Kim Phan, David Anthony, Stefanie Jackman, and Mark Furletti delve into the significant Fair Credit Reporting Act (FCRA) developments of 2024 and provide insights on what to expect in 2025.
Join host Kim Phan and special guests David Anthony, Stefanie Jackman, and Mark Furletti as they delve into the significant Fair Credit Reporting Act (FCRA) developments of 2024 and provide insights on what to expect in 2025. This episode covers a range of topics, including the impact of the outgoing Biden Administration and the incoming Trump Administration on FCRA regulations, the Consumer Financial Protection Bureau's recent rulemaking activities, and the ongoing legal challenges. Tune in to understand the evolving landscape of consumer reporting laws and regulation and how it may affect your business. Don't miss this comprehensive review and analysis from Troutman Pepper Locke's seasoned legal professionals.
NOTE: At the time of recording this podcast did not capture recent events relating to the change in CFPB leadership and resulting instructions to CFPB staff regarding CFPB rulemakings and investigations. Stay tuned for future podcast episodes addressing these important developments.
FCRA Focus — FCRA Regulatory Year in Review
Host: Kim Phan
Guests: David Anthony, Stefanie Jackman, Mark Furletti
Date Aired: February 4, 2025
Kim Phan:
Welcome back to the FCRA Focus podcast of the new Troutman Pepper Locke, following our merger on January 1st with Locke Lord. I'm Kim Phan, and I want to wish our audience a Happy New Year. We’re looking forward to an exciting lineup of topics to discuss here throughout 2025.
But to get the year started off right, we’re going to go over some of the biggest FCRA developments in 2024 and give a preview on what may be coming in 2025. Joining us today, are our special guests, Mark Furletti, the co-leader of Troutman Pepper Locke’s Consumer Financial Services Regulatory Practice. Mark provides practical legal counsel advice to providers of financial services across numerous industries, including with regards to the Fair Credit Reporting Act.
David Anthony is one of our most esteemed national litigators who represents companies in the consumer financial services space under the Fair Credit Reporting Act. Clients also rely on David to resolve their most difficult and complex legal and business challenges, both in and out of the courtroom.
Stefanie Jackman is also a partner in our Consumer Financial Services Practice Group. And certainly, not least, she does it all. Stefanie takes a holistic approach to working with her clients from both the regulatory and litigation viewpoints. This includes regulatory compliance counseling and assessments, as well as serving as a zealous advocate in government inquiries, investigations, and consumer litigation.
However, before we jump into the discussion, let me remind you to visit and subscribe to our blogs, TroutmanFinancialServices.com and ConsumerFinancialServicesLawMonitor.com. And while you're at it, head on over to Troutman.com and add yourself to our Consumer Financial Services email list that allow you to get invitations to our webinars, receive our alerts and advisories, and other communications that we send out from time to time. While we make lots of free content available to our listeners, if you cannot get enough FCRA, I would encourage you to explore our subscription-based tracker service, which provides information on federal and state regulatory and legislative developments, as well as summaries of FCRA case law on a weekly basis, as well as monthly roundtable discussions. These tracker services can also cover other topics including debt collection and privacy and data security.
[EPISODE]
Kim Phan:
Now, jumping into our audience with our special guests, Mark, David, Stefanie, welcome. As we ring in the new year, I think there is a broad expectation that 2025 is going to look very different from 2024, from both a legislative and regulatory perspective. I invite all of you to weigh in. What are some of the major differences that we're expecting to see between the outgoing Biden administration and the incoming Trump administration?
Stefanie Jackman:
Well, I'm happy to start, Kim, and glad to be here. I mean, that's a huge question, but I think that we are already getting a taste of what at least the outgoing, well, presumably, outgoing director of the CFPB thinks with regard to what those things may be in the proliferation of items we've seen coming out in the way of lawsuits, finalized rules, and just general guidance, and position statements, if you will, as we near the inauguration next week. I know our listeners will be listening to this after the fact.
But if you step back from it, it's anticipating that the Trump administration will take a very different view on what the mission of a regulator like the CFPB is and presumably others, maybe like the FTC, FCC, the Prudential Banking Regulators, and so forth from the current administration and maybe roll back or take a different approach to how they interpret and apply existing law, UDAAP, and determine what consumer harms may be there and the best way to go about addressing them. But inviting some other panelists to join in as well.
Kim Phan:
Yes. David, I invite you to offer some thoughts on the FCRA's proposed data broker rule. I know they dropped that late last year. Do we anticipate anything happening with that in the coming year? Can you pull out your crystal ball and let us know?
David Anthony:
Thanks for having me here today. A couple of thoughts that I think tied together what Stefanie said, and I think she's exactly right as well as your question. I take a step back and look at this from the standpoint of like, what is the job of the CFPB and the FTC? And there are differences of opinion. There is a restrained, let me follow the law view and there is a, let me do anything that I think I can get away with, view.
I tend to view the most recent administration of the CFPB and the FTC as pushing the envelope and stretching their authority, and in my view rewriting statutes under the claim of regulatory authority. I view the data broker rule as exactly that is exceeding the scope of what the CFPB has done. I give that rule little chance of becoming final, whether it be through the CFPB squashing it or if it does become some variation of all of this, a court upholding that. I just don't see that happening. It goes along with all this.
So, as I think back to the flurry of activity that the Biden, Chopra, and Lina Khan administrations have done on their way out the door, it seems like they want to tell everybody what they think should be done, perhaps enable or empower state attorneys general or state legislatures to pick up the mantle on some of this stuff, to give roadmaps to plaintiffs' counsel on arguments to make to go along with all that. I personally believe that none of those are within purview of what a federal regulator should be doing. But nonetheless, that's what they're doing.
I fully expect, and in fact, I saw a story this morning that the new CFPB director is expected to, an interim be expected to be put in place almost immediately, and there will effectively be a freeze on everything from existing rulemaking to what they're going to do to litigation. It will not surprise me if some of the new litigation is immediately withdrawn, or perhaps even the new CFPB may agree with the views of the defense that go along with all that.
I do suspect it'll be fundamentally different. I do think if you look back to the Kraninger administration of the CFPB when President Trump was first in office, they didn't do nothing. But I do think that they focused on the bad actors and the folks that were doing bad things and I suspect that will continue. These sort of pushing the envelope, cutting-edge arguments or expansion of the law will be curtailed dramatically.
Kim Phan:
I would characterize what you call a flurry of activity as a full-on snowstorm. They are throwing things out left and right. There is not a day that goes by that we’re not hearing a new pronouncement from the CFPB. So much so that the incoming Republican members of the House Financial Services Committee actually sent a letter directly to Chopra asking them to stop doing this during this lame-duck period before President Trump is sworn in. That hasn't deterred them, in any way. Of course, we saw that they issued that data broker proposed rule. They also issued an advance notice of proposed rulemaking on coerced debt, and they finalized a medical debt rule. Stefanie, looking to you, can you give our audience a high-level overview of what that rule is now going to require?
Stefanie Jackman:
Yes. I definitely can. Kim, I don't think they read that letter. In fact, I think that letter sparked them to be even more active. But with regard to the rule that the CFPB recently finalized, people are calling it, and I just want to start here. People are calling it, it's the medical credit reporting ban. That's not what it does, right? That may be its effective impact, but it is not actually a ban on the furnishing of medical information to credit bureaus. And that's going to be important as we look to the future because I'm also going to give you a little high-level summary of some of the legal challenges that have already been brought.
But basically, a week and a half ago now, so early January, right in the new year, the CFPB announced that it had finalized a rule that is banning the inclusion of medical debt-related information, trade lines, in credit reports provided by credit reporting agencies, CRAs, to lenders and creditors for use in underwriting. And it also prohibits the consideration of medical debt information in underwriting by those creditors, right?
So, when you're assessing people for potential credit, you're not supposed to be able to see or use any information that may be in their credit report that relates to medical debt. That's why I started by saying it doesn't ban the furnishing of that information, the providing of it to the credit bureaus. But query, why would the credit bureaus want it? And this is why I say it may practically be a ban on furnishing, even if it's not legally, which is an important distinction, and then it's important to keep front of mind as we think about how to approach it in the future and watch the litigations that have been filed, one on January 7th by the Consumer Data Industry Association, CDIA and Cornerstone Credit Union, and another right after by ACA International.
But what I mean is why would they want it in a world of data breaches and ever-increasing threats to the privacy of personal consumer data? This is certainly both PII and PHI, personal health information, not just sensitive personal information. Why do the credit bureaus want it? Maybe there's a reason they want it and manage the security around it in the event of a breach or some other issue that could expose them to legal risk. This data got taken, what do you use it for?
So, I don't know, maybe there's some other way they could use it. But generally, credit bureaus are in the business of providing credit reports. If it can't be used in that, it doesn't immediately come to me why they would want this information. They may, I'm not saying they will, but they may tell furnishers, don't give this information. There's a code associated with medical debt that they could easily find it and say this isn't allowed.
That's why in practice, it could very well ban the furnishing of the information by banning the use and inclusion of it on credit reports on the other end. But let's back up just another minute before I jump into a few other things where I think this is going. The rule would become effective 60 days after it's published in the federal register, it is definitely in the CRA period that incoming Congress could decide to follow that process and undo it. That would prohibit the rule from actually taking effect, and because it would have been killed, if you will, through CRA and Congress, the CFPB would be prohibited from re-proposing and finalizing any sort of future rules that are substantially similar, right?
So, we'll see what happens. There's a 60-day period. It's a little bit longer than what the effective date would be because it's based, as I recall, on congressional days, and those can be days that Congress is actually in session.
Kim Phan:
Yes. The effective date is March 17.
Stefanie Jackman:
Yes, I would imagine the CRA period goes a little bit beyond that. I'm not sure because I haven't done that calculation, and it can actually be hard to do. You have to, Kim, you and I have done it before and you have to go on and figure out when Congress is in session.
But what I will say is that the incoming chair, Representative French Hill of the House Financial Services Committee and the incoming chair of the Senate Banking Committee, Tim Scott, have both come out as opposed to it. So, whether they'll be able to garner the votes, there's slim majorities, especially in the House, whether they'll be able to garner the vote to successfully overturn the rulemaking through a CRA procedure and process remains to be seen. But certainly, I would anticipate given their public statements will be a topic of discussion and so a CRA process could happen and get rid of this rule. If it doesn't, we have these lawsuits. It's expected, CDIA is going to ask for a preliminary injunction. They may wait to do that until the incoming Congress starts to indicate whether it is going to pursue doing anything about this rule or not. I would imagine ACA is contemplating requesting some sort of preliminary injunction as well.
While they litigate, the basic claims in those cases come down to an exceeding authority because medical debt is specifically allowed under the plain language of the FCRA to be both provided to credit bureaus and included in credit reports, hence the code that indicates it is such. There are some other rules around it, but it's allowed. So, this is plainly in exceeding of the CFPB's ability to – they're essentially rewriting the FCRA is the argument. Then also, that the basis on which to do it is arbitrary, capricious, insufficient and a myriad of other ways, and that it relies on allegedly outdated data from 2014 that isn't even reflective of things today, to claim that getting rid of this will make a significant impact to consumers and their creditworthiness.
Talking about there are legitimate reasons that large medical debts that are owed should be something that creditors are able to both see and consider when perhaps being requested to give some other credit in order to ensure both they're fully aware of this particular credit applicant's ability to pay and current significant outstanding liabilities and protect them from overextending themselves, as well as the risk to the lender in making sure they're making sound decisions in their underwriting process to extend credit to people, right?
There's more to it. I thought it was a really well-done complaint that was filed by CDIA and their lawsuit and ACA as well, and they're worth reading, but that's kind of the gist of it.
Kim Phan:
Yes. Well, so let me ask you, David, 60 days is really not that long between now and March 17th. What do you think the prospects are for this litigation during that time period? Should companies actually be getting ready or do we think this legal challenge at any challenge and any requested injunctions might actually get put into place between now and then?
David Anthony:
I would be skeptical that the final rule is implemented by that date. I think there's a number of different ways that could not happen, whether it's through a congressional act or it's through the CFPB doing something under a new director. Or imagine if the DOJ under Pam Bondi enters into a consent decree agreeing that what the CFPB is doing is unconstitutional. You can see any number of circumstances where that might go down.
I do think that it raises to me two important points. The first one is, as has been the case for this particular CFPB administration, there have been numerous instances where they have, in my view, exceeded their authority, pushed the envelope, but nonetheless, persuaded. I'll use those words in air quotes, the industry to go along with this and to do certain things to do this. So, you could see, irrespective of how the litigation turns out, a credit card issuer or a bank, or a CRA, or somebody agreeing not to do it, even though they may have the authority to kind of go do that because they just don't want to make the fight that goes along with all that.
The second thing that I think is at, I would echo Stefanie's point, the CDIA complaint is excellent and thorough. But there's a broader point here, which has always fascinated me about this, which is Congress has written the Fair Credit Reporting Act and we have a system in place, and somehow, we have a federal regulator coming in relying on a pretty scant report from 2014 declaring to the world what is and is not germane to credit underwriting, which to me is shocking. But I think it's purposeful that goes along with that, and they had to have some sort of cover to do what they were doing. But to me, that's highly problematic, and it plays into the CDIA's broader concerns about the accuracy of data, public nature of it, and providing the participants in that, the information they need to make the appropriate credit reporting decisions.
If you read the complaint, the CDIA points out, yes, the CDIA relies on this 2014 study, which is flawed and incomplete and old, but it also just disregarded a whole host of information and data to the absolute contrary, which has been symptomatic of this particular administration. Let's go provide everything for rulemaking and let's just ignore everything that's inconsistent with what we say. That's not the way it's supposed to work, but that's the way that it is operated here.
Kim Phan:
Yes. We spend quite a bit of time talking about the CFPB's rulemaking, but the reality is that's only one tool in the CFPB's toolbox, right? They issue advisories, guidance, they bring enforcement actions in other areas. They do exams and supervision of furnishers, not just consumer reporting agencies and end users.
So, for this, I wanted to turn to you, Mark. I know that the CFPB has been very active in every area of the FCRA, not just in the rulemaking area, but guidance on how to implement artificial intelligence in the credit scoring process and how furnishers should be re-investigating disputes. Love to hear your thoughts on this.
Mark Furletti:
Sure. Thanks, Kim. So, this past year, looking at 2024, there was a consent order that the CFPB entered into that involved a number of issues under the FCRA, and then they initiated a lawsuit against an industry participant under the FCRA. Actually, in both cases in the case of the consent order and in the case of the lawsuit, one of the primary focuses of the CFPB was on the duty to investigate credit reporting errors. The CFPB found that in both cases, the providers were alleged to have just totally failed in their duty of conducting reasonable investigations. They found it one provider that no direct dispute investigations were conducted whatsoever, that number of them were not investigated in a timely manner within the timeframe set forth in the FCRA. Then when the entities did go and conduct an investigation, they didn't do so in a reasonable manner. They didn't look at all the information that they had.
There was an allegation in one case that if the consumer alleged fraud or identity theft and the consumer refused to submit a police report, that the entity would just automatically refuse to do anything related to that claim. So, I think this emphasizes the importance of the need for providers to, I think, do the basic stuff under the FCRA, which includes investigating disputes. Then I would also say, in connection with kind of your very first question, Kim, neither of the things I've just described in my view are like novel. These are just things that you have to be able to do under the FCRA, and I don't know that it matters whether you have a Trump-appointed leader of the CFPB or a Biden one. To the extent the allegations in both of these instances are true, I think it'd be a problem either way.
I think echoing what Stefanie and David said at the beginning, I don't think this is like, “Oh, don't worry about compliance at all for the next four years of the FCRA.” Is the CFPB going to be stretching the law to cover things, as David was saying, that are clearly not unlawful? I think you'll see less of that, and that's very good. But in terms of, is it time to just get totally lax? I think definitely not.
Then I'll remind folks, two things that stand out to me. One, if you go to the CFPB's website and look at the enforcement actions that it initiated under the FCRA from 2017 to 2020, you get hits, right? It's not zero. There's six, I think, or so of them. That's one thing to remember. I think, just supporting my point that enforcement is not going to go to zero, although we'll probably go down and it'll be more focused on just garden variety violations.
I think another point to remember is there will still be these kind of consumer complaints, and so I think regulators will be under pressure to address them in connection with the violations, and I'm not sure that again, they will go totally anything goes. I don't think that's the case.
The other thing you asked about, Kim, was consumer complaints. So, again kind of year-in-review style, just to remind folks that in 2024, the Congressional Research Service released a report on complaints generally to the members of Congress about consumer complaints submitted to the CFPB, and it found that 80% of them related to credit reporting, and specifically about a third of them related to incorrect information on credit reports, about a quarter of them, those complaints of all complaints, this is across all areas. So, this is pretty serious. The improper use of credit reports. And then, in 20% of the cases, problems with the credit reporting agency's investigation into a complaint or into the furnisher’s investigation of the complaint.
That's a lot of complaints that are focused on this issue. So, I think, again, to the extent I'm looking forward, I think this area needs to remain, folks need to remain vigilant. One other point is, if in four years things switch back to being a different administration, it's not like for the prior four years, you can say, “Well, the regulator can't attack that conduct.” I think they could. So, if and when there's a switch or when there's a switch, because I'm sure there'll be one, you don't want to put yourself in a really bad position.
The final point you raised, Kim, related to AI. Rohit Chopra, he's been talking a lot and doing a lot as Stefanie and David were alluding to. In November, he gave some speeches around the use of AI and he was very critical of it. Credit scores, in my view, are a really good thing by and large because they allow the lender to consider the persons on their merits, on their just hardcore attributes that they can't take into consideration generally what they look like or any protected class characteristic that you could otherwise take into account if you are manually underwriting and the person was appearing before you.
But Chopra obviously doesn't like AI. He doesn't even seem to like credit scores, which is, I think, very unusual. I think most folks who are proponents of fair lending and even consumer advocates think that the credit scores do have a pretty important place in ensuring fair access to credit. But in any event, his criticisms and criticisms of AI related to inability of AI to make predictions about people who don't have credit histories. I don't know if that's entirely true. There's a number of specialty bureaus out there now that a number of our clients are using to underwrite consumers that consider not just traditional credit report information, but information about how a consumer, for example, whether they pay their rent or whether they have bounced checks, or how they responsibly use their checking account, things like that. He claims that the use of AI and credit scores, it tends to be opaque.
Again, we have the adverse action requirement under the FCRA and under the ECOA, under which creditors are obligated to explain why a consumer didn't do well under a credit model, whether it be AI-driven or not. So, I think that shines light on it. I don't agree with him there. Then he says they're not predictive. I don't even know how he can say that. I think they're – generally, lenders use them to avoid default. So, I think they're pretty predictive.
I just think on all his points he raised, they're manifestly untrue and good riddance, as he departs.
Kim Phan:
Yes, it's interesting because you would think everyone's interests are aligned. The consumer wants this information to be accurate so the right decision is going to be made about them. The bureaus want this information to be accurate so they can sell more of these into the marketplace. Lenders want these to be accurate so that they're making the right decision about consumers that are applying for various forms of credit.
But I do want to say as a self-proclaimed consumer reporting nerd, I would love to talk to this panel of experts all day long. But we are running short on time, so I wanted to give each of you the opportunity to offer any closing thoughts before we wrap up the podcast for today.
David Anthony:
I'll just start. I think that I echo all the comments that were made today. As was the case in 2017, it wasn't like all the litigation and regulatory oversight disappeared. On the pure litigation side, on the private side, there has been a steady increase over the last 10 years. I suspect that that's going to continue. There will continue to be creativity in terms of arguments, and I continue to see this sort of intersection of technology, the use of it, AI, FCRA, all of those things continuing to enter a new world. I suspect that's all going to continue.
I do think that this ping-pong effect that Mark talked about, it's not helpful to business to have to adjust depending upon the whim of a regulator or who the administration is and go to one extreme or back. I do think there'll be more stability and more rationality and predictability on the business side. If you look at the enthusiasm from the market, or from folks in the business space, they are excited about this administration just because they think there's going to be less regulation, less intrusiveness, and less pushing the envelope that will go along with all that. But there will still be plenty of litigation. There will still be plenty of regulatory and compliance concerns. Mark, Stefanie, will have more work to do than they can take a stick at because the way that the world is changing, so that's my parting thoughts.
Mark Furletti:
Kim, I would just add, overall, I'm somewhat excited because I think, at least in our practice, we saw some really cool and creative products come across our desks during the first Trump administration because people had incentives to innovate and to test new things. A number of those things, I think, were good and helpful for consumers. So, I'm excited to see that kind of product development. I think, overall, it'll be a positive development. I think there's been a reticence on the part of folks to invest in those things, particularly when they fear that there'll be some novel and totally untethered from the law theory brought against it. Anyway, that's my hope and expectation for next year.
Stefanie Jackman:
I agree with everything David and Mark have said. One more parting thought. We should anticipate seeing states continue to, no matter what happens with some of the rulemakings that are coming out and other positions at the federal level, we should expect to see states continuing to pay attention, particularly on FCRA issues, whether it's limiting what can be credit reported, whether it's limiting how information included in credit reports can be used, whether it's creating and passing coerced debt statutes that often have a, and by the way, you can't collect or credit report, things where people are established to be victims of coerced debt. And could this eventually also start to come into the world of considering certain information and underwriting just because we may all say, well, wouldn't that be preempted? Doesn't mean we won't see proposals to continue, and frankly already have, seen laws be proposed and passed that touch on some of these areas that will continue at the same time that preemption has had some interesting decisions.
I remember there was a case out of the First Circuit Court of Appeals. I think it was the Fry case dealing with a piece of the main laws talking about certain information that can't be furnished on certain types of accounts, and it was upheld as not preempted. We have a judiciary and a Supreme Court that seems to be tending more towards the world of plain language than perhaps reading between the lines as a method of judicial interpretation. So, if it's not clearly preempted, where will that go? I would assume states will continue to legislate here and try to act here. I don't assume all of it will ultimately be preempted by the FCRA.
Kim Phan:
Well, Mark, David, Stefanie, thank you so much for sharing your insights with us today. And thanks to our audience for tuning in to today's episode. If you enjoyed today's podcast, please let us know by leaving a review on your platform of choice. And of course, stay tuned for our next episode of the FCRA Focus podcast. Thank you all for listening.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.