Dec. 6: CFPB Recent Updates
CFPB Announces Return of $1.8 Billion in Illegal Junk Fees to 4.3 Million Americans Harmed in Massive Credit Repair Scheme
The Consumer Financial Protection Bureau (CFPB) is distributing $1.8 billion to 4.3 million consumers charged illegal advance fees or subjected to allegedly deceptive bait-and-switch advertising by a group of credit repair companies including Lexington Law and CreditRepair.com. Together, the payments constitute the largest-ever distribution from the CFPB’s victims relief fund, which is funded by civil penalties paid by companies that violate consumer protection laws.
In August 2023, the CFPB secured a legal judgment against the credit repair conglomerate, after a district court ruled that the companies had violated the Telemarketing Sales Rule’s advance fee prohibition. Under federal law, credit repair companies that engage in telemarketing cannot collect fees until they provide documentation showing they have achieved the promised results for consumers, at least six months after the results were achieved.
Following the district court’s ruling, the companies filed for Chapter 11 bankruptcy protection, shuttering approximately 80 percent of their business operations, including their telemarketing call centers. The CFPB’s $1.8 billion distribution to consumers harmed by the credit repair companies is a result of the agency’s enforcement action. Read more
The proposed rule would amend Regulation V to implement FCRA definitions of consumer report and consumer reporting agency, as well as certain other FCRA provisions, to, among other things, ensure that FCRA protections are applied to sensitive consumer information that the statute was designed to protect, including information sold by data brokers.
The CFPB also released a Fast Facts Summary of the proposed rule.
You can access the Notice of Proposed Rulemaking and Fast Facts Summary here: www.consumerfinance.gov/compliance/compliance-resources/other-applicable-requirements/fair-credit-reporting-act/
CFPB Proposes Rule to Stop Data Brokers from Selling Sensitive Personal Data to Scammers, Stalkers, and Spies
The Consumer Financial Protection Bureau (CFPB) today proposed a rule to rein in data brokers that sell Americans’ sensitive personal and financial information. The proposed rule would limit the sale of personal identifiers like Social Security Numbers and phone numbers collected by certain companies and make sure that people’s financial data such as income is only shared for legitimate purposes, like facilitating a mortgage approval, and not sold to scammers targeting those in financial distress. The proposal would make clear that when data brokers sell certain sensitive consumer information they are “consumer reporting agencies” under the Fair Credit Reporting Act (FCRA), requiring them to comply with accuracy requirements, provide consumers access to their information, and maintain safeguards against misuse.
The data broker industry collects and sells detailed information about Americans’ personal lives and financial circumstances to anyone willing to pay. The CFPB’s proposal would ensure data brokers comply with federal law and address critical threats from current data broker practices, including:
- National security and surveillance risks: Countries of concern, like China and Russia, can purchase detailed personal information about military service members, veterans, government employees, and other Americans for pennies per person. This enables the creation of detailed dossiers for potential espionage, surveillance, or blackmail operations, allowing relatively small investments to be leveraged into mass surveillance operations.
- Criminal exploitation: Identity thieves and scammers purchase detailed financial profiles to target vulnerable consumers, particularly seniors and financially distressed individuals. These criminals can use this data to execute sophisticated fraud schemes and steal retirement savings, often targeting Americans who can least afford the losses.
- Violence, stalking, and personal safety threats to law enforcement personnel and domestic violence survivors: The availability of sensitive contact information poses risks to those who are targeted for their profession, such as judges, police officers, prosecutors, and other government employees. Domestic violence survivors also face grave dangers when their current addresses and phone numbers are readily available for purchase through data brokers. Several states have already had to take action to protect judges and law enforcement officers after violent incidents, including the 2020 murder of a federal judge’s son by an attacker who purchased her home address.
To address these risks, the proposed rule would:
- Treat data brokers just like credit bureaus and background check companies: Companies that sell data about income or financial tier, credit history, credit score, or debt payments would be considered consumer reporting agencies required to comply with the FCRA, regardless of how the information is used.
- Protect consumers’ personal identifiers from abuse and misuse: When consumer reporting agencies collect information like names, addresses, or ages for credit reports, any subsequent sale of that information would be covered by the FCRA’s protections.
- Require clear consumer consent for data sharing: Under the proposed rule, companies relying on consumers’ consent to obtain or share a consumer’s credit report would need separate, explicit authorization to do so, rather than burying permissions in fine print.
These changes would significantly limit the ability of data brokers to sell sensitive contact information that could be used to target, harass, or dox individuals seeking privacy protection, including domestic violence survivors. The proposed rule would preserve existing pathways created by the FCRA for government agencies to access consumer report information for legitimate law enforcement, counterterrorism, and counterintelligence purposes.
Congress enacted the FCRA, one of the first data privacy laws in the world, in 1970 to, among other things, strictly limit the use of personal data by a growing data surveillance industry. The CFPB’s proposed rule would ensure that the FCRA’s strong privacy protections safeguard consumers from modern day data brokers that rely on emerging technologies and newer business models to collect and sell consumer data.
The CFPB developed this proposed rule based on extensive market monitoring that revealed widespread evasion of consumer protections. The agency found that data brokers routinely sidestep the FCRA by claiming they aren’t subject to its requirements – even while selling the very types of sensitive personal and financial information Congress intended the law to protect. This proposed rule would further Congress’s goal of protecting Americans’ privacy and financial information.
The proposed rule is part of a broader government-wide initiative to protect Americans’ sensitive personal data, complementing recent Executive Orders and actions by other federal agencies. In October, the Department of Justice proposed a rule to prevent access to Americans’ sensitive personal data by Russia, Iran, China, and other countries of concern.