Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
On June 24, the FTC finalized the “Free Electronic Credit Monitoring for Active Duty Military Rule,” which implements the Economic Growth, Regulatory Relief, and Consumer Protection Act requirement for nationwide consumer reporting agencies (CRAs) to provide free electronic credit monitoring services for active duty military consumers. The proposed rule, issued in November 2018 (covered by InfoBytes here), defined the term “electronic credit monitoring service” as a service through which the CRAs provide, at a minimum, electronic notification of material additions or modifications to a consumer’s file and requires CRAs to notify active duty military consumers within 24 hours of any material change. The proposal noted that CRAs may require that active duty military provide contact information, proof of identity, and proof of active duty status in order to use the free service and outlines how a servicemember may prove active duty status, such as with a copy of active duty orders. Additionally, the proposal prohibited CRAs from requiring active duty military consumers to purchase a product in order to obtain the free service.
In response to comments on the proposal, the final rule refers to the definition of “active duty military consumer” in the FCRA, which requires that the servicemember be assigned to service away from their usual duty station, or be a member of the National Guard, regardless of whether the National Guard member is stationed away from their normal duty station. The FTC noted that commenters requested the requirement that the servicemember be stationed away from their normal duty station be eliminated but “the statutory language limit[ed] the Commission’s discretion on [the] topic.” However, the FCRA does not apply the same duty station requirement to the National Guard. Additionally, the final rule, among other things (i) requires CRAs to provide free access to a credit file when it notifies an active duty military consumer about a material change to the file; (ii) extends the amount of time the CRAs have to notify an active duty military consumer of a material change from 24 hours to 48 hours; and (iii) prohibits CRAs from requiring that active duty military consumers agree to terms or conditions as a requirement to obtain their free credit file, unless the terms or conditions are necessary to comply with certain legal requirements.
While the final rule goes into effect three months after publication in the Federal Register, CRAs will be allowed to comply with certain portions of the final rule by offering existing credit monitoring services to active duty military consumers for free, for a period of up to one year from the effective date.
On May 30, the CFPB released the latest quarterly consumer credit trends report, which examines the fluctuations in consumers’ credit scores and the timing of consumers’ applications for credit. The report analyzes consumers whose credit scores showed large increases or decreases between 2009 and 2017. Key findings of the report include, (i) consumers with large credit score changes, in either direction, tend to be younger and have considerably lower credit scores on average; (ii) application rates drop sharply as credit scores reach their minimums, and then, after hitting bottom application rates trend steadily upward; and (iii) patterns in application rates generally hold regardless of the levels of minimum and maximum credit scores.
The report notes that while the Bureau did not perform “a full accounting of the underlying mechanism” that leads to the observed patterns, there are a few possible explanations, including (i) consumers are more aware of their credit scores due to the wider availability of them, which would influence timing of applications; (ii) hard inquiries and results from hard inquiries may contribute to the observed peaks and troughs in the scores; (iii) marketing practices by card issuers may contribute to increased applications after a consumer’s credit score qualifies the consumer for a prescreened offer.
On May 17, the U.S. Court of Appeals for the 9th Circuit revived a putative class action lawsuit against a national credit reporting agency for allegedly failing to follow reasonable procedures to assure maximum possible accuracy in the plaintiffs’ credit reports, in violation of the FCRA. According to the opinion, the credit reporting agency failed to delete all the accounts associated with a defunct loan servicer, despite statements claiming to have done so in January 2015. As of October 2015, 125,000 accounts from the defunct loan servicer were still being reported, and the accounts were not deleted until April 2016. A consumer filed the putative class action alleging the credit reporting agency violated the FCRA by continuing to report her past-due account, even after deleting portions of the positive payment history on the account. The district court granted summary judgment in favor of the credit reporting agency on the consumer’s claim that the credit reporting agency failed to “follow reasonable procedures to assure maximum possible accuracy” in her credit report.
On appeal, the court determined that a “reasonable jury could conclude that [the credit reporting agency]’s continued reporting of [the account], either on its own, or coupled with the deletion of portions of [the consumer’s] positive payment history on the same loan, was materially misleading.” Moreover, the appellate court noted that a jury could conclude that the credit reporting agency’s reading of the FCRA “runs a risk of error substantially greater than the risk associated with a reading that was merely careless,” and that the length of delay in implementing the decision to delete the defunct loan servicers accounts “entail[ed] ‘an unjustifiably high risk of harm that is either known or so obvious that it should be known.’”
On April 25, the U.S. Court of Appeals for the 11th Circuit affirmed a district court’s dismissal of a putative class action against a national bank, finding that the plaintiff failed to show an investigation would reveal the bank inaccurately furnished information to credit reporting agencies (CRAs). According to the opinion, after the plaintiff failed to make payments on his mortgage, the bank reported the delinquencies to the three CRAs. A Florida circuit court entered a final judgment of foreclosure in the bank’s favor, which the plaintiff paid two years later after the account was transferred to a different lender. Two years after he paid the foreclosure judgment, the plaintiff noticed that the CRAs showed his account as past due despite the fact that the judgment had been paid. However, following an investigation, the CRAs confirmed that the information provided by the bank was accurate, since it reflected two years of missed payments that the plaintiff later contended he was not obligated to make due to the filing for the foreclosure action. The plaintiff filed a class action suit alleging the bank violated the FCRA by failing to report that he had paid off the foreclosure judgment. The district court dismissed the case with prejudice, ruling that the bank satisfied its obligations under the FCRA, and that the plaintiff failed to support his claim that the bank was obligated to report the payoff after it transferred the account.
On appeal, the 11th Circuit agreed with the district court, opining that because the plaintiff never claimed that the bank was informed of the past-due status dispute by the CRAs, the bank was not obligated to investigate under the FCRA. The court noted that the plaintiff “never alleged that [the bank] received notification from the CRAs that he disputed his account's past-due status as of July 2017,. . .that the CRAs provided notification of any such dispute to [the bank],. . .or even that he contacted the CRAs to dispute that aspect of his credit reports.” The plaintiff further argued that the filing of the foreclosure action and acceleration of the loan relieved him of the obligation to make monthly payments. The 11th Circuit was “unconvinced” by the argument and said that, nonetheless, “[w]hether [the plaintiff] was obligated to make payments on the mortgage after the Foreclosure Action was filed is a currently unresolved legal, not a factual, question. Thus, even assuming [the bank] furnished information that turned out to be legally incorrect under some future ruling, [the bank’s] purported legal error was an insufficient basis for a claim under the FCRA.”
On March 11, the U.S. District Court for the Central District of California approved a stipulation for prospective relief, settling a consumer FCRA action against a purported credit reporting agency (defendant) for alleged procedural violations. In 2016, the case went to the U.S. Supreme Court (covered by a Buckley Special Alert), which remanded the case so the 9th Circuit could fully consider whether the plaintiff had standing under Article III of the Constitution. The approved stipulation lasts three years and, among other things, requires the defendant to (i) post a “clear and appropriately-titled” link to its opt-out privacy form; (ii) create a step requiring that its customers affirmatively agree not to use its information to determine eligibility for a FCRA-related purpose; and (iii) state on all of its webpages that it is not a consumer reporting agency. The order also prohibits the defendant from publishing “any numerical estimates or predictions of consumer credit scores” unless its terms and conditions specify that the information may not be used for FCRA purposes.
On March 25, the U.S. Court of Appeals for the 9th Circuit affirmed dismissal of five plaintiffs’ allegations against two credit reporting agencies, concluding the plaintiffs failed to show they suffered or will suffer concrete injury from alleged information inaccuracies. According to the opinion, the court reviewed five related cases of individual plaintiffs who alleged that the credit reporting agencies violated the FCRA and the California Consumer Credit Report Agencies Act (CCRAA), by not properly reflecting their Chapter 13 bankruptcy plans across their affected accounts after they requested that the information be updated. The lower court dismissed the action, holding that the information in their credit reports was not inaccurate under the FCRA. On appeal, the 9th Circuit, citing to U.S. Supreme Court’s 2016 ruling in Spokeo v. Robins (covered by a Buckley Special Alert), concluded that the plaintiffs failed to show how the alleged misstatements in their credit reports would affect any current or future financial transaction, stating “it is not obvious that they would, given that Plaintiffs’ bankruptcies themselves cause them to have lower credit scores with or without the alleged misstatements.” Because the plaintiffs failed to allege a concrete injury, the court affirmed the dismissal for lack of standing, but vacated the lower court’s dismissal with prejudice, noting that the information may indeed have been inaccurate and leaving the door open for the plaintiffs to refile the action.
On March 21, the U.S. District Court for the Northern District of Alabama reduced a consumer’s punitive damages award from $3 million to $490,000 in an action against a credit reporting agency for the alleged misreporting of credit information. According to the opinion, after the consumer had a debt dismissed by small claims court, he requested that the credit reporting agencies remove the trade line from his credit report. When one credit reporting agency refused to initiate a dispute investigation because it suspected fraud, the consumer filed a complaint alleging violations of the FCRA. In May 2018, a jury awarded the consumer $5,000 in compensatory damages and $3 million in punitive damages. The credit reporting agency moved to have the court enter judgment as a matter of law and/or have the judgment amended or altered. The court reviewed the award, noting that the punitive to compensatory damages ratio of 600 to 1 “suspiciously cocked” the “court’s eyebrows.” The court emphasized that a single-digit multiplier would not be sufficient to deter the credit reporting agency from future wrongdoing and instead, applied the 98 to 1 ratio used by the U.S. Court of Appeals for the 4th Circuit, bringing the punitive damages down to $490,000. In addition, the court applied the “one satisfaction” rule, concluding the credit reporting agency did not have to pay the compensatory damages, as the consumer already received settlement proceeds that exceed the jury award from other defendants, and “the injuries the [consumer] described are indivisible between [the credit reporting agency] and the settling defendants.”
On February 26, the U.S. District Court for the Northern District of California granted summary judgment in favor of Fannie Mae in an action brought by a consumer alleging that Fannie Mae violated the California Consumer Credit Reporting Agencies Act (CCCRA) and the Fair Credit Reporting Act (FCRA) by prohibiting lenders from providing consumers a copy of Fannie Mae’s Desktop Underwriter (DU) report. According to the opinion, two years after completing a short sale on his previous home, a consumer sought a mortgage with three lenders. One lender used Fannie Mae’s DU program to determine if the loan would be eligible for purchase by the agency, but the DU report listed his prior mortgage loan as a foreclosure rather than a short sale. The lender ultimately denied the application, rather than manually underwrite it. Upon reviewing Fannie Mae’s motion for summary judgment, the court noted that in order for the consumer to succeed on his CCRA and FCRA claims, he must establish Fannie Mae is a credit reporting agency. The court rejected the consumer’s attempts to distinguish his case from the recent 9th Circuit decision in Zabriskie v. Fed. Nat’l Mortg. Ass’n, which held that Fannie Mae was not a credit reporting agency under the FCRA. (Covered by InfoBytes here.) The court acknowledged that even though Fannie Mae may have problems with its foreclosure recommendations in the DU system, it does not undercut the conclusion that Fannie Mae operates the DU system to assist lenders in making purchasing decisions, does not “regularly engage in . . . the practice of assembling or evaluating” consumer information, and therefore, is not a credit reporting agency.
On February 19, the U.S. District Court for the District of Maryland denied a bank’s renewed motion to dismiss FCRA claims by a consumer alleging the bank accessed his credit report without a permissible purpose. Specifically, the consumer alleged his credit report included two credit inquires by the bank for “promotional” purposes but that he never received any offers of credit from the bank. According to the consumer, a bank representative told him to dispute the “illegitimate” credit inquiry with the credit reporting agency, and so he filed suit. The bank moved to dismiss, arguing the facts allegedly failed to establish the bank obtained the credit report without a permissible purpose. The court, however, held that the consumer’s allegations that he did not receive an offer of credit and that a representative advised him the inquiry was illegitimate were sufficient to establish—at the motion to dismiss stage—that no firm offer of credit was extended. In response to the bank’s argument that the consumer’s alleged emotional distress damages based on “invasion of privacy” were implausible—because they would have occurred whether or not there was a permissible purpose for the credit pull—the court noted that unauthorized credit disclosures have been “long seen as injurious,” and that the bank cannot attack the harm experienced by the consumer simply because the “harm would still have existed if [the bank] had acted lawfully.”
On January 10, the Massachusetts Governor signed HB 4806, following the House and Senate’s adoption of amendments to the bill. The bill, which is effective April 10, amends current law related to security breaches and the protection of consumer financial and credit information. Among other provisions, the amendments to the current law:
- Prohibit users from requesting or obtaining the consumer credit report of a consumer unless the user obtains the consumer’s prior written, verbal, or electronic consent, and discloses the user's reason for accessing the consumer report to the consumer prior to obtaining consent.
- Require every consumer reporting agency to disclose to consumers, when properly identified, (i) the nature, contents, and substance of all information on file (except medical information) at the time of the request; (ii) the sources of all credit information; and (iii) “the recipients of any consumer report on the consumer which it has furnished for employment purposes within the 2-year period preceding the request, and for any other purpose within the 6-month period preceding the request.”
- State that a consumer reporting agency may not charge a fee to any consumer for placing, lifting, or removing a security freeze from a consumer report.
- Specify that a consumer reporting agency may not “knowingly offer a paid product to prevent unauthorized access or restrict access to a consumer's credit.”
- Require persons who experience a security breach to report specific information to the state Attorney General, as well as certify that their credit monitoring services are in compliance.
- State that consumers shall receive notice provisions in the event of a breach of security, including the right to obtain police reports, steps for requesting a security freeze, and various mitigation services.
- Require persons who experience a breach that compromises social security numbers to provide at least 18 months of free credit monitoring for affected individuals.
- Amanda R. Lawrence to discuss "Navigating the challenges of the latest data protection regulations and proven protocols for breach prevention and response" at the ACI National Forum on Consumer Finance Class Actions and Government Enforcement
- Tim Lange to discuss "Ease your pain at the state level: Recommendations for navigating the licensing issues in the states" at the Online Lenders Alliance Compliance University
- Amanda R. Lawrence, Aaron C. Mahler, and Jonice Gray Tucker to discuss "Expanded role for the FTC ahead: Implications for bank and nonbank financial institutions" at an American Bar Association Banking Law Committee Webinar
- Buckley Webcast: Flirting with alternatives — Opportunities and challenges created by alternative data, modeling, and technology
- Daniel P. Stipano to discuss "Reporting requirements for credit unions: CTRs and SARs" at the National Association of Federally-Insured Credit Unions BSA Seminar
- Daniel P. Stipano and Moorari K. Shah to discuss "Vendor management: What is the NCUA looking for?" at the National Association of Federally-Insured Credit Unions BSA Seminar
- Sasha Leonhardt and John B. Williams to discuss "Privacy" at the National Association of Federally-Insured Credit Unions Summer Regulatory Compliance School
- Warren W. Traiger to discuss "CRA modernization" at the National Association of Industrial Bankers and the Utah Association of Financial Services Annual Convention
- Benjamin W. Hutten to discuss "Requirements for banking inherently high-risk relationships" at the Georgia Bankers Association BSA Experience Program
- Hank Asbill to discuss "Ethical guidance in conducting internal investigations – The intersection of Yates and Upjohn" at the American Bar Association Southeastern White Collar Crime Institute
- Brandy A. Hood to discuss "RESPA Section 8/referrals: How do you stay compliant?" at the New England Mortgage Bankers Conference
- Daniel P. Stipano to discuss "Risk management in enforcement actions: Managing risk or micromanaging it" at the American Bar Association Business Law Section Annual Meeting
- Daniel P. Stipano to discuss "Navigating the conflicting federal and state laws for doing business with cannabis companies" at the American Bar Association Business Law Section Annual Meeting
- Tim Lange to discuss "Services and value" at the North American Collection Agency Regulatory Association Annual Conference
- Amanda R. Lawrence to discuss "Data privacy litigation" at the Mortgage Bankers Association Regulatory Compliance Conference
- Brandy A. Hood to discuss "How to ace your TRID exam" at the Mortgage Bankers Association Regulatory Compliance Conference
- Jonice Gray Tucker to discuss "HMDA data is out, now what?" at the Mortgage Bankers Association Regulatory Compliance Conference
- Daniel P. Stipano to discuss "Assessing the CDD final rule: A year of transitions" at the ACAMS AML & Financial Crime Conference
- Daniel P. Stipano to discuss "Lessons learned from recent enforcement actions and CMPs" at the ACAMS AML & Financial Crime Conference
- Melissa Klimkiewicz to discuss "Navigating FHA rules and regs" at the Mortgage Bankers Association Regulatory Compliance Conference
- Kathryn L. Ryan to discuss "The state’s role in fintech: Providing an industry framework for innovation" at Lend360
- Amanda R. Lawrence to discuss "How to balance a successful (and stressful) career with greater personal well-being" at the American Bar Association Women in Litigation Joint CLE Conference