```

[Federal Register Volume 87, Number 132 (Tuesday, July 12, 2022)]
[Rules and Regulations]
[Pages 41243-41246]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-14823]

========================================================================
Rules and Regulations
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains regulatory documents 
having general applicability and legal effect, most of which are keyed 
to and codified in the Code of Federal Regulations, which is published 
under 50 titles pursuant to 44 U.S.C. 1510.

The Code of Federal Regulations is sold by the Superintendent of Documents. 

========================================================================


Federal Register / Vol. 87, No. 132 / Tuesday, July 12, 2022 / Rules 
and Regulations

[[Page 41243]]

BUREAU OF CONSUMER FINANCIAL PROTECTION

12 CFR Part 1022

Fair Credit Reporting; Permissible Purposes for Furnishing, 
Using, and Obtaining Consumer Reports

AGENCY: Bureau of Consumer Financial Protection.

ACTION: Advisory opinion.

-----------------------------------------------------------------------

SUMMARY: The Consumer Financial Protection Bureau (Bureau) is issuing 
this advisory opinion to outline certain obligations of consumer 
reporting agencies and consumer report users under section 604 of the 
Fair Credit Reporting Act (FCRA). This advisory opinion explains that 
the permissible purposes listed in FCRA section 604(a)(3) are consumer 
specific, and it affirms that a consumer reporting agency may not 
provide a consumer report to a user under FCRA section 604(a)(3) unless 
it has reason to believe that all of the consumer report information it 
includes pertains to the consumer who is the subject of the user's 
request. The Bureau notes that disclaimers will not cure a failure to 
have a reason to believe that a user has a permissible purpose for a 
consumer report provided pursuant to FCRA section 604(a)(3). This 
advisory opinion also reminds consumer report users that FCRA section 
604(f) strictly prohibits a person who uses or obtains a consumer 
report from doing so without a permissible purpose.

DATES: This advisory opinion is effective on July 12, 2022.

FOR FURTHER INFORMATION CONTACT: Seth Caffrey, Pavneet Singh, Laura 
Stack, or Ruth Van Veldhuizen, Senior Counsels, Office of Regulations 
at (202) 435-7700 or https://reginquiries.consumerfinance.gov/. If you 
require this document in an alternative electronic format, please 
contact [email protected].

SUPPLEMENTARY INFORMATION: The Bureau is issuing this advisory opinion 
through the procedures for its Advisory Opinions Policy.\1\ Refer to 
those procedures for more information.
---------------------------------------------------------------------------

    \1\ 85 FR 77987 (Dec. 3, 2020).
---------------------------------------------------------------------------

I. Advisory Opinion

A. Background

    Consumer reporting agencies collect and assemble or evaluate 
information about, among other things, the credit, criminal, 
employment, and rental histories of hundreds of millions of Americans. 
They package this information into consumer reports,\2\ which are used 
by creditors, insurers, landlords, employers, and others to make 
eligibility and other decisions about consumers. This collection, 
assembly, evaluation, dissemination, and use of vast quantities of 
often highly sensitive personal and financial information about 
consumers poses significant risks to consumer privacy.
---------------------------------------------------------------------------

    \2\ See 15 U.S.C. 1681a(d) (defining ``consumer report'').
---------------------------------------------------------------------------

    The FCRA regulates consumer reporting.\3\ Congress enacted the 
statute ``to ensure fair and accurate credit reporting, promote 
efficiency in the banking system, and protect consumer privacy.'' \4\ 
One of the problems with the credit reporting industry that Congress 
recognized and sought to remedy with the FCRA was that ``information in 
a person's credit file [was] not always kept strictly confidential.'' 
\5\ The statute was enacted to ``prevent an undue invasion of the 
individual's right of privacy in the collection and dissemination of 
credit information.'' \6\ As courts have recognized, ``[a] major 
purpose of the [FCRA] is the privacy'' of consumer data.\7\
---------------------------------------------------------------------------

    \3\ See 15 U.S.C. 1681-1681x.
    \4\ Safeco Ins. Co. of Am. v. Barr, 551 U.S. 47, 52 (2007); see 
also 15 U.S.C. 1681 (recognizing ``a need to insure that consumer 
reporting agencies exercise their grave responsibilities with 
fairness, impartiality, and a respect for the consumer's right to 
privacy'').
    \5\ S. Rep. No. 91-517, at 4 (1969) (noting, as an example of 
this problem, ``a reporter for a major TV network was able to obtain 
10 out of 20 reports requested at random from 20 credit bureaus by 
using the name of a completely fictitious company under the guise of 
offering the individuals credit''). When introducing the bill that 
would become the FCRA, Senator Proxmire observed that ``[w]hat is 
disturbing is the lack of any public standards to ensure that the 
information [collected by consumer reporting companies] is kept 
confidential and used only for its intended purpose. The growing 
accessibility of this information through computer- and data-
transmission techniques makes the problem of confidentiality even 
more important.'' 15 Cong. Rec. 2413 (1969).
    \6\ S. Rep. No. 91-517, at 1 (1969).
    \7\ Trans Union Corp. v. FTC, 81 F.3d 228, 234 (D.C. Cir. 1996).
---------------------------------------------------------------------------

    The FCRA protects consumer privacy in multiple ways, including by 
limiting the circumstances under which consumer reporting agencies may 
disclose consumer information. For example, FCRA section 604, entitled 
``Permissible purposes of consumer reports,'' identifies an exclusive 
list of ``permissible purposes'' for which consumer reporting agencies 
may provide consumer reports,\8\ including in accordance with the 
written instructions of the consumer to whom the report relates and for 
purposes relating to credit, employment, and insurance.\9\ The statute 
states that a consumer reporting agency may provide consumer reports 
under these circumstances ``and no other.'' In addition, FCRA section 
607(a) requires that ``[e]very consumer reporting agency shall maintain 
reasonable procedures designed to . . . limit the furnishing of 
consumer reports to the purposes listed under section 604.'' \10\ And 
FCRA section 620 imposes criminal liability on any officer or employee 
of a consumer reporting agency who knowingly and willfully provides 
information concerning an individual from the agency's files to an 
unauthorized person.\11\
---------------------------------------------------------------------------

    \8\ 15 U.S.C. 1681b(a) (providing that, ``[s]ubject to 
subsection (c), any consumer reporting agency may furnish a consumer 
report under the following circumstances and no other''). FCRA 
section 604(c) defines when consumer reporting companies may furnish 
consumer reports in connection with credit and insurance 
transactions not initiated by the consumer. 15 U.S.C. 1681b(c). 
Other sections of the FCRA identify additional limited circumstances 
under which consumer reporting companies are permitted or required 
to disclose certain information to government agencies. See 15 
U.S.C. 1681f, 1681u, 1681v. Further, the Debt Collection Improvement 
Act of 1996, Public Law 104-134, sec. 31001(m)(1), allows the head 
of an executive, judicial, or legislative agency to obtain a 
consumer report under certain circumstances relating to debt 
collection. See 31 U.S.C. 3711(h).
    \9\ 15 U.S.C. 1681b(a)(2), (a)(3)(A), (a)(3)(B), (a)(3)(C).
    \10\ 15 U.S.C. 1681e(a).
    \11\ 15 U.S.C. 1681r.
---------------------------------------------------------------------------

    In addition to imposing permissible purpose limitations on consumer 
reporting agencies, the FCRA limits the circumstances under which third 
parties may obtain and use consumer report information from consumer 
reporting agencies. FCRA section 604(f) provides that ``a person shall 
not use or obtain a

[[Page 41244]]

consumer report for any purpose unless'' the consumer report ``is 
obtained for a purpose for which the consumer report is authorized to 
be furnished under [FCRA section 604]'' and ``the purpose is certified 
in accordance with FCRA section 607 by a prospective user of the report 
through a general or specific certification.'' \12\ FCRA section 619 
imposes criminal liability on any person who knowingly and willfully 
obtains information on a consumer from a consumer reporting agency 
under false pretenses.\13\
---------------------------------------------------------------------------

    \12\ 15 U.S.C. 1681b(f). FCRA section 607(a) requires that 
consumer reporting companies, among other things, must require that 
prospective users of consumer reports ``certify the purposes for 
which the information is sought, and certify that the information 
will be used for no other purpose.'' 15 U.S.C. 1681e(a).
    \13\ 15 U.S.C. 1681q.
---------------------------------------------------------------------------

    The FCRA's permissible purpose provisions are thus central to the 
statute's protection of consumer privacy. Consumers suffer harm when 
consumer reporting agencies provide consumer reports to persons who are 
not authorized to receive the information or when recipients of 
consumer reports obtain or use such reports for purposes other than 
permissible purposes. These harms include the invasion of consumers' 
privacy, as well as reputational, emotional, physical, and economic 
harms. The Bureau and the Federal Trade Commission (FTC) have 
collectively brought numerous enforcement actions to address violations 
of the FCRA's permissible purpose provisions.\14\ For example, in a 
case that resulted in a 2006 settlement with a consumer reporting 
agency, the FTC alleged that the agency violated the FCRA's permissible 
purpose provisions by providing consumer reports to persons without a 
permissible purpose, resulting in at least 800 cases of identity 
theft.\15\ More recently, in 2020, a group of companies and individuals 
settled Bureau allegations that they obtained consumer reports without 
a permissible purpose when they obtained consumer reports for use in 
marketing debt relief services.\16\ Also in 2020, a mortgage broker 
settled FTC allegations that it used consumer reports for other than a 
permissible purpose when, in response to negative reviews on a website, 
it publicly posted information it had obtained from a consumer report 
about the reviewer.\17\
---------------------------------------------------------------------------

    \14\ See, e.g., United States v. Vivint Smart Home, Inc., No. 
2:21-cv-00267 (D. Utah 2021), https://www.ftc.gov/system/files/documents/cases/de2_complaint_against_vivint_smart_home.pdf 
(alleging that the defendant violated FCRA section 604(f) by 
obtaining consumer reports about consumers who had not applied for 
credit in order to improve credit applicants' ability to satisfy the 
defendant's credit criteria); In re Clarity Servs., Inc., 2015-CFPB-
0030 (Dec. 3, 2015), https://files.consumerfinance.gov/f/201512_cfpb_consent-order_clarity-services-inc-timothy-ranney.pdf 
(alleging that the defendant violated FCRA section 604(f) by 
obtaining consumer reports to create presentations to market its 
analytical services to lenders and other financial service 
providers); United States v. Direct Lending Source, Inc., No. 3:12-
cv-02441 (S.D. Cal. 2012), https://www.ftc.gov/sites/default/files/documents/cases/2012/10/121010directlendingcmpt.pdf (alleging that 
the defendant violated FCRA section 604(f) by obtaining consumer 
reports without a permissible purpose and selling them to entities 
that targeted consumers in financial distress for loan modification, 
debt relief, and foreclosure relief services); In re Fajilan & 
Assocs., No. C-4332 (Aug. 17, 2011), https://www.ftc.gov/sites/default/files/documents/cases/2011/08/110819statewidecmpt.pdf 
(alleging that the respondents furnished consumer reports to hackers 
in violation of FCRA section 604); In re ACRAnet, Inc., No. C-4331 
(Aug. 17, 2011), https://www.ftc.gov/sites/default/files/documents/cases/2011/08/110809acranetcmpt.pdf (same); In re SettlementOne 
Credit Corp., No. C-4330 (Aug. 17, 2011), https://www.ftc.gov/sites/default/files/documents/cases/2011/08/110819settlementonecmpt.pdf 
(same).
    \15\ United States v. Choicepoint, Inc., No. 1:06-cv-00198-GET, 
at ] 12 (N.D. Ga. 2006), https://www.ftc.gov/sites/default/files/documents/cases/2006/01/0523069complaint.pdf.
    \16\ Bureau of Consumer Fin. Prot. v. Chou Team Realty, LLC et 
al., No. 8:20-cv-00043, at ]] 57-59, 69, 77-78, 89-106 (C.D. Cal. 
2020), https://files.consumerfinance.gov/f/documents/cfpb_chou-team-realty-monster-loans_complaint_2020-01.pdf.
    \17\ United States v. Mortgage Sols. FCS, Inc., No. 4:20-cv-
00110-DMR, at ]] 11-14 (N.D. Cal. 2020), https://www.ftc.gov/system/files/documents/cases/mortgage_solutions_complaint.pdf. In addition 
to continuing to enforce the FCRA's permissible purpose provisions 
and protect the privacy of consumer reports, the Bureau's 
supervisory work also has focused on ensuring compliance with the 
FCRA's permissible purpose requirements by consumer reporting 
companies and consumer report users. See, e.g., Bureau of Consumer 
Fin. Prot., Supervisory Highlights, at 3-4 (Sept. 2020), https://files.consumerfinance.gov/f/documents/cfpb_supervisory-highlights_issue-22_2020-09.pdf; Bureau of Consumer Fin. Prot., 
Supervisory Highlights Consumer Reporting Special Edition, at 16-17 
(Dec. 2019), https://files.consumerfinance.gov/f/documents/cfpb_supervisory-highlights_issue-20_122019.pdf.
---------------------------------------------------------------------------

    In light of the importance of the FCRA's permissible purpose 
provisions to the protection of consumer privacy, the Bureau is issuing 
this advisory opinion to affirm that consumer reporting agencies may 
not provide a consumer report pursuant to FCRA section 604(a) under any 
circumstance not expressly permitted by this section. In particular, 
the permissible purposes identified in FCRA section 604(a)(3) are 
consumer specific--that is, they apply only with respect to the 
consumer who is the subject of the user's request--and a consumer 
reporting company may not provide a consumer report to a user under 
FCRA section 604(a)(3) unless it has reason to believe that all of the 
consumer report information it includes pertains to the consumer who is 
the subject of the user's request. For example, consumer reporting 
agencies violate the FCRA's permissible purpose provisions if they 
provide consumer reports on multiple consumers (e.g., consumers with 
the same name) in response to a request where the user only has a 
permissible purpose to obtain a report on a single individual because 
that would inherently involve providing at least one consumer report on 
an individual with respect to whom the user did not have a permissible 
purpose. The Bureau notes that disclaimers will not cure a failure to 
have a reason to believe that a user has a permissible purpose for a 
consumer report provided pursuant to FCRA section 604(a)(3). The Bureau 
also is issuing this advisory opinion to highlight that FCRA section 
604(f) strictly prohibits a person who uses or obtains a consumer 
report from doing so without a permissible purpose.

B. Coverage

    Section C.1 of this advisory opinion applies to all ``consumer 
reporting agencies,'' as that term is defined in FCRA section 603(f). 
Section C.2 of this advisory opinion applies to all persons that obtain 
or use, or seek to obtain or use, ``consumer reports,'' as that term is 
defined in FCRA section 603(d).

C. Legal Analysis

1. FCRA Section 604(a)(3)
    Section 604(a) of the FCRA identifies a limited set of 
``permissible purposes'' for which a consumer reporting company may 
provide a consumer report to a user.\18\ The Bureau is aware that some 
consumer reporting agencies use insufficient identifiers in matching 
procedures, such as name-only matching, which can result in the 
provision of consumer reports to persons without a permissible purpose 
to receive them. The permissible purposes for which consumer reports 
are most commonly sought are those identified in FCRA section 
604(a)(3), including for purposes related to credit, employment, 
insurance, and rental housing. Under section 604(a)(3), a consumer 
reporting company may provide a consumer report when it has ``reason to 
believe'' that the user requesting the report has one of the 
permissible purposes specified therein with respect to the consumer who 
is the subject of the user's request. The Bureau interprets the 
permissible purposes in FCRA section 604(a)(3) to apply only with 
respect to the consumer who is the subject of the user's request.
---------------------------------------------------------------------------

    \18\ 15 U.S.C. 1681b(a).
---------------------------------------------------------------------------

    The Bureau's interpretation is based on the plain language of FCRA 
section

[[Page 41245]]

604(a)(3) itself, which makes clear that whether a user has a 
permissible purpose under that section is analyzed on a consumer-by-
consumer basis. For example, FCRA section 604(a)(3)(A) permits a 
consumer reporting company to provide a consumer report ``to a person 
which it has reason to believe . . . intends to use the information in 
connection with a credit transaction involving the consumer on whom the 
information is to be furnished and involving the extension of credit 
to, or review or collection of an account of, the consumer.'' \19\ 
Similarly, FCRA section 604(a)(3)(F) permits a consumer reporting 
company to provide a consumer report ``to a person which it has reason 
to believe . . . has a legitimate business need for the information . . 
. in connection with a business transaction that is initiated by the 
consumer or to review an account to determine whether the consumer 
continues to meet the terms of the account.'' \20\
---------------------------------------------------------------------------

    \19\ 15 U.S.C. 1681b(a)(3)(A) (emphasis added).
    \20\ 15 U.S.C. 1681b(a)(3)(F) (emphasis added).
---------------------------------------------------------------------------

    The Bureau's interpretation also is consistent with the FCRA's 
purpose and structure. As explained in part I.A, Congress enacted the 
FCRA in part to address ``a need to insure that consumer reporting 
agencies exercise their grave responsibilities with . . . a respect for 
the consumer's right to privacy.'' \21\ The FCRA achieves this by, 
among other things, narrowly limiting the circumstances under which a 
consumer reporting company may provide consumer report information to 
third parties. The statute is structured so that the permissible 
purposes in section 604(a) function as exceptions to the general rule 
that a consumer reporting company may not provide consumer reports to 
third parties.\22\ Interpreting FCRA section 604(a)(3) to allow a 
consumer reporting company to provide consumer report information to a 
third party about a consumer with respect to whom the third party does 
not have a permissible purpose would undermine the statutory scheme and 
threaten consumer privacy with respect to the often highly sensitive 
information collected by consumer reporting agencies.\23\
---------------------------------------------------------------------------

    \21\ 15 U.S.C. 1681(a)(4).
    \22\ 15 U.S.C. 1681b(a) (providing that, in general, ``[s]ubject 
to subsection (c), any consumer reporting agency may furnish a 
consumer report under the following circumstances and no other'').
    \23\ The Bureau's interpretation of FCRA section 604(a)(3) also 
is consistent with the statute's purpose and structure with respect 
to accuracy. See 15 U.S.C. 1681e(b). As discussed below, a consumer 
reporting agency's use of poor matching procedures can lead to 
violations of the FCRA's permissible purpose requirements, as well 
as its accuracy requirements.
---------------------------------------------------------------------------

    A consumer reporting company may not provide a consumer report 
under FCRA section 604(a)(3) unless it has reason to believe that the 
user has a permissible purpose with respect to the consumer about whom 
the report is requested. A user's request to a consumer reporting 
company for a report about a consumer does not give the consumer 
reporting company a reason to believe that the user has a permissible 
purpose to obtain a consumer report about other consumers. Accordingly, 
a consumer reporting company may not provide a consumer report under 
FCRA section 604(a)(3) unless it has reason to believe that all of the 
consumer report information it includes pertains to the consumer who is 
the subject of the user's request.
    The use of poor matching procedures, such as name-only matching, 
can lead to violations of the FCRA's permissible purpose provisions. As 
the Bureau has observed, some consumer reporting agencies obtain 
information from sources that do not have or use identifying 
information other than consumer names, and they include such 
information in consumer reports without taking additional steps to 
match the information to the consumer who is the subject of the 
report.\24\ The Bureau has recently affirmed that, ``[i]n preparing 
consumer reports, it is not a reasonable procedure to assure maximum 
possible accuracy to use insufficient identifiers to match information 
to the consumer who is the subject of the report.'' \25\ In addition to 
running afoul of the FCRA's accuracy provisions, a consumer reporting 
company that uses insufficient identifiers in its matching procedures, 
such as name-only matching, cannot rely on these procedures to form a 
reason to believe that all of the information it includes in a consumer 
report pertains to the consumer who is the subject of the user's 
request.
---------------------------------------------------------------------------

    \24\ Bureau of Consumer Fin. Prot., Fair Credit Reporting; Name-
Only Matching Procedures, 86 FR 62468, 62472 (Nov. 10, 2021).
    \25\ Id. at 62471.
---------------------------------------------------------------------------

    For example, when a consumer reporting company conducts a public 
records search using name-only matching and identifies one or more 
individuals with the same name as the consumer who is the subject of 
the user's request, it sometimes might provide the user with a report 
containing a possible match or list of possible matches instead of 
taking further steps to match the information to the specific consumer 
who is the subject of the request.\26\ Under these circumstances, a 
consumer reporting company has not formed a reason to believe that all 
of the information it includes in a consumer report pertains to the 
consumer who is the subject of the user's request. If the report 
includes information that identifies (even if not by name) consumers 
who are possible matches and information that bears on the credit 
worthiness, credit standing, credit capacity, character, general 
reputation, personal characteristics, or mode of living of those 
consumers, the consumer reporting company will have provided consumer 
reports about those consumers to a user that does not have a 
permissible purpose for them.\27\
---------------------------------------------------------------------------

    \26\ See, e.g., Erickson v. First Advantage Background Screening 
Corp., 981 F.3d 1246, 1249 (11th Cir. 2020) (defendant furnished a 
consumer report about plaintiff that included a record belonging to 
plaintiff's father using name-only matching; defendant included with 
the consumer report the statement: ``[t]his record is matched by 
First Name, Last Name ONLY and may not belong to your subject. Your 
further review of the State Sex Offender Registry is required in 
order to determine if this is your subject.''); see also United 
States v. Infotrack Info. Servs., 14-cv-02054, at ]] 16-17 (N.D. 
Ill. 2014), https://www.ftc.gov/system/files/documents/cases/140409infotrackcmpt.pdf (defendant consumer reporting agency, using 
name-only matching, identified more than one individual with a 
record in the National Sex Offender registry and reported all 
identified individuals as ``possible matches'' to users). Erickson 
and Infotrack concerned alleged violations of the FCRA's accuracy 
provisions, 15 U.S.C. 1681e(b), not its permissible purpose 
provisions.
    \27\ See, e.g., Erickson, 981 F.3d at 1249 (consumer report 
directed the user to a public database ``to compare the `demographic 
data and available photographs,' noting that the user might 
`conclude that the records do not belong to''' the subject of the 
user's request); Dodgson v. First Advantage Background Screening 
Corp., 2018 WL 1807014, *1 (N.D. Ga. 2018) (noting that the record 
belonging to plaintiff's father that was included in plaintiff's 
consumer report ``contained at the very least an address that did 
not match plaintiff's address''); Infotrack, 14-cv-02054, at ] 16 
(``Defendants would forward reports that included names and pictures 
of several different people with the same name who were convicted 
sex offenders and listed in the National Sex Offender Registry. 
Defendants' practice and procedure resulted in furnishing consumer 
reports to employers that included National Sex Offender Registry 
records of individuals who could not have been the subject of the 
inquiry.'').
---------------------------------------------------------------------------

    The Bureau is aware that some consumer reporting agencies that use 
inadequate matching procedures include disclaimers with their consumer 
reports. For example, one consumer reporting company stated when 
providing a consumer report: ``This record is matched by First Name, 
Last Name ONLY and may not belong to your subject. Your further review 
of the State Sex Offender Registry is required in order to determine if 
this is your subject.'' \28\ Disclaimers will not cure a

[[Page 41246]]

failure to have a reason to believe that a user has a permissible 
purpose for a consumer report provided pursuant to FCRA section 
604(a)(3). A disclaimer does not change the fact that the consumer 
reporting company has failed to satisfy the requirements of 604(a)(3) 
and has provided a consumer report about a consumer to a person lacking 
a permissible purpose with respect to that consumer.
---------------------------------------------------------------------------

    \28\ Erickson, 981 F.3d at 1249.
---------------------------------------------------------------------------

2. FCRA Section 604(f)
    FCRA section 604(f) prohibits a person from using or obtaining a 
consumer report ``unless . . . the consumer report is obtained for a 
purpose for which the consumer report is authorized to be furnished 
under [FCRA section 604]'' and ``the purpose is certified in accordance 
with FCRA section 607 by a prospective user of the report through a 
general or specific certification.'' \29\ Congress amended the FCRA to 
include section 604(f) in September 1996.\30\ Before the 1996 
amendments, FCRA section 604 did not impose limitations on users of 
consumer reports, only on consumer reporting agencies. The Bureau 
interprets FCRA section 604(f) to provide that consumer report users 
are strictly prohibited from using or obtaining consumer reports 
without a permissible purpose. Although some courts have applied a 
``reason to believe'' standard for persons using or obtaining a 
consumer report, as at least one court has noted, the opinion most 
commonly cited in support of this standard was decided before the 1996 
amendments.\31\ Based on its plain language, the 1996 addition of FCRA 
section 604(f) clearly imposes a strict prohibition on using or 
obtaining a consumer report without a permissible purpose.\32\
---------------------------------------------------------------------------

    \29\ 15 U.S.C. 1681b(f). As noted above, FCRA section 607(a) 
requires that a consumer reporting agency must, among other things, 
require that prospective users of consumer reports ``certify the 
purposes for which the information is sought, and certify that the 
information will be used for no other purpose.'' 15 U.S.C. 1681e(a).
    \30\ Consumer Credit Reporting Reform Act of 1996, Public Law 
104-208, Div. A, tit. II, sec. 2404.
    \31\ See, e.g., Blumenfeld v. Regions Bank, No. 4:16-CV-01652-
ACA, 2018 WL 4216369, at *5 (N.D. Ala. 2018) (holding that ``[FCRA 
section 604(f)] does not incorporate the `reason to believe' 
language from [FCRA section 604(a)],'' and noting that the opinion 
in Korotki v. Att'y Servs. Corp. Inc., 931 F. Supp. 1269, 1276 (D. 
Md. 1996) (applying section 604(a)(3)'s ``reason to believe'' 
standard to users), was decided prior to the 1996 amendments to the 
FCRA that added section 604(f)).
    \32\ Pursuant to FCRA sections 616 and 617, a person is civilly 
liable to a consumer for violations of section 604(f) if they have 
negligently or willfully failed to comply with the requirement. 15 
U.S.C. 1681n, 1681o.
---------------------------------------------------------------------------

    Users of consumer reports must ensure that they do not violate 
consumer privacy by obtaining consumer reports when they lack a 
permissible purpose for doing so. For example, in 2018 a company 
settled Bureau allegations that it violated FCRA section 604(f) when 
its agents obtained consumer reports for consumers who were not seeking 
an extension of credit from the company and the company had no other 
permissible purpose for the consumer reports it obtained.\33\ In some 
instances, for example, the company's agents initiated credit 
applications for the wrong consumer by incorrectly inputting consumer 
information into the company's application system or by selecting the 
wrong consumer from a list of possible consumers identified in the 
system. When these applications were initiated in error, the company 
obtained a consumer report for a consumer with respect to which it had 
no permissible purpose, violating the FCRA's permissible purpose 
provisions and the privacy of the consumers that were the subject of 
those reports, and also generating an inquiry on the consumers' credit 
reports.\34\
---------------------------------------------------------------------------

    \33\ In re State Farm Bank, FSB, 2018-CFPB-0009, at ]] 17-19 
(Dec. 6, 2018), https://files.consumerfinance.gov/f/documents/bcfp_state-farm-bank_consent-order.pdf.
    \34\ Id.
---------------------------------------------------------------------------

II. Regulatory Matters

    This advisory opinion is an interpretive rule issued under the 
Bureau's authority to interpret the FCRA, including under section 
1022(b)(1) of the Dodd-Frank Wall Street Reform and Consumer Protection 
Act,\35\ which authorizes guidance as may be necessary or appropriate 
to enable the Bureau to administer and carry out the purposes and 
objectives of Federal consumer financial laws.\36\
---------------------------------------------------------------------------

    \35\ Dodd-Frank Wall Street Reform and Consumer Protection Act, 
Public Law 111-203, 124 Stat. 1376 (2010).
    \36\ 12 U.S.C. 5512(b)(1).
---------------------------------------------------------------------------

    As an interpretive rule, this advisory opinion is exempt from the 
notice-and-comment rulemaking requirements of the Administrative 
Procedure Act.\37\ Because no notice of proposed rulemaking is 
required, the Regulatory Flexibility Act does not require an initial or 
final regulatory flexibility analysis.\38\ The Bureau has also 
determined that this advisory opinion does not impose any new or revise 
any existing recordkeeping, reporting, or disclosure requirements on 
covered entities or members of the public that would be collections of 
information requiring approval by the Office of Management and Budget 
under the Paperwork Reduction Act.\39\
---------------------------------------------------------------------------

    \37\ 5 U.S.C. 553(b).
    \38\ 5 U.S.C. 603(a), 604(a).
    \39\ 4 U.S.C. 3501-3521.
---------------------------------------------------------------------------

    Pursuant to the Congressional Review Act,\40\ the Bureau will 
submit a report containing this interpretive rule and other required 
information to the United States Senate, the United States House of 
Representatives, and the Comptroller General of the United States prior 
to the rule's published effective date. The Office of Information and 
Regulatory Affairs has designated this interpretive rule as not a 
``major rule'' as defined by 5 U.S.C. 804(2).
---------------------------------------------------------------------------

    \40\ 5 U.S.C. 801 et seq.

Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2022-14823 Filed 7-11-22; 8:45 am]
BILLING CODE 4810-AM-P
```