InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
CFPB, DOD, FTC, and State AGs Partner to Develop Enforcement Action Database
On January 25, the CFPB, the Department of Defense, the FTC, and the New York Attorney General announced a partnership to develop the Repeat Offenders Against Military (ROAM) Database to track enforcement actions against entities or individuals engaged in consumer financial frauds against military personnel, veterans, and their families. The database, which should be available by mid-February, will compile publicly available information about completed civil and criminal legal actions and will be accessible and searchable by state attorneys general, U.S. Attorneys, and Judge Advocates from all branches of the armed services. The Consumer Protection Committee of the National Association of Attorneys General already has sent a letter to state attorneys general asking them to populate the new database with their enforcement action information. The FTC noted that the ROAM database will complement its Consumer Sentinel Network, which collects and provides wide access to consumer complaints, including those related to the frauds against servicemembers and their families.
EU Commission Officially Releases Proposed Replacement for Data Protection Directive
On January 25, the European Union Commission officially released a proposed Regulation designed to update and replace the 1995 Data Protection Directive and national laws issued under that directive. This proposal is designed as a regulation rather than a directive, allowing it to take effect without national implementing legislation. Instead, the proposal will be submitted to the European Parliament and member states for adoption and would become effective two years after adoption. Notably, the proposed Regulation contains a "right to be forgotten" provision, which provides individuals the right, under certain circumstances, to seek the erasure of personal data and a halt to further dissemination of such data. Other provisions of the Regulation would (i) require explicit data subject consent for processing, where previously consent could be inferred in some cases; (ii) require data breaches to be reported to the national supervisory authority and, in certain cases, to the data subject; and (iii) provide data subjects the right to file complaints with national data protection authorities and seek judicial remedies, including damages, for violations of the Regulation. An earlier unofficial draft of this regulation was reported in InfoBytes, December 23, 2011. The two proposals are substantially similar, though the officially released version does lower the limits for penalties under the Regulation.
FINRA Issues Notice Regarding Increasing Account Attacks and Theft of Funds
On January 26, the Financial Industry Regulatory Authority (FINRA) issued Regulatory Notice 12-05, notifying institutions of an increase in reports of customer funds being stolen through improper access to customer email accounts and unauthorized electronic instructions to transfer or withdraw funds. FINRA urged firms to review policies and procedures to ensure protection of customer funds, particularly in cases where the request for funds and transmittal are handled electronically. FINRA recommends that policies and procedures include methods for confirming the identity of the requestor, as well as a system to identify and respond to “red flags.” Concurrent with the regulatory notice, FINRA issued an alert to investors warning about the increased account breach activity and providing tips for protecting account information and funds.
OCC Publishes Proposed Stress Test Rule
On January 24, the OCC published a proposed rule to implement annual capital-adequacy stress tests for national banks and federal savings associations with total consolidated assets of more than $10 billion. The rule is substantially similar to a recent FDIC stress test proposal for FDIC-insured state nonmember banks and state-chartered savings associations. (See InfoBytes, January 20, 2012). The Dodd-Frank Act requires these stress tests to aid regulators in assessing risk presented by an institution's capitalization and help ensure the institution’s financial stability. Under the proposal, the OCC would annually provide covered institutions with at least three sets of conditions - baseline, adverse, and severely adverse - that must be used in conducting an annual stress test. The tests would include calculations showing, for each quarter-end within a defined planning horizon, (i) estimates of revenues, (ii) potential losses, (iii) loan loss provisions, and (iv) potential impact on regulatory capital levels and ratios. Covered institutions also would be required to establish an oversight and documentation system to ensure that stress testing procedures are effective. Stress test results would have to be submitted to the OCC and the Federal Reserve Board by January 5 of each year, and a summary would have to be released to the public within ninety days thereafter. The OCC would plan to provide covered institutions with the scenarios at least two months before the January 5 deadline. The OCC is accepting public comment on the rule through March 26, 2012.
Third Circuit Affirms Partial Expiration Date on Receipt Violates FACTA
On January 24, the U.S. Court of Appeals for the Third Circuit affirmed a district court holding that printing of partial expiration dates does constitute a Fair and Accurate Credit Transactions Act (FACTA) violation, but held that the merchant, in this case, did not willfully violate FACTA by printing a portion of credit card expiration dates on customer receipts. Long v. Tommy Hilfiger U.S.A., Inc., No. 11-1554, 2012 WL 180874 (3rd Cir. Jan. 24, 2012). The consumer alleged, on behalf of a putative nationwide class, that the merchant’s practice of printing receipts that included the expiration month, but not year, willfully violated FACTA’s prohibition against printing “more than the last five digits of a credit card number or the expiration date upon any receipt provided” at the time of a transaction. On appeal, the court considered two questions: (i) whether the consumer properly alleged a FACTA violation, and (ii) whether the merchant’s alleged conduct constituted a willful violation of FACTA. The court held that FACTA prohibits printing of partial expiration dates, and that therefore plaintiff did properly allege a FACTA violation. The court explained that “expiration date” is not defined in the law, and found that “the most natural reading of the phrase” prohibits merchants from printing any of the numbers that appear in the expiration date field on a credit or debit card. If Congress had intended to allow partial expiration dates, the court stated, it would have used language similar to that used with regard to partial credit card numbers. However, the court held that the consumer could not recover statutory damages of $100 to $1,000 per violation, punitive damages, and attorneys fees, because the merchant’s action was not willful. Relying on a standard set in Safeco Insurance Company of America v Burr, 551 U.S. 47 (2007), the court held that the merchant’s interpretation that the statute permits partial expiration dates was not “objectively unreasonable”, because the statute does not provide a definition for “expiration date” and the interpretation has some foundation in the statutory text. According to the court, although the merchant’s interpretation of FACTA was wrong, it did not constitute a willful violation of the law.
HUD Publishes Final Rule on FHA Single Family Lender Insurer Process
On January 24, the Department of Housing and Urban Development (HUD) published a final rule to enhance the Federal Housing Administration (FHA) Lender Insurance process. Under the final rule, (i) Lender Insurance mortgagees (mortgagees who have authority to insure mortgages on HUD’s behalf) must meet stricter performance standards to gain and maintain their approval status as an entity that can insure mortgages on HUD’s behalf; (ii) HUD may require indemnification for “serious and material” violations of FHA origination requirements and for fraud and misrepresentation; (iii) Lender Insurance mortgagees must demonstrate a two-year seriously delinquent and claim rate at or below 150 percent of the aggregate rate for the states in which they operate; (iv) FHA may monitor lender performance on an ongoing basis, and (v) HUD-approved lenders created through corporate restructuring have a new process for seeking Lender Insurance authority. The final rule follows an October 2010 proposed rule (see InfoBytes, October 15, 2010), and makes certain changes to the proposal including to (i) clarify that HUD reviews of Lender Insurance mortgagee performance will be “ongoing”, as opposed to “continual”; (ii) require indemnification of HUD when the mortgagee “knew or should have known” that fraud or misrepresentation occurred; (iii) clarify that automatic termination of Lender Insurance authority can result only from institutional and not branch activity; and (iv) provide a reinstatement process closely modeled on the existing reinstatement process regarding origination approval agreements or Direct Endorsement authority.
CFPB Seeks Third Round of Feedback on Mortgage Closing Forms
On January 24, the CFPB announced a third round of testing of prototype mortgage closing forms as part of its Know Before You Owe campaign. In this round, the CFPB asks the public to compare two versions of its prototype closing forms and consider how each works with the prototype initial disclosure form the CFPB previously developed. The CFPB asks consumers to consider certain specific questions, including whether changes to loan terms or costs are easily identifiable from initial disclosure to closing. The CFPB also seeks comment on whether the disclosures are easy for lenders and settlement agents to use and explain. As with prior rounds of testing, the CFPB will travel to local communities to review the forms with the public. A fourth and final round of testing is expected next month.
House Subcommittee Holds Hearing on CFPB Under Director Cordray
On January 24, the House Oversight Subcommittee on TARP, Financial Services, and Bailouts of Public and Private Programs held a hearing to receive testimony from newly appointed CFPB Director Richard Cordray. Committee members (i) sought the Director’s interpretation of the term “abusive” as it is used in the Dodd-Frank Act, (ii) requested more transparency into the CFPB’s planned regulatory actions, and (iii) requested CFPB action to mitigate the impacts of its regulations on small and community institutions. Mr. Cordray declined to offer a definition of “abusive”, relying instead on the statutory language. The Director did state that abusive practices that are not also either “unfair or deceptive”, likely would be addressed on a “facts and circumstances” basis rather than through an “abstract” regulatory definition. He did not rule out using “abusive practices” as the basis of an enforcement action prior to issuing any further guidance or rulemaking. The Director committed to consider following the SEC’s model of periodically publishing a regulatory agenda. He also explained that the CFPB will consider and address impacts of its regulatory actions on community banks and financial institutions with under $10 billion in assets.
California Federal Court Dismisses Data Loss Class Action Because No Immediate Harm Exists
On January 20, the U.S. District Court for the Eastern District of California dismissed a putative class action brought on behalf of California residents against a company that lost multiple server drives containing personal and medical information. Whitaker v. Health Net of Cal., Inc. No. 11-910, 2012 WL 174961 (E.D. Cal. Jan. 20, 2012). The named plaintiff alleged that the loss of the drives and personal information violated California’s Confidentiality of Medical Information Act. Relying on Ninth Circuit decisions in Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010) and Ruiz v. Gap Inc., No. 09-15971, 380 F. Appx. 689 (9th Cir. May 28, 2010), the plaintiff argued that the threat of harm naturally stems from a loss of data alone. The court held, however, that there is a difference between theft and loss of data. Unlike those prior cases in which personal data was obtained by hacking or data breach, loss of data does not present any actual or immediate harm, only conjectural or hypothetical harm. The court held that the plaintiff lacked standing and dismissed the case with leave to amend because the possibility of harm is not sufficient to meet the constitutional injury-in-fact standard.
CFPB and FTC Announce Memorandum of Understanding to Coordinate Regulatory Activities
On January 23, the CFPB and the FTC announced that the agencies had entered into a memorandum of understanding (MOU) to facilitate coordination of the agencies’ consumer financial rulemaking, enforcement, and supervision activities. The MOU establishes regular meetings between the two entities, as well as processes for providing notice of enforcement activities. Under the MOU, the CFPB and the FTC will be able to share consumer complaint information, and the FTC can request CFPB examination reports and confidential supervisory information.