This case from the Southern District of West Virginia was brought by a husband and wife, alleging that furnisher Ally Financial (“Ally”) violated the FCRA by failing to conduct a reasonable reinvestigation following their dispute regarding the accuracy of information furnished by Ally.[1]  In denying Ally’s Motion to Dismiss, the court found that what constitutes a “reasonable reinvestigation” and when information is misleading to the point that it is no longer “accurate” for FCRA purposes are usually matters for a jury.  But this case also caught my eye for another reason- the court recast what was essentially a claim by plaintiffs that Ally breached a contract into an FCRA violation.

In connection with the resolution of a previous dispute regarding an auto loan, the plaintiffs and Ally entered into a settlement agreement pursuant to which Ally agreed to request that the credit bureaus delete from plaintiffs’ files all negative information regarding Ally tradelines. Interestingly, the settlement agreement did not waive the plaintiffs’ account balance or release the debt.  Three years later, plaintiffs applied for an auto loan and did not receive a favorable interest rate, based in part on negative tradeline information in their credit report relating to their previous account with Ally. The plaintiffs then filed disputes with the CRA that issued the report and Ally directly, alleging that the information reported was inaccurate. Ally verified that the negative information reported was accurate, notwithstanding Ally’s settlement agreement with the plaintiffs.  The plaintiffs then sued Ally and the CRA.

What constitutes a “reasonable” reinvestigation?  The court held that a furnisher must conduct a “reasonable,” rather than a superficial or minimal investigation. To satisfy the reasonable investigation standard, a furnisher must conduct a “searching inquiry” into the dispute. Such an investigation “requires the data furnisher to go beyond a cursory review of internal records.” “Nor may a data furnisher restrict an investigation to information provided by the CRA.”  Although the court didn’t apply these standards to the facts in this case, the facts suggest that when Ally performed its reinvestigation, it did not take into account the settlement agreement.  The court also noted that it is generally a question of fact for the jury as to whether a data furnisher conducted a reasonable investigation.

OK, but wasn’t the information that Ally reported technically accurate? Ally argued that the FCRA claims should be dismissed because the disputed information was accurate- the debt had not been released and so Ally could not have failed to conduct a reasonable investigation of their dispute. The court found Ally’s assertion to be “meritless.” The Fourth Circuit has held that “a consumer report that  contains  technically  accurate  information  may  be deemed  ‘inaccurate’  if  the  statement  is  presented  in such  a  way  that  it  creates  a  misleading  impression.”[2]

The court noted that although the settlement agreement did not release the debt, Ally did agree to delete the negative tradeline. The complaint alleges that the tradeline continues to appear on their credit reports despite Ally’s assurance to plaintiffs that the tradeline would be deleted. Therefore, the plaintiffs have sufficiently alleged creation of a misleading impression constituting inaccurate information under the FCRA. The court also noted that whether technically accurate information is sufficiently misleading to be considered inaccurate for FCRA purposes is typically a question for a jury.

This case provides a helpful summary of the law on reasonable reinvestigation requirements and what constitutes misleading (and so inaccurate) information in the Fourth Circuit.  It is also interesting that what is essentially a claim by plaintiffs that Ally breached a contract has been leveraged into an FCRA violation.  That is, the only reason that the court believes the plaintiffs have plausibly alleged an FCRA violation is that the information in question was reported in violation of a contract not to do so.  All parties agree that the information was technically accurate and it’s far from clear how any third party lender, employer or insurance carrier would be misled by the information appearing in plaintiffs’ consumer report, since the information is indeed accurate.

We’ll see how this case develops!  In any event, it provides helpful insight into how some judges can creatively interpret the law when a sympathetic plaintiff is before them.  It’s also a good reminder that reinvestigations need to be thorough and that ensuring the technical accuracy of consumer report information is not the end of the analysis- the information must also not be misleading as presented.

[1] Saunders v. Branch Banking and Trust Co. of VA, 526 F.3d 142, 148 (4th Cir. 2008).

[2] AT Beckley Daniel Price & Lisa Price v. Equifax Info. Servs., No. 5:19-cv-00886, 2020 U.S. Dist. LEXIS 87367 (S.D. W. Va., 2020).

­­­­­­­What is behavioral data really? And where does it stand in relation to the FCRA? In this recent ruling out of the Central District of California, Tailford v. Experian Info. Sols., Inc., 2020 U.S. Dist. LEXIS 84658, the putative class of plaintiffs defined behavioral data as “non-traditional consumer data such as household income and purchase history,” and argued that Experian, as a consumer reporting agency (“CRA”)  is required to disclose all such data IF it “might be” furnished in a consumer credit report. Plaintiffs argued that the behavioral data that Experian sold to its affiliates and third parties through a credit product called “OmniView,” should have been included by Experian in plaintiffs’ consumer reports. By not disclosing the behavioral data in the consumer reports, Experian violated the FCRA. Experian, in response, argued that the behavioral data “does not bear on a consumer’s eligibility for credit, employment, or insurance, [and] its transmission does not constitute a consumer report,” and therefore should not be considered part of the plaintiffs’ respective files, or required to be disclosed. The Court agreed.

Experian’s response comes directly from the Court’s reasoning in Shaw v. Experian Info. Sols. Inc. (9th Cir. 2018) 891 F.3d 749., where the Court rejected an assertion that Experian was required to disclose upon a consumer request that Fannie Mae had mishandled its data because it was “not information retained by Experian in any credit report [and therefore,] falls outside the bounds of a ‘file’ for purposes of section 1681g(a).” Similarly here, Experian argued, the behavioral data is not alleged to be information retained for use in a credit report and therefore is not part of the consumer file. Agreeing with Experian, the Court stated: “Shaw’s definition of a consumer file “does not open the door for every shred of information to be included in a consumer disclosure simply because there is some slight chance it might someday be in a consumer report.”” Plaintiffs’ allegation that behavioral data “might be furnished” was considered mere speculation, and not sufficient to survive a cause of action under the FCRA disclosure requirement. Plaintiffs had to show that Experian included such information in a consumer report in the past OR plan to do so in the future. However, no such allegations existed in the complaint as to the behavioral data at issue. The Court granted Experian’s motion to dismiss plaintiffs’ claim.

The Court’s ruling is a refreshing reminder that even if a CRA is handling multiple consumer data services, there is clear divide between products that are regulated by the FCRA and those that are not. Thus, consumer information collected or provided for purposes other than those expressly covered under the FCRA are not regulated by the FCRA merely because they are being handled by an entity that performs traditional CRA functions as well, and merely because such information might be included in a consumer file. As long as the data has not been furnished in a “consumer report,” and is not intended to be furnished in a “consumer report,” there is no obligation to disclose such information in an FCRA consumer report. And although “behavioral data” is not defined under the FCRA, it is distinguished as separate from the consumer data that is covered by the FCRA as long as it is not being furnished in a consumer report.

Plaintiffs also claimed that Experian violated section 1681g by failing to include all consumer report inquiries regarding the plaintiffs, and names of all persons who had submitted such inquiries for the one-year period preceding the date of the request. However, plaintiffs needed more than just a cursory allegation that the inquiries made to Experian were for “consumer reports” such that they would have been required to be disclosed in a section 1681g disclosure.  Because the plaintiffs did not offer any facts to support why the inquiries in question were for consumer reports, the Court dismissed the claim.

Plaintiffs finally also alleged that Experian was required to disclose the “employment dates” it had allegedly stored related to consumers. Plaintiffs did not allege that the employment dates had ever appeared on or might appear on a consumer report. Instead, plaintiffs alleged that they are entitled to “all” section 1681g disclosures and that although the disclosures they received listed several current or former employers they did not disclose “any of the reported dates of employment,” which were required. The Court was not convinced here either. Mere speculation of what information a CRA holds is insufficient to allege that they are concealing that information, especially when such information has never been disclosed in a consumer report.

All the information at issue in this case was information that could have been useful in a consumer report, and IF Experian had in fact used that information in a consumer report, it would have to be disclosed under the FCRA requirements. However, mere speculation that Experian sold information for use in identifying consumers for marketing, and not for use in determining eligibility for credit (and presumably not for any of the other permissible purposes), was insufficient to survive a cause of action under the FCRA. Plaintiffs were granted leave to amend, so we may be seeing more unfold on this, and maybe an answer to the potential controversy around CRA’s furnishing behavioral data in consumer reports?!

A 1,815-page House bill has just been introduced that affords $3 trillion in relief to consumers and businesses impacted by COVID 19.  The bill (official title: the Health and Economic Recovery Omnibus Emergency Solutions Act, or “HEROES Act”) addresses numerous topics, but I’d like to focus on one: amendments to the Fair Credit Reporting Act (“FCRA”) designed to prevent reporting of adverse information arising out of a national emergency. However well-intentioned these provisions may be, they work an extreme—some might say unworkable and crazy— shift to the credit reporting landscape. If implemented, these changes would have significant negative impact on the financial services industry and consumers’ ability to get credit at rates reflecting their true repayment risk. The House will vote on the bill this Friday but—unsurprisingly given the bill’s drawbacks— the odds of it passing the Senate and being signed by the President in its current form lie somewhere between very unlikely and a snowball’s chance in Hell.

Calling out a handful of the troublesome amendments to the FCRA proposed by the HEROES Act:

• All Adverse Information Arising from “Major Disaster” Must Be Excluded from Consumer Reports. Under the HEROES Act, consumer reporting agencies (“CRAs”) are prohibited from including “an adverse item of information” (other than a felony conviction) that was the result of “any action or inaction that occurred” during a period declared to be a “major disaster” by the President. There is a similar prohibition on furnishers furnishing such adverse information to CRAs. Think about that. But when is an adverse fact “the result of” an action or inaction that occurred during an emergency?  Some cases are easy – I’ve been in the hospital for two months with COVID-19, couldn’t work and so missed payments on my credit cards and mortgage. Fine.  But if I’m a CRA and two years from now I want to include a bankruptcy in a consumer report, how could I possibly know if there was some action or inaction that took place during the pandemic such that the bankruptcy could be said to have “resulted” from such action or inaction? It’s an impossible standard.
• A Catalog of Consumer Woe? HEROES Would Create CFPB Website to Track Consumers’ Economic Hardships. The HEROES Act requires the Consumer Financial Production Bureau (“CFPB”) to establish a website where consumers can report “economic hardship” as a result of a major disaster, including the current COVID-19 pandemic. It does not state that specified events resulting from such hardship (liens, bankruptcies, missed loan payments, etc.) are to be reported or otherwise elaborate on what constitutes an “economic hardship” for purposes of this website. It does, however, require the three credit bureaus and CRAs that qualify as “nationwide specialty consumer reporting agencies” to check this CFPB website weekly and delete from their databases “adverse items of information as soon as practicable after information that is reported appears in the database.” But how will a CRA know what to delete if consumers are not required to be specific about what events are a product of their “economic hardship”?  Oh, and the HEROES Act prohibits the CFPB from requiring any consumer to produce any documentation substantiating their claim of economic hardship.  Makes sense! Then there are the privacy implications of allowing/encouraging/requiring consumers to catalog their hardships in a centralized government database.
• Guidance Regarding the Treatment of Missed Payments Is Insufficient. As noted above, the HEROES Act prohibits CRAs from reporting adverse items of information. That leads to some tricky situations. For instance, suppose a bank’s records show that in some months during the pandemic the consumer made payments on his outstanding credit card balance and in some months he did not. Under the HEROES Act, CRAs are not allowed to report the missed payments because they are “adverse items of information.”  So the bank will furnish CRAs with payment history for only the months in which he made payments.  How does the CRA then report that information without signaling that the consumer didn’t make the payment during the months not reported?

• Debt Collection. Debt collectors routinely obtain consumer reports prior to attempting to collect a debt in order to confirm that debtors have not declared bankruptcy. If a consumer declares bankruptcy during a pandemic but CRAs can’t notify debt collectors of such bankruptcy, then debt collectors either run the risk of violating the law by attempting to collect debt from a bankrupt debtor or it has to stand up internal processes to check relevant sources to determine whether the debtor is bankrupt, adding significant cost to the collection effort.  This will be an unfair burden for debt collectors and increase the cost of credit for consumers.

• Making credit more expensive. While the HEREOES Act raises many questions regarding reporting adverse information during an emergency, one thing is clear—the cost of credit is going up if the HEREOES Act becomes law. When lenders have more information about consumers, they can make finer distinctions among consumers about their relative default risks, which leads to better terms for many consumers.  This is the main driver behind the push towards “alternative credit data”:  it allows lenders to identify potential borrowers that are a good credit risk in a pool of consumers that don’t have much of a footprint in the traditional credit universe because, g., they lease an apartment, do not use credit cards or don’t have checking accounts.  To the extent regulatory prohibitions limit what data lenders are allowed to use in underwriting, the less lenders are able to offer loan terms that match a consumer’s true credit risk, making credit more expensive for everyone.  This would undoubtedly happen if the HEROES Act were to pass in its current form.

The HEROES Act is not workable in its current format as it pertains to the FCRA.  We will monitoring developments with the HEROES Act and blog about it as it develops.

In a recent single-plaintiff federal case in the Northern District of Georgia alleging violations of the Fair Credit Reporting Act (the “FCRA”), the court helpfully explored the contours of what constitutes a “consumer report.”

Here’s the back story.  In 2016, a guy obtained a copy of his credit report from a consumer reporting agency (a “CRA”) to review it for accuracy.  He was surprised to find that a second CRA had accessed his credit file on at least 73 occasions and spent the next 18 months trying to get an explanation. Because the explanations were (allegedly) confusing and unsatisfactory, and he filed suit against both CRAs, contending that each had violated the FCRA in providing and using a consumer report without a statutory permissible purpose for doing so.

The two CRAs are separate companies and each maintains its own database of consumer credit files and account information.  However, the second CRA created a credit risk score that utilized data contained in the first CRA’s database in addition to its own credit files. When a consumer service representative for the second CRA accesses a consumer’s credit file to process a request for consumer disclosure, process a dispute reinvestigation or for other purposes, the second CRA’s system automatically, and without prompting, provides the representative with this credit risk score.

The representative can see only the score and is not able to see or otherwise access the data used to calculate the score. Every time the second CRA obtains information from the first CRA in order to generate such credit score, that event is recorded as a “soft inquiry” on the consumer’s file at the first CRA.  The generation of this credit score is unnecessary to whatever tasks the representative is performing and it is never explained why this process was implemented. When the first CRA was informed of this process, it requested the second CRA to cease the practice.

On these facts, the court determined that the Plaintiff had introduced sufficient evidence to survive summary judgment and so this case is headed to a jury.  In denying defendants’ Motion for Summary Judgment, the District Court reached the following (important) conclusions:

• Simple scores can be consumer reports. The defendant CRAs claimed in this case that consumers have reduced privacy interests when only limited information, short of a traditional credit report, is at issue. They claimed that the second CRA did not release detailed, specific information about the plaintiff’s accounts, but instead released only numbers that summarized the plaintiff’s payment history, the number of accounts, the type of accounts, his available credit, his credit used, and the length of his credit history.  The court rejected this argument as irrelevant, because the credit data disclosed in this case fell within the FCRA’s broad definition of the term “consumer report” and therefore entitled to protection. There is nothing in the FCRA that requires the disclosure of a full credit report or the underlying data as a condition to the FCRA’s application, as urged by the defendants.
• Once a consumer report, always a consumer report. In order to be considered a consumer report under the FCRA, a report has to be “used,” “expected to be used,” or “collected” for one of the permissible purposes described in the FCRA. The CRAs argued that because the report in question here was not being used for a permissible purpose, it could not be considered a consumer report.  Nice try. The Court held that even if a report isn’t used (or expected to be used) for one of those permissible purposes, if the information in the report was collected for a permissible purpose, then it remains regulated by the FCRA. In other words, if you collect personal information with the intent of subsequently including it in a consumer report, it is subject to the FCRA and may only be disclosed in a consumer report provided to a user that has a permissible purpose under the FCRA.
• Alternative credit data is NOT subject to a different standard than “traditional” credit data. The defendants claimed that the specific type of credit information disclosed here does not implicate the privacy concerns that Congress sought to address. While a typical CRA collects credit information like mortgage accounts, auto loans, credit cards, bankruptcies, or public records, the first CRA in this case collects payment information from telecommunications, pay TV, and utility service providers. This data, defendants claimed, does not reflect sensitive information about a consumer’s employment history, arrest records, or any other aspect of a person’s character. The court was not persuaded, finding that the “FCRA makes no distinction between the ‘utility credit data’ maintained by [the first CRA] and the ‘traditional credit data’ maintained by a more ‘traditional’ CRA ….” Because the data at issue here was a communication bearing on the plaintiff’s creditworthiness, credit standing, or credit capacity, the court found that that data is entitled to the privacy protections afforded to credit reports under the FCRA.
• Disclosure of a consumer report without a permissible purpose constitutes “concrete” harm for Spokeo standing purposes. In Spokeo v. Robins , the US Supreme Court explained that the US Constitution requires a plaintiff to allege an injury-in-fact that is concrete and particularized. While the lower court identified particular harms to plaintiff, it erred by not also determining that those harms were concrete. Although intangible harms can be concrete, “bare procedural violations” cannot.  Many have latched on to this phrase, internalizing that unless a plaintiff can demonstrate evidence of harm corroborating the allegation, it is a “bare procedural violation,” resulting in lack of standing for the plaintiff. Well, maybe. In some circumstances that may be a winning argument, but there is a long line of post-Spokeo cases cited by the court here holding that the impermissible disclosure of credit information is more than a bare procedural violation of the FCRA because it involves the invasion of a consumer’s privacy.

Take-Aways:  As I see it, this decision has two primary take-aways:

• • Examine historical practices. In this case, it was never explained why a credit score was automatically generated when a consumer contacted the CRA to request his or her file. I have no knowledge of this situation, but it may be that it was an historical practice that was never questioned and so never scrutinized. All organizations subject to the FCRA should regularly scrutinize their practices on a regular basis and challenge them. Do you have a one-off process that makes use of consumer report data?  How would this look to someone from outside the organization?  Is this process really necessary? Would I be comfortable discussing this process publicly? All great questions to ask yourself and your team.
  • Question long-held positions. Many organizations and some entire industries have legal positions that could fairly be described as “tribal lore,” which can be problematic given the rapid rate of regulatory change in the past 10 years.  A legal position is often maintained past the point at which it can be reasonably defended because “it has always been that way” or maybe it has never been challenged.  Drinking the kool-aid like this can come back to haunt an organization when a judge or regulator who was not been steeped in the tribal lore examines the position.  As with the examination of long-standing practices discussed above, it can be a tremendous help to an organization to challenge long-standing legal positions objectively to ensure that they remain as defensible and compelling as when they were adopted.