Broadening Definition of Data Subject to FCRA Not just credit report, - PowerPoint PPT Presentation

A Worsening FCRA Environment: A Checklist for Getting The Consumer and Employee Information You Need March 18, 2014 Michael O’Neil, Chicago Travis Nelson, Princeton Mark Melodia, Princeton

Broadening Definition of Data Subject to FCRA Not just “credit report,” but “consumer report ” • Definition of the data regulated by FCRA is broad 15 U.S.C.1681a(d)(1) • Oral , written or other communication of information delivered by a “consumer reporting agency” (circular definition, because “consumer report” defined as data delivered by CRA) • Bearing on a person’s credit worthiness, character, personal characteristics or mode of living • “Which is used or expected to be used, or collected in whole or in part for the purpose of serving as a factor in eligibility” for credit, insurance, employment or other “permissible purpose” • Any info originally collected by a CRA for these purposes is subject to FCRA, even if not used for such a purpose • Using information for an eligibility decision may give rise to application of FCRA 2

Questions for Vendors • What are sources of data? • Is it a data broker? • Is it a CRA? • Do other clients of data source ever use data for eligibility decisions? • What are contractual restrictions on use of data? Basis for restrictions? • If user intends to use the data to make a decision on the consumer’s eligibility for credit, insurance, employment, what are restrictions? • Note : even if data not sole basis for eligibility decision, if used “in whole or in part,” it may be FCRA data • How does vendor market data (e.g., is it described as useful for eligibility decisions?) • If so marketed, data is “expected to be used” for eligibility decision, and may be subject to FCRA 3

Regulatory Examinations & Enforcement “Credit reporting companies exert great influence over the lives of consumers. They help determine eligibility for loans, housing, and sometimes jobs. Consumers need an avenue of recourse when they feel they have been wronged.” – Richard Cordray, Director, CFPB 4

Overview of CFPB Authority • Scope of enforcement authority • Covered persons; service providers; related parties • Organizational issues – “ Supervision, Enforcement & Fair Lending Division” • Sub-units can operate independently • Enforcement by civil or administrative action • Pros and cons of civil enforcement action • Interagency cooperation – and information sharing • Prudential regulators (OCC, FDIC, Fed) • Federal Trade Commission • State attorneys general 5

Key Events in Build-up to CFPB FCRA Enforcement • July 21, 2011: FCRA rulemaking and enforcement transfers to the CFPB • Providers of consumer financial products and services • April 13, 2012: CFPB issues guidance on service providers/vendors • July 16, 2012: CFPB designates CRAs with more than $7 million in annual receipts as “larger participants” – effective Sept. 30, 2012 • Extends CFPB jurisdiction to 30 companies accounting for 94 percent of the CRA market • Oct. 31, 2012: CFPB issues Supervision & Examination Manual – including nearly 100 pages dedicated to FCRA examination protocols and commentary 6

Key Events in Build-up to CFPB FCRA Enforcement (cont.) • June 25, 2013: CFPB issues Bulletin 2013- 06 on “enforcement expectations • Factors CFPB considers in determining whether to bring an enforcement action • CFPB’s indicia of “responsible business conduct” • Aug. 9, 2013: CFPB Deputy Enforcement Director gives preview of FCRA enforcement posture • Consumer’s right to dispute consumer report is “truly fundamental” • CFPB will supervise and regulate “the entire ecosystem” of credit reporting • CFPB will examine and pursue service providers/vendors • Sept. 4, 2013: CFPB issues Bulletin 2013-09 on FCRA supervisory expectations of “furnishers” of consumer report information • Jan. 8, 2014: Richard Cordray says in “The Daily Show” interview that the CFPB will pursue senior executives as corporations for fines, suspensions from the industry, and criminal referrals • “CRAs need to fix these problems and be more responsive” 7

Regulators’ Focus on Third -Party Relationships/Vendors • Guidance on third-party relationships • Pre-contracting due diligence • Essential elements of the contract • Post-contracting on-going monitoring 8

CFPB Enforcement Powers and Actions • CFPB formal enforcement actions can be done jointly with prudential regulators • Enforcement tools: • Injunctive relief • Civil money penalties • $5,000/day for violations, regardless of fault • $25,000/day for reckless violations • Up to $1 million/day for “knowing” violations • Representative enforcement remedies • Prior CFPB enforcement actions • July 2012: CFPB/OCC; $150 million in restitution; $70 million in fines • Sept. 2012: CFPB/FDIC; $200 million in restitution; $14 million in fines • Oct. 2012: CFPB/FDIC; $85 million in restitution; $27.5 million in fines • Sept. 2013: CFPB/OCC; $309 million in restitution; $80 million in fines • Dec. 2013: CFPB/FDIC/OCC; $60 million in restitution; $16.2 million in fines 9

Dealing with CFPB Examinations • Have well-developed policies and procedures • Including vendor management policies • Beware of books and records violations • Designate a central point of contact to coordinate examination matters and deliver requested information – the “Examination Manager” • Make sure that the examiners’ requests are promptly met • Have a plan for responding to requests for privileged material • Consult outside regulatory counsel • Clearly document minutes of exit meetings and forward to regulatory counsel 10

Surviving a CFPB Investigation/Enforcement Action What to do and not do when the gov’t comes calling! • Know the rules: Must be • Do not overreact: familiar with the examination Sometimes more regulators/ policies and informal guidance enforcement counsel are brought than are necessary – of the regulators • Involve counsel Shock and Awe! immediately: Comments in • Know the players: Learn exit interview or supervisory the relative authority and roles correspondence. Protection of of the supervisory staff. privilege and document Partner with local examiners to control. avoid escalation. • Review comparable • The examiners do not enforcement actions: just “go away” – remember What remedies have the their unique role regulators sought in the past? Consider corrective action. 11

Explosion of FCRA Class Litigation “Perfect storm” of several phenomena gives rise to increased FCRA class litigation • Generous remedies available under the FCRA • Statute allows lawsuit for violation of ANY provision of the broad statute • Statute allows for recovery of statutory damages of $100 - $1,000 (in lieu of “actual damages”) and punitive damages • Statutory damages are awardable even if the consumer did not suffer any damages as result of willful violation • U.S. Supreme Court decision in 2007 ( Safeco Insurance v. Burr ) lowered standard for “willfulness” to “recklessness,” i.e., something more than negligence but less than knowing • Therefore, for example, proof that a business practice was brought into question by an FTC staff opinion letter or court may establish “willfulness” • Constitutional “standing” requirement that federal court plaintiff must have suffered harm met by allegation that statute violated • Spokeo ; SCOTUS in Edwards v. First American ducked issue of whether Congress can manufacture constitutional standing by reversing decision to take case after briefing 12

Explosion of FCRA Class Litigation (cont.) • FCRA claims are ripe for class treatment under existing caselaw • FCRA class claims often challenge the standardized business practices that treat a group of consumers similarly (e.g., obtaining same data on all credit applicants or employees). Therefore, there is a common nucleus of facts. • No individualized issues in establishing that each class member was harmed (since no statutory harm requirement) • No individualized issues in determining each class member’s “damages” (because statute sets range of damages that, in theory, can be applied across the class) • Courts have reversed prior caselaw, and now refuse to consider the annihilating effect of a class-wide statutory damages claim, regardless of the obvious constitutional problems with such awards in the face of technical violations of the law that cause no harm. E.g., Bateman v. American Multi-Cinema , 623 F. 3d 708 (9th Cir. 2010) (FACTA case for including more than last 5 digits of account number on credit receipt; 290,000 receipts could lead to $290 million award; Murray v. GMAC , 434 F. 3d 948 (7th Cir. 2006) (court should deal with due process issue post-trial)). • Unlike other federal consumer protection statutes (e.g., FDCPA), there is no cap on class award (e.g., $500,000 or 1 percent of defendant’s net worth) in FCRA 13

Questions Michael O’Neil Partner Chicago michael.oneil@reedsmith.com +1 312 207 2879 Travis P. Nelson Counsel Princeton tnelson@reedsmith.com +1 609 524 2038 Mark S. Melodia Partner Princeton mmelodia@reedsmith.com +1 609 520 6015 14