InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
NYDFS finds credit card underwriting showed no evidence of wrongdoing
In March, NYDFS released a report detailing the findings of an investigation into whether a global technology company and a New York state-chartered bank allegedly discriminated against women when making underwriting decisions for a co-branded credit card. According to the report, in 2019, allegations were made that the bank offered lower credit limits to women applicants and unfairly denied women accounts. NYDFS launched a fair lending investigation into the allegations and reviewed underwriting data for nearly 400,000 New Yorker residents, but ultimately found no evidence of unlawful disparate treatment or disparate impact. Among other things, the report noted that the bank “had a fair lending program in place for ensuring its lending policy—and underlying statistical model—did not consider prohibited characteristics of applicants and would not produce disparate impacts.” The bank also identified the factors it used when making the credit decisions, including credit scores, indebtedness, income, credit utilization, missed payments, and other credit history elements, all of which, NYDFS stated, appeared to be consistent with its credit policy.
3rd Circuit: Plaintiff must arbitrate debt adjustment allegations
On March 24, the U.S. Court of Appeals for the Third Circuit determined that a plaintiff must arbitrate proposed class claims brought against a debt resolution law firm. The plaintiff alleged the law firm engaged in racketeering, consumer fraud, and unlawful debt adjustment practices in violation of various New Jersey laws. The district court denied the firm’s motion to compel arbitration, applied the law of the forum state, New Jersey, and ruled that the arbitration provision was invalid and unenforceable. The law firm appealed, arguing, among other things, that the arbitration provision would have been found valid if the district court had applied Delaware law in accordance with the parties’ 2013 professional legal services agreement. On appeal, the 3rd Circuit disagreed with the district court, holding that the arbitration provision demonstrated that the plaintiff gave up her right to litigate her claims in court, despite there appearing to be a true conflict between Delaware and New Jersey law. The appellate court concluded that the arbitration clause met the standard set forth in Atalese v. U.S. Legal Services Group, L.P., which held that an arbitration provision “will pass muster if it, ‘at least in some general and sufficiently broad way,. . .explain[s] that the plaintiff is giving up her right to bring claims in court or have a jury resolve the dispute.’” Moreover, the 3rd Circuit noted that the arbitration provision was also sufficiently broad enough to reasonably encompass the plaintiff’s statutory causes of action.
Illinois enacts 36 percent rate cap for consumer loans, creates state community reinvestment act
On March 23, the Illinois Governor signed the Predatory Loan Prevention Act, SB 1792, which prohibits lenders from charging more than 36 percent APR on all non-commercial consumer loans under $40,000, including closed-end and open-end credit, retail installment sales contracts, and motor vehicle retail installment sales contracts. For purposes of calculating the APR, the act requires lenders to use the system for calculating a military annual percentage rate under the Military Lending Act. Any loan with an APR exceeding 36 percent will be considered null and void “and no person or entity shall have any right to collect, attempt to collect, receive, or retain any principal, fee, interest, or charges related to the loan.” Additionally, a violation constitutes a violation of the Illinois Consumer Fraud and Deceptive Business Practices Act, and carries a potential fine up to $10,000. The act also contains an anti-evasion provision that prohibits persons or entities from “making loans disguised as a personal property sale and leaseback transaction; disguising loan proceeds as a cash rebate for the pretextual installment sale of goods or services; or making, offering, assisting, or arranging a debtor to obtain a loan with a greater rate or interest, consideration, or charge than is permitted by this Act through any method including mail, telephone, internet, or any electronic means regardless of whether the person or entity has a physical location in the State.”
The same day, the governor also signed SB 1608, which, among other things, creates a state version of the Community Reinvestment Act. The act will allow the state to assess whether covered financial institutions, including state-chartered banks, credit unions and non-bank mortgage lenders, are meeting the needs of local communities, including low-income and moderate-income neighborhoods. Financial institutions’ lending practices and community development/redevelopment program investments will be examined by the Secretary of Financial and Professional Regulation, who is granted the authority to conduct examinations in compliance with other state and federal fair lending laws including, but not limited to, the Illinois Human Rights Act, ECOA, and HMDA.
Both acts are effective immediately.
New York law prohibiting paper billing statement fees is an unconstitutional restriction of commercial speech
On March 16, the U.S. District Court for the Northern District of New York dismissed a putative class action with prejudice over whether a national bank violated state law by charging a fee for paper billing statements in certain circumstances. The consumer’s suit alleged violations of N.Y. Gen. Bus. Law § 399-zzz as well as N.Y. Gen. Bus. Law § 349, which prohibits deceptive acts and practices. The bank argued, among other things, that (i) the consumer’s § 399-zzz claim was preempted by the National Bank Act (NBA); (ii) the consumer’s interpretation of § 399-zzz “would prevent [the bank] from exercising its federally authorized power to charge non-interest fees”; (iii) § 399-zzz is unconstitutional under the First Amendment because it limits the bank’s communication of fees and pricing to consumers; (iv) the statute does not apply to national banking institutions like the defendant; and (v) the statute does not prohibit the conduct at issue. The court disagreed, ruling that § 399-zzz is not preempted by the NBA because paper statement fees are not limited to only banking institutions. Moreover the court determined that the state statute is a rule of general application and “does not prevent or significantly interfere with [the bank’s] exercise of its powers.” However, the court ultimately dismissed the consumer’s action, agreeing that § 399-zzz constitutes an unconstitutional restriction on the bank’s First Amendment right of commercial speech under intermediate scrutiny. According to the court, § 399-zzz regulates “how businesses can communicate their fees” by “prohibit[ing] businesses from charging consumers for receiving a paper statement” but permits businesses “to offer consumers a credit for receiving an electronic statement instead of a paper statement.” The court also ruled that the consumer failed to state a claim for a deceptive act or practice because §399-zzz unconstitutionally infringes on the bank’s First Amendment rights.
Utah creates certain affirmative defenses for data breaches
On March 11, the Utah governor signed HB 80, which provides entities an affirmative defense for a data breach if they follow certain cybersecurity industry standards. Among other things, a “person that creates, maintains, and reasonably complies with a written cybersecurity program” that meets specific safeguard requirements to protect personal information and is in place at the time of the data breach has an affirmative defense to claims brought under Utah law or in the courts of the state that allege the person failed to implement reasonable information security controls that resulted in the data breach. A person also has an affirmative defense to claims regarding the failure to appropriately respond to a data breach or provide notice to affected individuals as long as the written cybersecurity program contained specific protocols at the time of the breach that “reasonably complied with the requirements for a written cybersecurity program” for responding to a data breach or for providing notice. HB 80 also outlines the components that a written cybersecurity program must include to be eligible for an affirmative defense, and is effective 60 days following adjournment of the legislature.
Court rules CDC eviction moratorium unconstitutional
On February 25, the U.S. District Court for the Eastern District of Texas granted plaintiffs’ motion for summary judgment, ruling that decisions to enact eviction moratoriums rest with the states and that the federal government’s Article I power under the U.S. Constitution to regulate interstate commerce and enact necessary and proper laws to that end “does not include the power” to order all evictions be stopped during the Covid-19 pandemic. The Centers for Disease Control and Prevention (CDC) issued an eviction moratorium order last September (set to expire March 31), which “generally makes it a crime for a landlord or property owner to evict a ‘covered person’ from a residence” provided certain criteria are met. The CDC’s order grants the DOJ authority to initiate criminal proceedings and allows the imposition of fines up to $500,000. The plaintiffs—owners/managers of residential properties located in Texas—argued that the federal government does not have the authority under Article I to order property owners to not evict specified tenants, and that the decision as to whether an eviction moratorium should be enacted resides with the given state. The CDC countered that Article I afforded it the power to enact a nationwide moratorium, and argued, among other things, that “evictions covered by the CDC order may be rationally viewed as substantially affecting interstate commerce because 15% of changes in residence each year are between States.”
However, the court disagreed stating that the CDC’s “statistic does not readily bear on the effects of the eviction moratorium” at issue, and that moreover, “[i]f statistics like that were enough, Congress could also justify national marriage and divorce laws, as similar incidental effects on interstate commerce exist in that field.” The court determined that the CDC’s eviction moratorium exceeds Congress’ powers under the Commerce Clause and the Necessary and Proper Clause. “The federal government cannot say that it has ever before invoked its power over interstate commerce to impose a residential eviction moratorium,” the court wrote. “It did not do so during the deadly Spanish Flu pandemic. . . .Nor did it invoke such a power during the exigencies of the Great Depression. [] The federal government has not claimed such a power at any point during our Nation’s history until last year.”
The DOJ issued a statement on February 27 announcing its decision to appeal the court’s decision, citing that the court’s order “‘does not extend beyond the particular plaintiffs in that case, and it does not prohibit the application of the CDC’s eviction moratorium to other parties. For other landlords who rent to covered persons, the CDC’s eviction moratorium remains in effect.’”
Washington passes law allowing mortgage employees to work from home
On March 24, the Washington legislature passed SB 5077, allowing licensed mortgage loan originator activity to be conducted from the mortgage loan originator’s residence if, among other things, certain state and information security requirements are satisfied.
3rd Circuit: ECOA does not preempt NJ’s common-law doctrine of necessaries in FDCPA case
On March 16, the U.S. Court of Appeals for the Third Circuit held that because ECOA does not preempt New Jersey’s common-law doctrine of necessaries (where a spouse is jointly liable for necessary expenses incurred by the other spouse) a defendant debt collector was permitted to send medical debt collection letters to a deceased individual’s spouse without violating the FDCPA. The defendant was retained to collect the deceased spouse’s medical debt and sent collection letters to the plaintiff who maintained she was not responsible for the debt and subsequently filed suit alleging violations of the FDCPA. The defendant moved for dismissal, arguing that the plaintiff owed the debt under New Jersey’s doctrine of necessaries because her deceased spouse incurred the debt for medical treatment. The district court agreed and dismissed the case. The plaintiff appealed, arguing, among other things, that the doctrine of necessaries conflicts with the spousal-signature prohibition found in the ECOA.
In affirming the district court’s dismissal, the 3rd Circuit concluded that “ECOA does not preempt the doctrine of necessaries because the debt is ‘incidental credit’ exempt from the prohibition.” According to the 3rd Circuit, the Federal Reserve Board determined that incidental credit is exempt from the § 202.7(d) spousal-signature prohibition because it “refers to extensions of consumer credit. . .(i) [t]hat are not made pursuant to the terms of a credit card account; (ii) [t]hat are not subject to a finance charge. . .and (iii) [t]hat are not payable by agreement in more than four installments.” The 3rd Circuit determined that because the medical debt in question satisfied all three criteria, the spousal-signature prohibition did not apply, and therefore ECOA and its regulations did not conflict with the doctrine of necessaries. Further, the 3rd Circuit held that ECOA focuses “on ensuring the availability of credit rather than the allocation of liability between spouses.”
California again modifies CCPA regs; appoints privacy agency’s board
On March 15, the California attorney general announced approval of additional regulations implementing the California Consumer Privacy Act (CCPA). The CCPA—enacted in June 2018 (covered by a Buckley Special Alert) and amended several times—became effective January 1, 2020. According to the announcement, the newly-approved amendments strengthen the language of CCPA regulations approved by OAL last August (covered by InfoBytes here). Specifically, the new amendments:
- Require businesses selling personal information collected in the course of interacting with consumers offline to provide consumers about their right to opt out via offline communications. Consumers must also be provided instructions on how to submit opt-out requests.
- Provide an opt-out icon for businesses to use in addition to posting a notice of right to opt-out. The amendments note that the opt-out icon may not be used in lieu of requirements to post opt-out notices or “do not sell my personal information” links.
- Require companies to use opt-out methods that are “easy” for consumers to execute and that require “minimal” steps to opt-out. Specifically, a “business’s process for submitting a request to opt-out shall not require more steps than that business’s process for a consumer to opt-in to the sale of personal information after having previously opted out.” Additionally, except as otherwise permitted by the regulations, companies are prohibited from requiring consumers to provide unnecessary personal information to implement an opt-out request, and may not require consumers to click through or listen to reasons as to why they should not submit an opt-out request. The amendments also state that businesses cannot require consumers “to search or scroll through the text of a privacy policy or similar document or webpage to locate the mechanism for submitting a request to opt-out.”
The AG’s press release also notes that the California Privacy Rights Act (CPRA), which was approved by voters last November and sought to amend the CCPA, will transfer some of the AG’s responsibilities to the California Privacy Protection Agency (CPPA), covered by InfoBytes here; however, the AG will retain the authority to go to court to enforce the law. Enforcement of the CPRA will begin in 2023.
Additionally, on March 17, the California governor announced appointments to the five-member inaugural board for the CPPA, consisting of experts in privacy, technology, and consumer rights. The CPPA is tasked with protecting the privacy rights of consumers over their personal information, and “will have full administrative power, authority, and jurisdiction to implement and enforce” the CCPA and the CPRA, including bringing enforcement actions before an administrative law judge.
D.C. enacts law extending obligations for debt collection, credit reporting, mortgage servicing, and evictions
On March 17, the mayor of D.C. signed the Coronavirus Support Emergency Amendment Act of 2021. The act extends the most provisions of D.C.’s prior Covid-19 relief act (previously covered here and here) through June 15. Among other things, the act includes consumer protection provisions, including provisions regarding debt collection and credit reporting. It also provides housing and tenant protections, including in the areas of mortgage payment and late fee relief, and restrictions on evictions and foreclosures.