InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
CFPB report on credit bureaus hints at rulemaking
On January 3, the CFPB released its annual report, pursuant to Section 611(e)(5) of the FCRA, on information gathered by the Bureau regarding certain consumer complaints on the three largest nationwide consumer reporting agencies (CRAs). According to the report, the Bureau received 488,000 consumer complaints about the CRAs from October 2021 through September 2022. The Bureau’s analysis revealed that 93 percent of consumers reported having previously attempted to fix their problem with the company. The report also noted that the use of problematic response types has decreased, and most complaints now receive “more substantive and tailored” responses. The report found that most responses from the CRAs describe the outcomes of consumers’ complaints. The Bureau highlighted areas that the CRAs should prioritize given the “challenges facing market participants and policy makers,” including: (i) considering consumer burden when implementing automated processes; (ii) recognizing how current processes will need to evolve in light of new technologies that can generate similar-sounding complaints that are in fact unique; and (iii) considering how to transition the market from control and surveillance to consumer participation. According to CFPB Director Rohit Chopra, the Bureau “will be exploring new rules to ensure that [the CRAs] are following the law, rather than cutting corners to fuel their profit model.”
CFPB, FTC say furnishers’ investigative duties extend to legal disputes
On December 16, the CFPB and FTC filed an amicus brief in a case on appeal to the U.S. Court of Appeals for the Eleventh Circuit concerning two related FCRA cases in support of plaintiffs-appellants and reversal of their suits involving a defendant hotel chain’s summary judgments. Both cases involve the same defendant company. In one case, the plaintiff entered into a timeshare agreement with the defendant for a property and made monthly payments for approximately three years. When the plaintiff stopped making payments, the plaintiff mailed the defendant letters that disputed the validity of, and purported to rescind, the agreement, while permitting the defendant to retain all prior payments as liquidated damages. The plaintiff obtained a copy of his credit report from a credit reporting agency (CRA), which stated that he had an open account with the defendant with a past-due balance. In three letters to the CRA, the plaintiff disputed the credit reporting. The letters stated that the plaintiff had terminated his agreement with the defendant and that he did not owe a balance. After the CRA communicated each dispute to the defendant, the defendant certified that the information for the defendant’s account was accurate. The plaintiff sued alleging the defendant violated the FCRA when it verified the accuracy of his credit report without conducting reasonable investigations following receipt of his indirect disputes. The defendant moved for summary judgment, alleging, among other things, that the plaintiff’s claim that he was not contractually obligated to make the payments to the defendant that are reported on his credit report as being due “is inherently a legal dispute and is not actionable under the FCRA.” The district court granted the defendant’s motion for summary judgment, which the plaintiff appealed.
In the other case, the plaintiff entered into a timeshare agreement with the defendant. She made a down payment and the first three installment payments, but did not make any additional payments. The plaintiff sent letters to the defendant disputing the validity of, and attempted to cancel, the agreement. The defendant reported the plaintiff’s delinquency to the CRA. In three letters to the CRA, the plaintiff disputed the credit reporting. After the CRA communicated the disputes to the defendant, the defendant determined there was no inaccuracy in the reporting. The plaintiff sued alleging the defendant violated the FCRA when it verified the accuracy of her credit report without conducting reasonable investigations following receipt of her indirect disputes about credit reporting inaccuracies. The district court granted the defendant’s motion for summary judgment, which the plaintiff appealed.
The CFPB and FTC argued in favor of the plaintiffs-appellants. According to the agencies, furnishers’ duty under the FCRA to reasonably investigate applies not only to factual disputes, but also to disputes that can be labeled as legal in nature. The agencies made three arguments to support their contention. First, a reasonable investigation is required under the FCRA to comport with its goal to “protect consumers from the transmission of inaccurate information about them.” The agencies argued that reasonableness is case specific, but it can “be evaluated by how thoroughly the furnisher investigated the dispute (e.g., how well its conclusion is supported by the information it considered or reasonably could have considered).”
Second, the agencies argued that Congress did not intend to exclude disputes that involve legal questions. The FCRA describes the types of indirect disputes that furnishers need to investigate, which are “those that dispute ‘the completeness or accuracy of any item of information contained in a consumer’s file.’” The agencies said nothing suggests that Congress intended to exclude information that is inaccurate on account of legal issues. Furthermore, the agencies noted that a lot of “inaccuracies in consumer reports could be characterized as legal, which would create an exception that would swallow the rule.” Consumer reports generally include information regarding an individual’s debt obligations, which are generally creatures of contract. Therefore, “many inaccurate representations pertaining to an individual’s debt obligations arguably could be characterized as legal inaccuracies, given that determining the truth or falsity of the representation could require the reading of a contract.”
Lastly, the agencies argued that an “atextual exception for legal inaccuracies would create a loophole that could swallow the reasonable investigation rule.” The agencies urged that “[g]iven the difficulty in distinguishing ‘legal’ from ‘factual’ disputes,” the court “should hold that there is no exemption in the FCRA’s reasonable investigation requirement for legal questions” because it would “curtail the reach of the FCRA’s investigation requirement in a way that runs counter to the purpose of the provision to require meaningful investigation to ensure accuracy on credit reports.”
District Court grants MSJ for plaintiff in FDCPA suit
On November 21, the U. S. District Court for the Northern District of Illinois denied a defendant debt collection company’s motion for summary judgment and granted plaintiff’s motion for summary judgment in an FDCPA suit. According to the opinion, the plaintiff sent a letter to the defendant disputing the accuracy of the information being reported to the credit reporting agency, saying the amount of the debt was incorrect. The defendant received the letter on February 1, 2021, and on February 3, the defendant reported the debt to the CRA, but failed to note that the debt was disputed. The CRA then communicated information about plaintiff’s debt to additional third parties. The next reporting cycle for the plaintiff’s account closed on March 3, 2021. At that time, the defendant correctly reported that plaintiff’s debt was disputed. The defendant explained that although the servicer received the plaintiff’s dispute letter on February 1, 2021, “no one was able to analyze, process, and review” it until February 4, 2021, by which time it had already reported the debt to the CRA.
The defendant argued that it can take up to seven business days for its credit review team to review a dispute letter that it receives, and information about a disputed debt may be communicated to third parties in the interim. The defendant also argued that the plaintiff lacked standing to sue because there was no negative impact on her credit score as a result of the dispute not being transmitted.
According to the court, the defendant’s “system tolerates the communication of false information in cases where disputes arrive at its doorstep at the close of its monthly reporting periods, and it lacks procedures for promptly correcting information it later discovers was false at the time it was communicated to a third party.” The court also found that the plaintiff’s constitutional standing does not depend on proof of damage to her credit score.
District Court: Defendants cannot use CFPB funding argument to dismiss deceptive marketing lawsuit
On November 18, the U.S. District Court for the Northern District of Illinois ruled that the CFPB can proceed in its lawsuit against a credit reporting agency, two of its subsidiaries (collectively, “corporate defendants”), and a former senior executive accused of allegedly violating a 2017 enforcement order in connection with alleged deceptive practices related to their marketing and sale of credit scores, credit reports, and credit-monitoring products to consumers. According to the court, a recent decision issued by the U.S. Court of Appeals for the Fifth Circuit, which found that the Bureau’s funding structure violates the Appropriations Clause of the Constitution (covered by a Buckley Special Alert), is a persuasive basis to have the lawsuit dismissed.
As previously covered by InfoBytes, the Bureau sued the defendants in April claiming the corporate defendants, under the individual defendant’s direction, allegedly violated the 2017 consent order from the day it went into effect instead of implementing agreed-upon policy changes intended to stop consumers from unknowingly signing up for credit monitoring services that charge monthly payments. The Bureau further claimed that the corporate defendants’ practices continued even after examiners raised concerns several times, and that the individual defendant had both the “authority and obligation” to ensure compliance with the 2017 consent order but did not do so.
The defendants sought to have the lawsuit dismissed for several reasons, including on constitutional grounds. The court disagreed with defendants’ constitutional argument, stating that, other than the 5th Circuit, courts around the country have “uniformly” found that Congress’ choice to provide independent funding for the Bureau conformed with the Constitution. “Courts are ill-equipped to second guess exactly how Congress chooses to structure the funding of financial regulators like the Bureau, so long as the funding remains tethered to a law passed by Congress,” the court wrote. The court also overruled defendants’ other objections to the lawsuit. “[T]his case is only at the pleading stage, and all the Bureau must do is plausibly allege that [the individual defendant] was recklessly indifferent to the wrongfulness of [the corporate defendants’] actions over which he had authority,” the court said, adding that the Bureau “has done so because it alleges that because of financial implications, [the individual defendant] actively ‘created a plan to delay or avoid’ implementing the consent order.”
The Bureau is currently seeking Supreme Court review of the 5th Circuit’s decision during its current term. (Covered by InfoBytes here.)
States reach multi-million dollar CRA data breach settlement
On November 7, a coalition of 40 state attorneys general, co-led by Massachusetts and Illinois, reached settlements with a credit reporting agency (CRA) and a telecommunications company related to data breaches in 2012 and 2015 that impacted the personal information of millions of consumers nationwide. According to the announcement, in 2012, an identity thief posing as a private investigator accessed and retrieved sensitive personal information, such as names, Social Security numbers, addresses, and/or phone numbers from a database company that the CRA purchased. The states claimed that the identity thief (who has since pleaded guilty to federal criminal charges for wire fraud, identity fraud, access device fraud, and computer fraud and abuse, among other charges) accessed the information prior to the acquisition and continued to do so afterwards. Affected consumers were allegedly never informed of the data breach. Later, in 2015, the CRA reported it experienced a data breach affecting personal information, including consumers’ driver’s license and passport numbers, as well as information used by the telecommunications company to make credit assessments, which the CRA stored on behalf of the telecommunications company. Following the breach, the CRA offered two years of credit monitory services to affected consumers.
Under the terms of the settlements (see here and here), the CRA has agreed to pay a combined total of $13.67 million to the states in connection with the 2012 and 2015 data breaches, and will strengthen its data security practices. According to the announcement, these measures will require the CRA to (i) maintain comprehensive incident response and data breach notification plans; (ii) strengthen the vetting and oversight of third parties that have access to consumers’ personal information; (iii) develop an Identity Theft Prevention Program to detect potential red flags in customer accounts; (iv) not misrepresent to consumers the extent to which the privacy and security of their personal information is protected; (v) strengthen due diligence provisions to ensure the CRA properly vets acquisitions and evaluates data security concerns prior to integration; and (vi) implement data minimization and disposal requirements, including undertaking specific efforts designed to reduce the use of Social Security numbers as an identifier. The CRA will also offer affected consumers five years of free credit monitoring services, during which time consumers will be able to receive two free copies of their credit report annually.
Separately, the telecommunications company agreed to pay more than $2.43 million to the states, and will maintain a written information security program, including vendor management provisions to ensure vendors take reasonable security measures to safeguard consumers’ personal information. This will involve, among other things, maintaining a third-party risk management team to oversee vendors’ security, outlining specific security requirements in vendor contracts, and employing a variety of security assessment and monitoring practices to confirm vendor compliance. The telecommunications company will also provide employee training on the requirements of its information security measures and implement a written cyber incident and response plan to prepare for and respond to security events.
6th Circuit affirms FCRA summary judgment
On November 4, the U.S. Court of Appeals for the Sixth Circuit affirmed a district court’s summary judgment ruling in favor of a credit reporting agency (defendant) accused of violating the FCRA. According to the opinion, a father and son (plaintiff) filed Chapter 7 bankruptcy petitions just over a year apart with the same attorney. Both petitions had their similar names, identical address, and, mistakenly, the plaintiff’s social security number. Although the attorney corrected the social security number on the father’s bankruptcy petition the day after it was filed, the defendant allegedly failed to catch the amendment and erroneously reported the father’s bankruptcy on the plaintiff’s credit report for nine years. When the plaintiff noticed the error, he sent the defendant a letter and demanded a sum in settlement. The defendant removed the father’s bankruptcy filing from the plaintiff’s credit report. The plaintiff sued two credit reporting agencies, alleging they violated the FCRA by failing to “follow reasonable procedures to assure maximum possible accuracy” of his reported information. One of the agencies settled with the plaintiff. A district court granted the other defendant’s motion for summary judgment, which the plaintiff appealed.
On the appeal, the 6th Circuit noted that the plaintiff “has standing to bring this action, but also agree that he cannot establish that [defendant’s] procedures were unreasonable as a matter of law.” The appellate court found that, because the defendant gathered information from reliable sources and because someone “with at least some legal training” would have had to manually review the bankruptcy docket to notice that the Social Security number had been updated, the defendant did not violate the FCRA. The appellate court wrote that the defendant’s “processes strike the right balance between ensuring accuracy and avoiding ‘an enormous burden’ on consumer credit reporting agencies.” Furthermore, the 6th Circuit stated that, “[g]iven the sheer amount of data maintained by these companies, we know that consumers are ‘in a better position . . . to detect errors’ in their credit reports and inquire about a fix.”
CFPB argues funding constitutionality holding does not make sense
On October 25, the CFPB responded to a notice of supplemental authority filed by a credit reporting agency (CRA) in the U.S. District Court for the Northern District of Illinois, which sought to use a recent decision issued by the U.S. Court of Appeals for the Fifth Circuit as justification for the dismissal of a lawsuit against the CRA. In April, the Bureau sued the CRA, two of its subsidiaries, and a former senior executive (collectively, “defendants”) for allegedly violating a 2017 consent order in connection with alleged deceptive practices related to their marketing and sale of credit scores, credit reports, and credit-monitoring products to consumers. (Covered by InfoBytes here.) Following the 5th Circuit’s decision, in which a three-judge panel unanimously held in CFSA v. CFPB that the CFPB funding structure created by Congress violated the Appropriations Clause of the Constitution (covered by a Buckley Special Alert), the defendants filed a notice of supplemental authority on October 20, arguing that the suit must be dismissed and that the Bureau may not use unappropriated funds when prosecuting the suit. The defendants further contended that the 2017 consent order is invalid because the Bureau used unappropriated funds in its preparation.
The Bureau countered in its response that the 5th Circuit’s holding does not “make sense,” is “without support in law,” and does not help the defendants’ defense. According to the Bureau, “the court mustered no case from more than 230 years of constitutional history that has ever held that Congress violates the Appropriations Clause or separation of powers when it authorizes spending by statute, as it did for the Bureau.” Moreover, the Bureau argued that the appellate court’s contention that the CFPB’s funding was “impermissibly ‘double-insulated’ from congressional oversight” was incorrect because “Congress is fully capable of overseeing the Bureau’s spending, including because of several provisions in the Bureau’s statute that ensure its ability to supervise.” Adding that the court “should reject” the 5th Circuit’s analysis and “join every other court to address the issue—including the en banc D.C. Circuit—in upholding the Bureau’s statutory funding mechanism,” the agency further argued that even if the district court should disagree with this contention, it should still deny the defendants’ motion to dismiss because any alleged defect in the agency’s funding authorization “would not deprive the Bureau of the power to carry out the responsibilities given it by Congress to enforce the law.”
7th Circuit: Plaintiff lacks standing to bring FCRA claim on credit report disputes
On October 18, the U.S. Court of Appeals for the Seventh Circuit affirmed dismissal of an FCRA action in favor of a defendant bank. According to the opinion, the plaintiff real estate investor obtained a loan secured by a mortgage from the defendant bank. The mortgage required the plaintiff to maintain a certain level of hazard insurance or the defendant bank could lender-place such insurance, with the cost of the lender-placed insurance amounts becoming additional debt secured by the mortgage. After the plaintiff underpaid on his flood insurance premiums, the defendant bank obtained lender-placed insurance. When the plaintiff did not pay the increased monthly payment associated with the lender-placed insurance amounts in full, the defendant bank informed the plaintiff that he was in default and that the entire amount of the loan would be accelerated if the default was not cured. While the plaintiff continued to submit partial payments, the defendant began reporting certain 2011 payments as 60 days or more late to the credit reporting agencies (CRAs). In 2012, the plaintiff disputed these purportedly late payments with the CRAs.
The plaintiff sued claiming, among other things, that the defendant violated the FCRA by failing to responsibly investigate the 2012 disputes. On appeal, after determining that the district court did not abuse its discretion by failing to rely on unsupported statements in the plaintiff's affidavit, the 7th Circuit found that the district court erred in requiring the plaintiff to prove damages as an element of his FCRA claim. However, the appellate court held that the plaintiff ultimately lacked standing to bring a claim under the FCRA because, as the appellate court highlighted, the injury that the plaintiff alleged—a decrease in his credit score in November 2011—could not be fairly traced to the defendant’s alleged action—a failure to reasonably investigate credit reporting disputes in January 2012.
District Court partially dismisses FDCPA suit concerning disputed debt
On October 5, the U.S. District Court for the District of Arizona partially granted a defendant’s motion to dismiss in an FDCPA suit, which alleged that the defendant furnished information to the credit reporting agencies (CRAs) that did not belong to the plaintiff. According to the order, the plaintiff noticed that the defendant was reporting a collection account to the CRAs for a debt he did not recognize. He called the defendant who was unable to locate the plaintiff through his personal identifiers. The defendant told the plaintiff that the debt reporting on the plaintiff’s credit report was a medical debt and was owed by a third party with a different name and a different social security number. After the defendant confirmed that the debt did not belong to him, the plaintiff submitted a dispute to the CRA challenging the defendant’s reporting of the debt and requested that the defendant and the CRA remove the debt from his report. The CRA notified the defendant of the plaintiff’s dispute within five days of receiving the dispute. The defendant allegedly continued to report the debt as belonging to the plaintiff to the CRA, and did not request that the CRA note on the plaintiff’s credit report that the debt was disputed by the plaintiff. The plaintiff claimed that the defendant violated the FDCPA, contending that his “credit score has decreased as a result of [the defendant’s] erroneous credit reporting, which has frustrated [the plaintiff’s] ability to obtain credit.” The plaintiff also alleged that he suffered emotional distress and anxiety.
The defendant argued that it did not violate the FDCPA because it was the CRA that connected the underlying debt to the plaintiff’s credit report. The defendant also argued that the plaintiff did not provide the defendant with an appropriate period of time to mark the debt as disputed before filing the suit in question. The court found that the plaintiff had stated a claim upon which relief could be granted, explaining, among other things, that the defendant “does not point to any authority that, to state a claim under § 1692e(8), reporting of a debt must be to a credit report as opposed to any third party.” However, the court dismissed the § 1692f claim on the ground that the underlying conduct was already covered in the 1692e(8) claim.
District Court grants summary judgment in FCRA and FDCPA suit
On September 30, the District Court for the Northern District of New York granted a defendant’s motion for summary judgment in an FCRA and FDCPA suit. According to the order, the plaintiff allegedly discovered that the defendant communicated incorrect information regarding a debt to credit reporting agencies (CRAs) and subsequently began disputing the debt. The defendant confirmed that the tradeline was accurate and that the account had been paid in full. The plaintiff then sent letters to the different CRAs, the original creditor, and the defendant, claiming that the information being communicated was inaccurate. The plaintiff continued to receive responses indicating that the information being reported was accurate and that the account had been paid in full. The plaintiff then received a letter from a bank rejecting his application for a credit card on the basis that they had received negative information about the plaintiff’s credit from a credit reporting agency. The plaintiff claimed that the defendant violated the FCRA by failing to conduct a reasonable investigation, failing to review information provided by the CRAs, and failing to modify or delete information it could not verify as accurate. The court disagreed, finding that the defendant’s investigations were “reasonable under the circumstances,” given that the plaintiff’s disputes contained “various misleading descriptions that indicated” the debt was not the plaintiff’s, when he had admitted in other circumstances it was. Regarding the FDCPA claim, the court noted that “even if this information was false or inaccurate, there is no evidence whatsoever that it was communicated in connection with the collection of a debt.”