The CFPB today issued an interpretive rule related to the Fair Credit Reporting Act’s provisions regarding companies that use and share consumer reports. While much of the document focuses on the responsibilities of consumer reporting agencies, it also addresses responsibilities of users of consumer reports, which include banks.
Specifically, the interpretive rule noted that consumer report users must ensure they do not violate a person’s privacy by obtaining or using a report without a permissible purpose, and that it is illegal for consumer reporting companies to provide “possible matches” to users.
The CFPB cautioned that a user who incorrectly inputs consumer information when obtaining a report can result in that user obtaining a report without a “permissible purpose” and violating consumer privacy rights. The bureau further emphasized its position that that there is strict liability for obtaining or using a consumer report without a permissible purpose, and also included a reminder about criminal liability for knowing or willful violations of the FCRA provisions.
