On November 4, 2021, the Consumer Financial Protection Bureau published a sixteen-page advisory opinion to highlight that a consumer reporting agency that uses inadequate matching procedures to match information to consumers, including name-only matching (i.e., matching information to the particular consumer who is the subject of a consumer report based solely on whether the consumer’s first and last names are identical or similar to the names associated with the information), in preparing consumer reports (for credit, employment and rental housing)is not using reasonable procedures to assure maximum possible accuracy under section 607(b) of the Fair Credit Reporting Act (FCRA). The advisory opinion was effective upon publication in the Federal Register on November 10, 2021.
Director Chopra’s Statement – Also on November 4, CFPB Director Rohit Chopra issued a statement on the topic. Among other comments he stated, “Errors are particularly common when using name-only matching given that many individuals have the same or similar names, meaning that it’s not unlikely that thousands, even tens of thousands, of individuals, may share a particular first and last name combination. Of course, name-only matching is only one example of inadequate and skimpy procedures, and nothing in today’s advisory opinion suggests that the responsibility to follow reasonable procedures to assure maximum possible accuracy can be met with a thoughtless application of any particular loose matching criteria, even if more than names alone are matched. And I would warn consumer reporting companies against trying to evade their responsibilities under the FCRA simply by issuing a disclaimer that their report might not be matched to the right person.”
He further stated, “Following the issuance of today’s opinion, the CFPB intends to take a number of additional steps:
- First, the CFPB will be closely collaborating on enforcement actions with the Federal Trade Commission in this market. The FTC has begun to take its consumer protection responsibilities more seriously, particularly when it comes to abuse and misuse of personal data. In the background screening context, the FTC may be able to prosecute unfair or deceptive conduct not covered by the Consumer Financial Protection Act.
- Second, when prosecuting violations under the Fair Credit Reporting Act, in addition to civil penalties, the CFPB will seek to redress the full range of harms to victims, in addition to civil penalties. The law authorizes the CFPB to seek restitution and damages for violations of the FCRA. In situations where sloppy practices lead to loss of employment and housing opportunities, the harms to victims can be substantial. In addition, the CFPB will make appropriate referrals, including to the Department of Justice’s Civil Rights Division, when the conduct might implicate violations of anti-discrimination laws.
- Finally, the CFPB will be supporting the FTC in its work to monitor business models that rely on harvesting and monetizing personal data. Big Tech giants and less well-known data brokers may be trafficking data and consumer reports that triggers obligations under the FCRA, including restrictions on permissible purposes. The CFPB will be using its tools to ensure that individuals are protected in accordance with the law.”