The CFPB has issued an advisory opinion that affirms that the use of “name-only matching” by consumer reporting agencies, including tenant and employment screening companies, does not satisfy the FCRA requirement for a CRA ”to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the [consumer] report relates.” “Name-only matching” means the matching of information by a CRA to a particular consumer who is the subject of a consumer report based solely on whether the consumer’s first and last names are identical or similar to the first and last names associated with the information, without verifying the match using additional identifying information for the consumer.
Director Chopra’s statement. While the advisory opinion itself is an important development, perhaps equally important are the ominous comments made by Director Chopra in his statement about the advisory opinion because they potentially signal more broadly what the “new CFPB’s” approach to enforcement will be. Director Chopra calls name-only matching “only one example of inadequate and skimpy procedures,” and warns that “nothing in today’s advisory opinion suggests that the responsibility to follow reasonable procedures to assure maximum possible accuracy can be met with a thoughtless application of any particular loose matching criteria, even if more than names alone are matched.” He also states explicitly that he “would warn consumer reporting companies against trying to evade their responsibilities by issuing a disclaimer that their report might not be matched to the right person.” In addition, he cautions that in light of the advisory opinion many CRAs “will need to employ significantly more rigorous procedures, including individualized review of files, to assure maximum possible accuracy.”
Director Chopra also lists additional actions that the CFPB intends to take, which include:
- Close collaboration on enforcement actions with the FTC in the consumer reporting market. He states that “the FTC has begun to take its consumer protection responsibilities more seriously, particularly when it comes to abuse and misuse of personal data. In the background screening context, the FTC may be able to prosecute unfair or deceptive conduct not covered by the Consumer Financial Protection Act.”
- When bringing FCRA enforcement actions, in addition to civil penalties, “the CFPB will seek to redress the full range of harms to victims.” He notes that the CFPB can seek restitution and damages for FCRA violations” and indicates that the CFPB “will make appropriate referrals, including to the Department of Justice’s Civil Rights Division, when the conduct might implicate violations of anti-discrimination laws.”
Advisory opinion. The advisory opinion applies to all “consumer reporting agencies” as defined by the FCRA. The CFPB indicates that it interprets the FCRA’s requirement for a CRA to use “reasonable procedures to assure maximum possible accuracy” to include “as an integral component that information in fact pertains to the consumer who is the subject of the report.” It states that the steps a CRA takes in matching information it receives to the correct consumer are critical in assessing whether a CRA is satisfying this requirement.
According to the CFPB, “it is not a reasonable procedure to assure maximum possible accuracy to use insufficient identifiers to match information to the consumer who is the subject of the report.” The Bureau indicates that it has been its “consistent view” and “continues to be the Bureau’s position” that name-only matching is not a procedure that assures maximum possible accuracy and therefore violates the FCRA requirement. It also warns that nothing in the CFPB’s legal analysis “creates a safe harbor for meeting the reasonable procedures to assure maximum possible accuracy” requirement with respect to matching. It cautions that “multiple additional elements beyond names may often be needed to meet the [FCRA requirement].”
The Bureau also notes that in some cases, in preparing consumer reports, CRAs may obtain information from data brokers, databases, or other sources that do not have or use identifying information other than consumers’ names. The CFPB indicates that it is not a reasonable procedure for a CRA “to simply include information from such sources in a consumer report without taking additional steps to match the information to the consumer who is the subject of the report, such as consulting other databases or sources of information that contain additional identifying information.”