On Sept. 21, 2023, the Consumer Financial Protection Bureau (CFPB) officially announced it is considering a rulemaking to address several consumer reporting topics under the Fair Credit Reporting Act (FCRA). Under the process established by Congress in the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA), the CFPB is required to consult with representatives of small entities likely to be affected directly by the regulations. Thus, the CFPB convened a panel of Small Entity Representatives (SERs) to consider and provide feedback on its proposals and alternatives under a condensed time frame of approximately one month.
Notably, the proposed ideas in the outline include sweeping changes to the process of medical debt credit reporting and the use of information related to nonpayment of medical debt for underwriting purposes.
The CFPB previously announced a public inquiry for data brokers, which taken together reveal plans to add significant new requirements and compliance burdens to a range of industries. It also subsequently issued proposed rules on 1033. The proposals set forth have the potential to affect creditors that use medical debt collection information, Consumer Reporting Agencies (CRAs), furnishers, data brokers, data aggregators and entities that make data available to aggregators.
Medical Debt Reporting
The CFPB’s proposal is in line, but goes further, than recent pressure on credit bureaus to permanently remove medical debt from credit reports. On July 1, 2022, previous regulator intervention resulted in the CRAs announcing that they would be removing credit reporting for debt under $500 at the beginning of 2023.
The CFPB has argued that despite 20% of Americans holding medical debt, this data is not predictive of an individual’s repayment of financial obligations. The CFPB states that the rules are designed to prevent common billing errors and the complex insurance and billing dispute process from stopping those seeking to obtaining credit from receiving more generous lines of credit and favorable interest rates. However, industry stakeholders have pointed out that it could make the cost of medical care more expensive and cause consumers to be forced to pay more in upfront fees.
More specifically, the CFPB proposes modifying a regulatory exemption originally promulgated by a group of federal banking agencies and the National Credit Union Administration that allows creditors to consider a consumer’s medical debt information when underwriting credit and would prohibit consumer reporting agencies from including medical collection tradelines in consumer reports provided to creditors. The CFPB is also considering proposals that would change an exemption that allows creditors to consider a consumer’s medical debt when underwriting credit and would prohibit consumer reporting agencies from including medical collection tradelines on consumer reports.
Data Broker and Credit Header Regulation
The CFPB’s proposed rules also include sweeping changes to the definitions of data brokers and consumer reporting agencies and their ability to utilize data they gather. Their inclusion in the SBREFA panel is a continuation of a rule-making process that began on Aug. 15.
The proposals expand the definition of data brokers and CRAs to encapsulate more organizations based on the use of the data they disclose regardless of the intent of it being provided.
The regulations would limit the sale of certain data broker data for advertising or marketing, for the most part constraining the sale of data to only those companies or persons to whom the consumer applied for credit, insurance, employment, housing or some other service or to whom the consumer otherwise authorized access.
In addition, the rules subject certain data brokers to FCRA obligations. CFPB specifically proposes inclusion of credit header data in the definition of a “consumer report” As it stands, the FCRA has established requirements for how a creditor or other furnisher of information to a credit bureau must respond to direct and indirect disputes involving credit report information appearing on an individual’s credit report. The FCRA also requires that any attempt to access a consumer’s credit report be made with a “permissible purpose.” By broadening the definition of consumer report to include “credit header data,” the CFPB will create substantial confusion as to many financial institutions’ compliance obligations and will likely call into question certain customary procedures.
Industry Weighs In
On Nov. 6, several industry commenters weighed in on the SBREFA outline. On medical debt reporting, the Bank Policy Institute (BPI), Consumer Bankers Association (CBA) and The Clearing House (TCH) raised concern, noting that removing certain credit attributes from the credit reporting system without conducting a thorough analysis “would create a real risk that banks would be unable to meet their consumer protection obligations or safety and soundness requirements.” The American Hospital Association (AHA) noted that “It is possible that this proposal could remove an incentive for individuals to get insurance if they believe they can rely on not paying their bills. While hospitals offer financial assistance, such assistance is not a substitute for comprehensive health insurance and, as a result, patients who choose to forego coverage may face a barrier to routine preventative and restorative care. It is also possible that this proposal may incentivize patients to forego paying bills for care that they received and for which they have been determined liable.”
Within the data broker regulation, the National Association of Federally-Insured Credit Unions (NAFCU) and the Credit Union National Association (CUNA) stated that the broad proposed data broker definition “has the potential to limit the use of alternative data to assist more consumers in obtaining credit.” The American Fintech Council’s (AFC) comment letter detailed that the proposed data broker definition could “include many unintended businesses that fall far outside the intended scope of FCRA, such as marketing agencies, universities, and merchants.”
ACA International and other commenters noted that the SBREFA proposal conflicts with FCRA language concerning the definition of consumer report and consumer reporting agency, as changing the terms “oversteps its statutory authority under the Chevron doctrine” and goes beyond its statutory authority. Many commenters criticized the limited engagement period provided by the CFPB, with some commenters requesting that the CFPB convene an additional SBREFA panel after providing a new outline with additional data and proposals.
The Consumer Data Industry Association (CDIA) argued that as a fundamental matter, the CFPB lacks authority to declare medical collection debt, or any other information, to be information that may not be contained within consumer reports. Congress has already established the scope of the contents of consumer reports, and preempted further action by states to affect the same. With regard to medical information, specifically, Congress has, on multiple occasions, amended the FCRA to regulate when, how and to what extent medical information may be included in consumer reports. Given how thoroughly Congress has legislated, the CFPB has no authority to act by rulemaking.
THIS DOCUMENT IS INTENDED TO PROVIDE YOU WITH GENERAL INFORMATION REGARDING NEW CFPB RUELS ON DATA HANDLING AND REPORTING. THE CONTENTS OF THIS DOCUMENT ARE NOT INTENDED TO PROVIDE SPECIFIC LEGAL ADVICE. IF YOU HAVE ANY QUESTIONS ABOUT THE CONTENTS OF THIS DOCUMENT OR IF YOU NEED LEGAL ADVICE AS TO AN ISSUE, PLEASE CONTACT THE ATTORNEYS LISTED OR YOUR REGULAR BROWNSTEIN HYATT FARBER SCHRECK, LLP ATTORNEY. THIS COMMUNICATION MAY BE CONSIDERED ADVERTISING IN SOME JURISDICTIONS.