CFPB Issues Advisory Opinion on FCRA and Permissible Purpose
As NAFCU reported last week, on July 7th the CFPB published an advisory opinion regarding “Fair Credit Reporting; Permissible Purposes for Furnishing, Using, and Obtaining Consumer Reports.” The CFPB also released this press release about the advisory opinion. While much of the focus of the advisory opinion is on credit reporting agencies (CRAs), the advisory opinion does discuss requirements for entities that obtain and use credit reports. The advisory opinion reminds users of reports that they must have a permissible purpose to obtain and use a consumer report.
Section 604(f) of the FCRA states that:
“A person shall not use or obtain a consumer report for any purpose unless
(1) the consumer report is obtained for a purpose for which the consumer report is authorized to be furnished under this section; and
(2) the purpose is certified in accordance with section 607 [§ 1681e] by a prospective user of the report through a general or specific certification.”
Section 604(a) discusses what the FCRA considers a permissible purpose:
“(2) In accordance with the written instructions of the consumer to whom it relates.
(3) To a person which it has reason to believe—
(A) intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer;
(F) otherwise has a legitimate business need for the information—
(i) in connection with a business transaction that is initiated by the consumer; or
(ii) to review an account to determine whether the consumer continues to meet the terms of the account…”
Generally, the three above provisions constitute the three main permissible purposes used by credit unions. Credit unions may want to pay particular care to ensure that they have a permissible purpose, as the CFPB states that “section 604(f) clearly imposes a strict prohibition on using or obtaining a consumer report without a permissible purpose.” Furthermore, in footnote 32 of the advisory opinion, the CFPB notes that:
“[p]ursuant to FCRA sections 616 and 617, a person is civilly liable to a consumer for violations of section 604(f) if they have negligently or willfully failed to comply with the requirement.”
As an example, the advisory opinion discusses a settlement with State Farm Bank on an issue where the CFPB alleged that, among other things, agents of the bank incorrectly inputted customer information and subsequently sought consumer reports for the wrong consumer. The CFPB states that this violated the FCRA’s permissible purpose provisions and the consumers’ privacy. Unfortunately, the advisory opinion does not discuss to what extent a consumer’s written instruction provides a permissible purpose or whether a credit union can reuse a credit report. For a more in-depth discussion on these topics and permissible purpose in general, NAFCU members can review this NAFCU Compliance Monitor article on the subject.
About the Author
Keith Schostag joined NAFCU as regulatory compliance counsel in February 2021. In this role, Keith assists credit unions with a variety of compliance issues.