CFPB: Permissible Purposes for Pulling and Using Credit Reports

The CFPB recently announced its issuance of a legal interpretation to ensure that companies that use and share credit reports and background reports have a permissible purpose under the Fair Credit Reporting Act. The CFPB’s new Advisory Opinion makes clear that credit reporting companies and users of credit reports have specific obligations to protect the public’s data privacy. The advisory also reminds covered entities of potential criminal liability for certain misconduct.

Key points in the CFPB's opinion:

• Insufficient matching procedures can result in credit reporting companies providing reports to entities without a permissible purpose, which would violate consumers’ privacy rights.
• It is unlawful to provide credit reports of multiple people as “possible matches.”
• Disclaimers about insufficient matching procedures do not cure permissible purpose violations.
• Users of credit reports must ensure that they do not violate a person’s privacy by obtaining a credit report when they lack a permissible purpose for doing so.
  

The advisory opinion also outlines some of the criminal liability provisions in the Fair Credit Reporting Act. Covered entities can face criminal liability for obtaining a background report on an individual under false pretenses or by providing a background report to an unauthorized individual.

For example, Section 620 of the Fair Credit Reporting Act imposes criminal liability on any officer or employee of a consumer reporting agency who knowingly and willfully provides information concerning an individual from the agency’s files to an unauthorized person. Violators can face criminal penalties and imprisonment.