a safe harbor to use insufficient matching procedures involving multiple identifiers. Other practices, for instance name combined with a date of birth, could also lead to cases of mistaken identity." Put another way, while the CFPB identifies a practice that it considers to be insufficient under the FCRA, the CFPB does not simultaneously provide any guidance as to what it would consider to be sufficient. This puts CRAs — and the companies that depend on them — in a very difficult position. At a time when states are limiting the information available in public records, the CFPB is taking the position that matches based on this limited information may be unreasonable.
CRAs should take note of the CFPB's hardline position that name-only matching violates the FCRA. Additionally, given the opinion's ambiguity regarding how many and what types of additional identifiers are necessary when a consumer has a common name, CRAs should evaluate their common name policies in light of the specific concerns raised here. Further, given the CFPB's position that name-only matching has a significant effect on racial and ethnic minorities, the CFPB's guidance also could be seen as a harbinger of disparate impact enforcement actions and a claimed need to institute common name matching policies that account for the screened individual's race or ethnicity and/or the geographic location where the screening occurs.
