This year’s PBSA 2024 Mid-Year Legislative & Regulatory Conference covered a slew of interesting topics, including potential changes by the Consumer Financial Protection Bureau (CFPB). Last year, we shared an overview about these changes in interpretation of the Fair Credit Reporting Act (FCRA) and the way the CFPB enforces the statutes.

In this blog post, we’ll provide a recap of updates and new considerations that were shared at the 2024 Mid-Year Conference. 

Two recent CFPB advisory opinions

In January 2024, the CFPB issued two advisory opinion letters related to requirements of the FCRA. CFPB advisory opinion letters are interpretive statements showing how the bureau would respond in a challenge. However, not following the advice in the opinion letters would be construed by the CFPB as a “willful violation” of the FCRA. Below are two recent opinions of note.

File Disclosure

This piece of guidance appears to require all consumer requests for any information on them to be treated as a “full file disclosure” request regardless of the language used by the consumer. Additionally, it requires the disclosure of not only the source of information, such as the court, but also all vendors of that data, from the original source to the final reporting source.

There are a couple of concerns that surfaced at the conference regarding this guidance. Aside from the burden on all who touch the data between source and report, this will likely create frustration and confusion for the consumer, who typically is most concerned with what was on the report itself. 

Reasonable Procedures & Accuracy

This advisory opinion laid out three scenarios in which the CFPB would construe that a CRA does not use reasonable procedures to assure maximum possible accuracy. These situations are as follows:

1. If the CRA reports duplicative information, which could potentially mean a conviction for a sex related offense and the resulting registration on the sex offender registry. 
2. If the CRA reports expunged, sealed, or otherwise legally restricted from public access records.
3. If the CRA fails to include any existing disposition information for reported arrests, criminal charges, eviction proceedings or other court filings. For example, if a CRA reports an eviction proceeding but doesn’t report that the eviction charge was dismissed, the CFPB would interpret this as the CRA not using reasonable procedures to assure maximum possible accuracy.
   

CFPB proposed rulemaking

In the fall of 2023, the CFPB shared proposals for its upcoming rulemaking related to medical debt and the use of data for marketing and advertising purposes. In reviewing the CFPB’s outline of proposals under consideration, it appears that the proposed rule will encompass much more than medical debt and using data for marketing. It could significantly change the face of the background check industry. 

The CFPB’s Notice of Proposed Rulemaking is expected this year, and could come as early as mid-April. While the CFPB’s proposed rule is aimed at protecting consumers’ credit from the impact of medical debt and protecting consumers’ data from being used for marketing and advertising purposes, it would likely also have a sweeping effect on the background check industry and data providers. Exemptions to the rulemaking will likely be included by the bureau, but they are not expected to fully address the background check or data provider industries.

PBSA sent groups to Capitol Hill (Advocacy Day) to ask for bipartisan support to ask the CFPB to use an “Advanced Notice of Proposed Rulemaking” in addition to the expected “Notice of Proposed Rulemaking.”

The Advanced Notice would give the public a chance to give comments before the Notice itself is released and hopefully help the CFPB reshape the Notice to avoid unintended consequences that would harm consumers.

Effects on background check and data providers

The CFPB is likely aiming its data broker rules at large players like Amazon, Target and Facebook who often collect and sell data for marketing and advertising purposes. However, based on what the CFPB has released so far, data providers who collect and sell data for other purposes, such as Trust & Safety, will be affected. In addition to adding even more complex compliance requirements for consumer reports, the CFPB’s interpretation of FCRA requirements on CRAs will likely create more ambiguity and cause more consumer confusion rather than less. 

Below are some potential effects of the upcoming rulemaking:

• If information on a consumer report is not accurate, consumers may need to reach out to not only the background check company who provided the report, but also each vendor and the original source to make corrections, creating a burden on the consumer.
• Credit header data could be deemed a consumer report. Bureaus could then only sell credit header data for an FCRA permissible purpose. 
• Data brokers could be deemed CRAs, and therefore all data collected would be subject to the FCRA. This could have the unintended consequence of ending, or severely limiting, the Trust & Safety space.
  

What next?

As impending changes to interpretation of FCRA rules and additional legislation approach, it’s imperative for background check providers to stay informed. Proactively adjusting processes and policies to maintain compliance and a commitment to the highest standards of data accuracy and privacy will be crucial in effectively navigating this evolving landscape. 

If you’re looking to enhance your criminal database sources in anticipation of these upcoming regulatory changes, we invite you to connect with us. Our team of experts would love to chat about industry-leading product lines, ranging from automated criminal records at state and county levels to our comprehensive national criminal database. You can get in touch with us here.