Alert

CFPB Proposes Expanded FCRA Reach – Will It Grab Your Business?

September 12, 2023

At a recent White House Roundtable, the Consumer Financial Protection Bureau’s (CFPB) Director, Rohit Chopra, announced that the bureau will promulgate new rules in September that will broaden the categories of information/data that are subject to the Fair Credit Reporting Act (FCRA). The changes are likely to bring companies that are not currently subject to the FCRA within the statute’s purview.

Although the CFPB hasn’t released its proposed rules, Director Chopra’s statements at the meeting and a CFPB memorandum of frequently asked questions provide some indications of what companies should expect. The Roundtable was convened to discuss “harmful data broker practices” and included regulators, administration officials, and private parties.

The CFPB is evaluating whether businesses that sell certain types of consumer data should be subject to the FCRA. It specifically indicates that the sale of certain data, such as payment histories, income, and criminal records, may be a consumer report subject to the requirements of the FCRA.

In addition, the CFPB will consider whether “credit header data,” such as a consumer’s name, social security number, or address are “consumer reports,” reducing the ability of a credit reporting agency to disclose sensitive contact information without a permissible purpose.

The proposal shines a spotlight on the agency’s continued skepticism regarding the use of artificial intelligence. Redefining data points that may be “consumer reports” requiring a permissible purpose to sell would impact the ability to obtain data for the purpose of “training” AI systems, as it may be difficult to identify a “permissible purpose.”