The FCRA, ECOA and the Consumer Financial Protection Bureau
The FCRA, ECOA and the Consumer Financial Protection Bureau:Two Areas of Ambiguity the Bureau May Address Presented by Joshua A. del Castillo & Kenyon D. Harbison for Financial Institutions Committee Business Law Section State Bar of California January 8, 2013
Presentation Preview 1• The Fair Credit Reporting Act• The Transfer Authority From the FTC to the CFPB• How the CFPB is Stepping Up Enforcement• Two Case Studies in Ambiguity: Potential Issues the CFPB Might Resolve • FCRA Adverse Action Notices and Commercial Transactions • Adverse Action Notices to Guarantors • The Equal Credit Opportunity Act • Notices to Guarantors under the FCRA and ECOA• Conclusions
3Used with permission of the artist. All rights reserved.
Review of the FCRA’s Broad Coverage 4• The FCRA covers the popular conception of “credit reports.”• But the focus of the FCRA is more broadly on consumer reports information of manytypes and as used for many purposes: o Insurance o E.g., a report obtained from a credit bureau during a claims proceeding. o Employment o E.g., an employment history reports, including a listing of accidents. o Other business transactions, such as: o rental transactions and tenant histories; o medical records or payments; o insurance claims; o check-writing history.
Key Abbreviated Definitions 5• Consumer: an individual.• Person: an individual, partnership, corporation, etc.• Consumer reporting agency (“CRA”): any person who, for profit or not, regularlyassembles or evaluates consumer credit or other information to furnish it to third parties. • Note: may be implied, no federal registration or licensing required.• Consumer report: any communication by a CRA about a consumer’s creditworthiness,character or reputation, used or expected to be used even in part to establish eligibility for: • credit or insurance to be used primarily for personal, family or household purposes; • employment purposes; or • other permissible purposes such as court subpoenas, to determine government benefit eligibility, existing credit obligations, or as otherwise directed by a consumer.
Distinction: Not a Consumer Report 6• The following examples are not consumer reports: • Aggregated/blind data; • Mere ID data; • Data not from a CRA; • Data not intended to be used for an FCRA permissible purpose (e.g., law enforcement).• Also statutorily excluded under FCRA 603(d)(2)(A): • Transaction and experience information solely about the consumer/reporter interaction; • Such communications as between affiliated companies; • What would otherwise be a consumer report, which is shared as between affiliated companies after a notice and opportunity to opt out;• Other statutory exclusions: • Point of sale credit approvals (FCRA 603(d)(2)(3)); • Employment agency communications after a consumer opt out (FCRA 603(o)).• Note: May still be regulated information under the Gramm-Leach-Bliley Act (“GLBA”).
Key Benefits / Duties of the FCRA 7 Consumer Reporting Agency Duties: • Protect data (identity theft);Consumer Benefits: • Prevent uses for impermissible purposes; • Ease access to credit data; • Maintain accurate data; • Ease ability to correct/dispute data. • Investigate disputes; • Report only prescribed data. User Duties: • Use for permissible purposes only; • Notify consumers of adverse decisions. Furnisher Duties: • Provide accurate data; • Investigate disputes.
Consumer Reporting Agency Duties 8• Most sections in the FCRA relate to the duties of CRAs. • “Gatekeeper” relating to use of consumer report info for permissible purposes. • Exclusion of info from consumer reports (e.g., paid tax liens > seven years old). • Help prevent and remedy identity theft (some req’s apply to Nationwide CRA’s only). • Disclosures to consumers on request, including free annual disclosures. • Initial point of contact for most consumer disputes, and related reinvestigations; must notify the information furnisher of the dispute and relevant information within 5 days. • Restrictions on employment reports/information, and on investigative reports. • Criminal penalties for employees who make unauthorized disclosures. • Disclosures to the government for counterintelligence and anti-terrorism purposes.
Duties of “Users” of Consumer Reports 9• The sections relating to users nevertheless contain many rules, some of which are: • Permissible Purposes: concurrent duty only to obtain and use for such a purpose, including certification to the CRA. • Restrictions on the manner and circumstances in which “prescreened” offers based on consumer reports may be made to consumers. • Requirements relating to notices a user must give a consumer when it takes “adverse action” based on a consumer report, including credit score and key decision factors. • Special rules for employment/investigative consumer reports exist, including consent, and notification to a consumer before taking adverse action. • ID Theft Rules: “Red Flag” rule to spot potential ID theft, “reasonable” belief in ID before granting credit if a fraud alert is in place, and policies to know the ID.
Duties of Furnishers of Information to CRAs 10• No private right of action for most violations, such as. • Duty to provide accurate information, may not furnish if “reasonable cause” exists to believe it is inaccurate; • Duty to correct and update; • Duty to not furnish information resulting from ID theft to a CRA; • Duty to respond to direct disputes from a consumer; • Duty to provide notice to consumer when negative information is furnished;• Duty to investigate disputed information when notified by a CRA of a dispute and torespond to a CRA in time for the CRA to respond to a disputing consumer. • “Reasonableness” has been required by courts, including the Fourth Circuit.
Enforcement of the FCRA 11CFPB Enforcement of this and other consumer financial law statutes: • $5,000 per day penalties for negligent violations; • $25,000 per day for reckless violations; • Up to $1 million per day penalties for “knowing” violations.FTC Enforcement: • $2,500 per violation for knowing violations that are part of a pattern or practice.State Enforcement: • $1,000 for negligent or willful violations, per violation.Private Right of Action: • Not as to all aspects of the FCRA (e.g., user adverse action, most furnisher duties); • Negligent violations: actual damages, attorneys fees; • Willful violations: no need to prove actual damages; statutory damages of $100 to $1,000 per transaction, punitive damages, attorneys’ fees
12The Transfer of Regulatory and Some Enforcement Authority From the FTC to the CFPB
The Process of Empowerment for the CFPB 13• July 21, 2010 – Dodd-Frank Wall Street Reform and Consumer Protection Actcreated the Consumer Financial Protection Bureau (“CFPB”), in a portion of Dodd-Frank called the “Consumer Financial Protection Act,” (12 USC 5481 et seq.).• The CFPB was given broad regulatory and enforcement authority relating to manyfederal consumer financial protection laws, including all sections of the FCRA exceptSection 615(e) (red flags rules for users) and Section 628 (disposal of records).• In July 2011 the FTC rescinded its previous commentary on the FCRA and in itsplace published a “Staff Report” that kept much of it, but also made changes.• In January 2012 the CFPB entered into a Memorandum of Understanding with theFTC relating to the FTC’s parallel enforcement of certain acts, including the FCRA.
The CFPB Has Reformulated and 15 Republished Regulations B & V• On December 21, 2011 the CFPB restated, and on December 30, 2011 the CFPBrepublished the FRB’s FCRA “Regulation V” as 12 CFR 1022.1 et seq. • (It also republished ECOA regulation B.)• Per the CFPB, the new regulation “substantially duplicates the…regulationspromulgated…by the Board, the FDIC, the FTC, the NCUA, the OCC, and the OTS.”
Participated in Amicus Briefing on the 16 Constitutionality of a Provision of the FCRA• The CFPB is formally committed to filing amicus briefs even in private cases involvingfederal consumer financial protection laws, and so far has filed at least six.• This summer it participated in an amicus brief relating to the constitutionality of anFCRA provision relating to how long criminal records can remain in a consumer report.
First Legal Enforcement Action Filed 17• On July 18, 2012 the CFPB filed its first actual legal enforcement action, relating to aCalifornia law firm that offered mortgage assistance relief services to consumers.
Major Settlement with American Express 18• On October 1, 2012 without filing an actual lawsuit, the CFPB entered into a majorconsent decree with various American Express entities, including banking entities, to: • Pay $85 million to 250,000 consumers in restitution for violations of various statutes, including the FCRA; • Pay $27.5 million in civil penalties to the CFPB.• Violations Related To: • Deceiving consumers into thinking they were getting reward points; • Charging unlawful late fees; • Age-based discrimination relating to new account applicants (ECOA violation); • Failing to report consumer disputes to CRAs (FCRA violation); • Misleading consumers into believing paying old debt first would improve scores.
CFPB Now Producing 19 Examination Standards• September 2012: the CFPB issued its examination procedures for non-depositoryinstitutions that are “larger participants.” • Permits supervision of co’s w/annual gross of > $7mil from consumer reporting: i.e., the Nationwide Consumer Reporting Agencies, Transunion, etc.• October 24, 2012: the CFPB published its debt collection examination procedures,including significant reference to overlap between the FCRA and the FDCPA.• October 31, 2012: the CFPB published version 2 of its Supervision and ExaminationManual, including extensive commentary on examination for FCRA compliance.• December 17, 2012: the CFPB published its education loan examination procedures,including reference to and overlap with the FCRA.
Bulletins Regarding Compliance 20• November 29, 2012: CFPB issued a bulletin warning that nationwide consumer reportingagencies must comply immediately with the annual disclosure provisions of the FCRA. • NCRAs: • Transunion • Experian • Equifax
New Report on Credit Reporting System 21• In December 2012 the CFPB published a new report titled “Key Dimensions andProcesses in the U.S. Credit Reporting System.”• CFPB initial focus with regard to the FCRA is on consumer reporting agencies. • Examples: • e-OSCAR system by which NCRAs report disputes to fu •nishers does not have mechanism for transmitting supporting documents, which is an FCRA violation; • Previous slide about non-compliance w/free annual report requirements.• The “Key Dimensions” report promises to be the basis of increased future regulatoryaction, and a precursor to a greater focus on users and furnishers, including banks.
The CFPB’s Deadline to Update FCRA- 22 Required Forms has Arrived• Pursuant to regulations promulgated by the CFPB last year, January 1, 2013 was thedeadline to revise FCRA notices to reflect the enhanced role of the CFPB.• Pertains to the following required FCRA notices: • Summary of Consumer Rights • Notice of Furnisher Responsibilities • Notice to Users of Consumer Reports of Their Obligations Under the FCRA
23 Two Case Studies in Ambiguity:Potential Issues the CFPB Might Resolve
24 Case Study One:Adverse Actions and Commercial Transactions
25Used with permission of the artist. All rights reserved.
What is an Adverse Action? (The FCRA’s 26 ECOA Cross-Referenced Definition)• "Adverse Action" is defined in the FCRA by reference to the Equal Credit Opportunity Act(“ECOA”) (of which more in a few minutes), as a: • “[D]enial or revocation of credit, a change in the terms of [existing credit]…or a refusal to grant credit in substantially the amount or on substantially the terms requested."• And also pursuant to terms in the FCRA, as: • An adverse action in connection with insurance (e.g., denial, cancellation, or change in terms of coverage), employment (e.g., denial), and licenses (e.g., charge increase); and • (Catch-all): An action taken or determination made re: an application made by, or a transaction that was initiated by, a Consumer and adverse to the interests of the Consumer.• Note: the additional terms means the FCRA definition is arguably broader than ECOA’s.
Adverse Action Notices Under the FCRA 27• Purpose: Provide applicants with notice of the adverse action, along with inforelating to the CRA that provided the Report, and info relating to the consumers creditscore (if applicable) and rights to obtain and dispute credit information.• Required: Only where creditor takes any adverse action with respect to a consumer"based in whole or in part" on information contained within a consumer report.• Form: No specific form of adverse action notice is prescribed by the FCRA, butSection 615(a) requires notice of: • the adverse action; • any credit score or range of scores used, the date the score was provided, who provided it, and key factors adversely affecting it; • the CRA’s contact information and a statement it did not make the decision; • notice of the right to obtain a free credit report from the applicable CRA; • notice of the right to dispute the accuracy of the consumer report.
Case Study: What about commercial 28 transactions under the FCRA?• Open Issue: One of the longstanding issues under the FCRA is whether a credit reportobtained on an individual obtained in connection with a commercial transaction is a“consumer report” thereby bringing the transaction within the ambit of the statute, for thepurposes of the adverse action notice requirement. • I.e., an individual’s credit/consumer information is evaluated in connection with a business transaction (sole proprietorship, guarantors, etc.).• Note: This question presumes the applicant is in fact an individual consumer and not acorporation or other business entity, to which the FCRA plainly does not apply.
View One: Consumer Reports May Not Be 29 Delivered in Commercial Transactions• FCRA does not apply to transactions where no individual credit is evaluated.• Some case law, much of it developed in the context of loan origination, suggests that theFCRA does not apply to a consumer report on an individual obtained in any way inconnection with a commercial transaction.• These cases generally take position that FCRA was not intended to regulate reports incommercial transactions, and that only credit transaction in which a Consumer Report (asdefined by statute) can exist is for personal, family, or household expenses.• The FTC’s 1990 Commentary also took this position at pages 562 and 567.
View Two: Consumer Reports May Be 30 Delivered in Commercial Transactions• Contrary case law looks to the purpose for which credit information was collected (e.g.for inclusion in a consumer report), not the purpose for which it is ultimately used.• These cases typically do not address the context of loan origination; instead developedfrom cases where use of a Consumer Report was used for impermissible purpose, often acircumstance involving improper conduct.
Before the CFPB, the Latter Line of Cases 31 Had Received Regulatory Endorsement• View Two Endorsed: This line of cases recently received regulatory endorsement fromFTC, which rescinded it 1990 Commentary to the contrary effective July 26, 2011. • Separately, the July 2011 FTC staff report states that "a report from a CRA on the personal credit of a consumer to a business credit grantor is a consumer report regardless of the purpose for which the information may in fact be used."• So far nothing has changed with the CFPB: • In implementing the new Regulation V, the CFPB indicated it was not making changes at that time. • However, there is also no indication the CFPB has officially adopted the staff commentary of the FTC, and the National Consumer Law Center was advocating as recently as June 2012 that it do so.
32 Case Study Two:ECOA, Commercial Transactions, andAdverse Action Notices to Guarantors
What is ECOA? 33• The Equal Credit Opportunity Act, enacted in 1974, is another federal consumerfinancial statute. • Explicitly and primarily creditor-focused, unlike the FCRA.• Under ECOA it is unlawful for any creditor to discriminate against any applicant,with respect to any aspect of a credit transaction, on the basis of: • race; • color; • religion; • national origin; • sex, marital status; • or age (provided the applicant has the capacity to contract).
Adverse Action Notices Under ECOA 34• Required: In any transaction where adverse action is taken, regardless of whether aconsumer report is provided and reviewed. • Each "applicant against whom adverse action is taken" is entitled to statement as to reasons for action.• Applicant: “[A]ny person who requests or who has received an extension of creditfrom a creditor, and includes any person who is or may become contractually liableregarding an extension of credit.“• Form: No form of Adverse Action Notice is prescribed (with the exception ofstandard ECOA disclaimer). However, the FRB has created combined ECOA andFCRA adverse action notice forms which may be used, at least where personal credit isconcerned, as a form of "safe harbor.“ The CFPB has kept these forms.
ECOA Applies to Commercial Transactions 35• Applicability: ECOA applies both to consumer and to business transactions for which anapplication (absent any credit or other consumer report) has been submitted to the creditor.• Timing of Adverse Action Notices: • For business applicants w/ ≤ $1 million in gross revenues, with exceptions, a creditor may provide oral/written notice within the timeframe applicable to consumer applicants. • For business applicants w/ > $1 million in gross revenues, the creditor may comply with the above rule, or within a “reasonable time.”• Two Problems: • Are relaxed reqs for larger businesses truly applicable? Imagine a $15 million property secured by a $10 million loan to a single asset entity, but ≤ $1 million in gross revenues. • Which partys revenue should be examined? “Borrower" may not be established until time of closing (e.g., LBO, real estate transaction w/holding company or an SAE). Who is the "applicant"? The sponsor? Consider the definition of "applicant" under ECOA.
ECOA, FCRA, and Guarantors 36• ECOA and Guarantors: The general rule under ECOA is guarantors are not “applicants”for commercial credit, and, therefore, are not entitled to adverse action notices. • The Seventh Circuit has ruled any other interpretation would make no sense. • However, some courts have held or implied otherwise. • An old FTC staff letter confirms the common-sense and Seventh Circuit view, but ambiguity nevertheless remains. • This letter was actually written in the context of an inquiry w/regard to the FCRA, which incorporates the ECOA definition of adverse action, making this issue more generally applicable to both statutes.• Note: The CFPB has not yet spoken on this issue either.
Conclusions 37• There is no indication of fundamental change coming from the CFPB thus far, includingas to adverse action notices in commercial transactions, and with regard to guarantors.• There are indications that CFPB rulemaking and commentary may result in changes instatutory interpretation and application. CFPB has not kicked into “4th gear” yet.• Ongoing Sources of Authority in Order of Persuasion: • Statute (as amended five times from 1970 to 2010); • Rulemaking: the CFPB’s revised Regulations B & V; • Existing case law relating to the FCRA and ECOA; • Federal Trade Commission Materials; • 2011 Staff Report on FCRA: Replaced the Official Commentary; • Existing FTC staff opinion letters re: FCRA and ECOA; • Records of enforcement actions; • New guidance by the CFPB to the extent it exists; • Existing custom/practice.
Bio: Joshua A. del Castillo • Joshua A. del Castillo is senior counsel in Allen Matkins’ Los Joshua A. del Castillo Los Angeles Office Angeles office, and practices in the firms Bankruptcy & Creditors’ Rights, Litigation, and Banking and Financial Phone: 213.955.5591 Institutions groups. Facsimile: 213.620.8816 • Joshua serves as the lead attorney for Allen Matkins’ firstname.lastname@example.org Consumer Finance and Regulatory Compliance sub-group. In this capacity, he regularly defends institutional lenders and other creditors in consumer finance and regulatory compliance litigation, including in Fair Credit Reporting Act, Real Estate Settlement Procedures Act, Truth in Lending Act,Focus and other federal and state consumer finance litigation. InBankruptcy and Creditors’ Rights addition, he provides specific regulatory compliance advice in the non-litigation context regarding a variety of federal andLitigation state consumer finance matters, an area of increased focus inBanking and Financial Institutions the wake of the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act.EducationJ.D., University of Southern CaliforniaM.A., University of MichiganB.A., University of Southern California
Bio: Kenyon D. Harbison • Kenyon Harbison practices in the areas of real estate, Kenyon D. Harbison insurance, and general litigation, including litigation in Los Angeles Office bankruptcy courts. He has worked in all phases of litigation, including appeal in state, federal, and federal bankruptcy Phone: 213.955.5661 court proceedings. His cases have involved commercial lease Facsimile: 213.620.8816 disputes, insurance recovery, soil contamination, construction email@example.com defect litigation, and partnership disputes. • Kenyon also serves as a leading attorney for Allen Matkins’ Consumer Finance and Regulatory Compliance sub-group. In this capacity, he defends institutional lenders and other creditors in consumer finance and regulatory complianceFocus litigation, including in Fair Credit Reporting Act, Real Estate Settlement Procedures Act, Truth in Lending Act, and otherLitigation federal and state consumer finance litigation. In addition, heBanking and Financial Institutions provides specific regulatory compliance advice in the non-Construction litigation context regarding a variety of federal and state consumer finance matters, an area of increased focus in the wake of the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act.Education • At UCLA School of Law, Kenyon was a staff member and aJ.D., University of California, Los Angeles managing editor of the UCLA Law Review, was a student instructor of legal writing, and was made a member of TheB.A., Yale University Order of the Coif. He also served as a research assistant to Professor Joanna Schwartz and he externed for the Honorable Paul Boland of the California Court of Appeal, Second District. After practicing law at Allen Matkins for nearly a year, Kenyon took a leave of absence and clerked for the Honorable Florence-Marie Cooper of the U.S. District Court, Central District of California, after which he returned to Allen Matkins.