Consumer Data Protection: Actions Needed to Strengthen Oversight of Consumer Reporting Agencies
Released: 2019-03-26T00:00:00

Letter

Background

The Consumer Reporting Process

Information on consumers is exchanged through a consumer reporting process that includes consumers, CRAs, furnishers, and users of that information (see fig.1).

Consumers are individuals whose information is collected and shared to make eligibility decisions, such as for credit, insurance, or employment.

CRAs are companies that assemble or evaluate consumer information for the purpose of furnishing consumer reports to third parties who use the reports to determine consumer eligibility for employment, or products and services such as credit and insurance.

Furnishers are entities such as banks or credit card companies that provide CRAs with consumer information, such as account openings, bill payments, or delinquency information. CRAs use this information, along with other information, including from public records such as bankruptcies, to compile consumer reports.

Users are banks, credit card companies, employers, or other entities that use consumer reports to make eligibility decisions for individual consumers. Users vary in the specific information they request from CRAs and how they interpret the data. Some institutions, such as banks, may act as both furnishers and users.

During the consumer reporting process, a consumer would not necessarily interact with the CRA; however, if the consumer discovered inaccurate information on their credit report as a result of, for example, being denied credit, the consumer could file a dispute with the CRA or the furnisher. Consumers may also request copies of their consumer reports from CRAs directly, and CRAs may provide consumers with disclosures about how their information is being shared.

Oversight Agencies

FTC and, most recently, CFPB, are the federal agencies primarily responsible for overseeing CRAs. FTC has authority to investigate most organizations that maintain consumer data and to bring enforcement actions for violations of statutes and regulations that concern the security of data and consumer information. CFPB, created in 2010 by the Dodd- Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), has enforcement authority over all CRAs for violations of certain consumer financial protection laws. In general, it also has the authority to issue regulations and guidance for those laws. CFPB has supervisory authority over larger market participants in the consumer reporting market. In 2012, CFPB defined larger market participant CRAs as those with more than $7 million in annual receipts from consumer reporting. CFPB’s supervision of these companies includes monitoring, inspecting, and examining them for compliance with the requirements of certain federal consumer financial laws and regulations. As discussed below, these laws include most provisions of the Fair Credit Reporting Act (FCRA); several provisions of the Gramm-Leach-Bliley Act (GLBA); and provisions of the Dodd-Frank Act concerning unfair, deceptive, or abusive acts or practices.

Data Breaches and the Equifax Breach

Although there is no commonly agreed-upon definition of “data breach,” the term generally refers to an unauthorized or unintentional exposure, disclosure, or loss of sensitive information. This information can include personally identifiable information such as Social Security numbers, or financial information such as credit card numbers. A data breach can be inadvertent, such as from the loss of an electronic device; or deliberate, such as from the theft of a device. A breach can also occur as a result of a cyber-based attack by individuals or groups, including organizations’ own employees, foreign nationals, or terrorists. Data breaches have occurred at all types of organizations, including private, nonprofit, and federal and state entities.

In the Equifax data breach, Equifax system administrators discovered on July 29, 2017, that intruders had gained unauthorized access via the Internet to a server housing the company’s online dispute portal. The breach compromised the personally identifiable information of at least 145.5 million individuals, and included names, addresses, and birth dates; and credit card, driver’s license, and Social Security numbers. Equifax’s investigation of the breach identified factors that led to the breach: software vulnerabilities, failure to detect malicious traffic, failure to isolate databases from each other, and inadequately limiting access to sensitive information such as usernames and passwords. Equifax’s public filings after the breach noted that the company took steps to improve security and notify individuals about the breach. Our August 2018 report provides more information on the breach and Equifax’s response.

While data breaches do not always result in measurable harm, intruders may retain or resell stolen information to commit identity theft, which can include existing-account fraud and new-account fraud. In existing-account fraud, identity thieves use financial account identifiers, such as credit card or debit card numbers, to take over an individual’s existing accounts to make unauthorized charges or withdraw money. In new-account fraud, identity thieves use an individual’s identifying data, such as Social Security and driver’s license numbers, to open new financial accounts and incur charges and obtain credit in an individual’s name without that person’s knowledge. In addition, identity thieves may commit synthetic identity fraud, where they combine real and/or fictitious information to create identities with which they may defraud financial institutions, government agencies, or individuals.

Several Federal Laws Govern the Collection, Use, and Protection of Consumer Information

FCRA Governs the Accuracy, Use, and Sharing of Consumer Information, and CRAs Reported Taking Actions to Comply

FCRA, enacted in 1970, is one of the primary federal laws governing the personal information that CRAs hold. It governs the accuracy of this information and gives consumers rights to view, correct, or opt out of the sharing or use of certain aspects of their personal information among affiliates. FCRA also applies to how CRAs can use and share the information.

Accuracy of collected information. FCRA requires that when preparing a consumer report, CRAs follow reasonable procedures to assure “maximum possible accuracy” of the information concerning the individual about whom the report relates. Companies that furnish information to CRAs also must take steps regarding the accuracy of information they report, as required by FCRA and its implementing regulation, Regulation V. A 2012 CFPB report cited steps that nationwide CRAs take to help ensure that information they collect from furnishers is legitimate and accurate. The report notes that initial screening of furnishers generally includes an inspection of the companies’ physical headquarters, phone numbers, websites, business licenses, and company records such as annual reports. In addition, these CRAs may hire third-party investigation services to screen for illegal or unethical business practices. They may also conduct additional inspections in response to consumer complaints, variations in data reporting, or changes in a furnisher’s ownership. To conduct quality checks on data submitted by furnishers, CFPB reported that the nationwide CRAs check for blank fields or logical inconsistencies. Representatives of CRAs we spoke with provided examples of the quality assurance steps they take. For example, one representative told us that they look for violations of logical patterns, such as a loan going from 30 days past due to 90 days past due over the course of one month. CFPB reported that when inaccuracies are identified, the CRAs can reject the information. These steps may improve the quality of the information received from furnishers, but they cannot ensure the accuracy of such data.

Use and sharing of information. FCRA permits CRAs to provide users with consumer reports only if the user has a “permissible purpose,” such as to process a credit application, screen a job applicant, or underwrite an insurance policy, subject to limitations where the credit or insurance transaction is not initiated by the consumer. FCRA also prohibits the use of a consumer report for any purpose other than that specified to the CRA when the user obtained the report. It also requires that CRAs take steps to validate the legitimacy of users and their requests for consumer report information and apply FCRA requirements to the sharing of information within their companies.

Validating the legitimacy of users and their requests for consumer report information. Representatives of CRAs told us they take several steps to validate the legitimacy of users and their requests, including verifying credit transactions, periodically evaluating user agreements, and validating users’ identities. For example, representatives of one CRA said they sometimes conduct on-site visits to verify the existence of an entity and the business it conducts. In addition, they said they randomly select 6,000 to 8,000 consumer files each year and ask users associated with those files to show proof that the consumers engaged in the credit transactions contained in those files. However, several CRAs told us that these steps cannot guarantee that the users and requests are valid. For example, representatives of one CRA noted that once a user has the information, a CRA would find it difficult to prevent that user from retaining and reusing it for purposes other than the original permissible purpose.

Applying FCRA requirements to sharing information internally. As amended by the Fair and Accurate Credit Transactions Act of 2003, FCRA limits the ability of affiliated companies to market products or services to consumers using shared consumer data. Affiliates may use consumer report information for product or service marketing only if they clearly and conspicuously disclose to the consumer that the information may be shared for such solicitations, the consumer is provided a simple method to opt out of such solicitations, and the consumer does not opt out. Representatives of CRAs told us that they apply the same FCRA protections when they share consumer reporting data among their departments or subsidiaries, which may use the data for other purposes. For example, one nationwide CRA said that one of its internal groups seeks to ensure that the company implements appropriate legal protections when it shares data for other uses within the company.

Staff from state Attorneys General offices we spoke with told us that their states also have laws pertaining to consumer reporting, which have similar requirements to those in FCRA. In addition, they noted that while there is no federal data breach notification law, all 50 states have laws requiring companies to notify consumers in the event of a data breach. According to the National Conference of State Legislatures, those laws have varying requirements, such as the timing or method of notification, and who must be notified.

GLBA and Other Laws Govern the Protection of Consumer Information

Congress enacted GLBA in part to protect the privacy and security of nonpublic personal information that individuals provide to financial institutions. According to FTC staff, CRAs may be considered financial institutions under GLBA if they collect, maintain, and report on consumer information. As with FCRA, GLBA restricts financial institutions from sharing consumers’ private information, but GLBA restricts sharing with nonaffiliated third parties specifically, and those parties face similar restrictions in how they may further share or use the information.

In addition, unlike FCRA, GLBA includes a provision directing FTC and certain federal regulators (not including CFPB) to establish standards specifically with respect to protection against any anticipated threats or hazards to the security of customer records. Specifically, under GLBA, these federal regulators are directed to establish appropriate standards for financial institutions under their jurisdiction to ensure the security and confidentiality of customer records and information; protect against any anticipated threats or hazards to the security or integrity of such records; and protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer. To implement these standards for CRAs, and other entities that fall under its jurisdiction, FTC adopted its Safeguards Rule, which requires, among other things, that financial institutions have a written information security program, assess the risks to customer information, and evaluate and adjust the information security program in light of foreseeable risks. FTC staff told us that because GLBA applies to information about a consumer with a customer relationship with a financial institution, the Safeguards Rule may not apply in all cases where a CRA holds personal information on individuals. For example, they said that GLBA would more clearly apply if the consumer had purchased credit monitoring or other products or services directly from the CRA, or if the CRA obtained customer information from another financial institution, such as a bank. Representatives of the three nationwide CRAs told us that for purposes of protecting information, they do not distinguish between consumers with whom they have a direct customer relationship and those with whom they do not.

CRAs we spoke with provided examples of how they protect consumer information and meet GLBA requirements to maintain administrative, technical, and physical safeguards. For example, with respect to administrative safeguards, representatives of one CRA said they enforce contractual requirements for data access and data security. Representatives of another CRA said that the technical safeguards they use include firewalls, anti-virus software, and malware protection. Examples of physical safeguards from another CRA included monitoring data centers by video and restricting access to secure data rooms. To address data protection more generally, representatives of CRAs we spoke with told us they routinely conduct internal audits of their data security systems, and that the financial institutions they work with frequently conduct audits of their risk management practices, including CRAs’ data security controls.

Provisions related to unfair or deceptive acts or practices also may apply to CRAs’ protection of consumer data. Specifically, under FTC’s authority, section 5 of the Federal Trade Commission Act (FTC Act) prohibits “unfair or deceptive acts or practices” in or affecting commerce. In the context of privacy and security, these provisions require companies to truthfully represent practices to consumers. For example, FTC has found companies that alleged that they were following certain security protections, but did not in fact have such security features, to have engaged in unfair or deceptive practices. Similarly, the Dodd-Frank Act prohibits providers of consumer financial products or services from engaging in “unfair, deceptive, or abusive acts or practices,” and CFPB has authority to enforce and supervise for compliance with this provision. CFPB has alleged that claims to consumers that transactions are safe and secure while simultaneously lacking basic security practices can constitute unfair, deceptive, or abusive acts or practices. FTC and CFPB officials said that in the case of data breaches, they would examine each case individually to determine whether the institution violated these provisions in connection with the breach.

Some states also have laws that protect consumer information, including laws that generally govern data security. For example, staff from the Massachusetts Attorney General’s office told us that their state has a data security law similar to FTC’s Safeguards Rule but with more specific requirements, including those for malware detection and firewalls. According to the National Consumer Law Center, all 50 states have consumer protection laws that prohibit unfair or deceptive practices. Staff from state Attorneys General offices told us that they can prosecute entities for potential violations of these provisions, including data breaches. They told us that following the Equifax breach, several states’ Attorneys General launched a joint investigation into whether Equifax violated state laws, including prohibitions of unfair or deceptive practices. According to staff from one state Attorney General office, as of February 2019, this investigation was ongoing. In addition, Equifax reported that individual states have also filed legal action or have ongoing investigations. For example, Massachusetts and West Virginia have filed civil enforcement actions against Equifax that seek various remedies, including civil penalties.

FTC Has Taken Enforcement Measures against CRAs but Lacks Civil Penalty Authority for GLBA Data Protection Provisions

FTC Enforces CRA Compliance with Consumer Protection Laws

FTC enforces compliance with consumer protection laws under authorities provided in FCRA, GLBA, and the FTC Act. FCRA authorizes FTC to enforce compliance for nearly all companies not supervised by either a federal banking regulator or certain other federal agencies. GLBA authorizes FTC to issue certain rules and enforce compliance for all nonbank financial institutions and other entities not under the jurisdiction of a federal banking regulator, the National Credit Union Administration, Securities and Exchange Commission, or state insurance regulators. The FTC Act authorizes FTC to investigate and take administrative and civil enforcement actions against companies under its jurisdiction that engage in unfair or deceptive acts or practices in or affecting commerce. According to FTC, in the last 10 years, it has brought 34 enforcement actions for FCRA violations, including 17 against CRAs. In addition, FTC said that it had taken a total of 66 actions against companies (not just in the last 10 years), including CRAs, that allegedly engaged in unfair or deceptive practices relating to data protection.

If FTC has reason to believe that a company has violated laws under its jurisdiction, it may initiate an investigation to determine whether to take enforcement action. FTC staff said that in determining whether to take on a case related to privacy and data security matters, they consider factors such as the company’s size and the sensitivity of the data in the company’s network. For example, FTC may choose not to investigate a data breach of a small company that affects few people; however, it may investigate a potential data security violation of a large company, even without evidence of a breach. Under its statutory authority, FTC can ask or compel companies to produce documents, testimony, and other materials to assist in its investigations. In June 2018, FTC notified Equifax that it was considering legal action against the company as a result of its 2017 data breach, including seeking civil penalties.

If FTC finds that a company violated consumer law, the agency may take several different actions depending on its legal authority and what it considers to be the most appropriate response. For example, FTC may, in administrative proceedings, issue cease-and-desist orders for unfair or deceptive acts or practices. Further, FTC generally may seek a range of remedies from the U.S. district courts, including injunctions, damages to compensate consumers for their actual losses, and disgorgement of ill- gotten funds. In limited circumstances, FTC also may seek civil money penalties, which are monetary fines imposed for a violation of a statute or regulation.

Examples of FTC enforcement actions related to consumer reporting include: In May 2016, FTC settled with a furnisher that allegedly violated FCRA requirements to have adequate policies and procedures for reporting accurate credit information to CRAs. FTC alleged that a debt collector acting as a furnisher did not have a written policy regarding the accuracy and integrity of information it furnished, and in numerous instances failed to inform consumers about these outcomes.

In 2011, FTC brought enforcement actions against three CRAs that merge, and then sell, information from the three nationwide CRAs. FTC alleged that these companies did not meet GLBA standards and violated unfair or deceptive practices prohibitions by not providing reasonable and appropriate security for consumers’ personal information. These violations included not developing and disseminating information security policies, and not addressing risks by, for example, evaluating the security of end users’ computer networks.

In 2006, FTC settled with ChoicePoint—a CRA—and imposed a $10 million civil penalty for violations of FCRA stemming from a 2005 data breach. In 2009, FTC obtained an additional $275,000 in equitable monetary relief due to ChoicePoint’s violation of the order after an additional data breach occurred in 2008.

FTC’s Lack of Civil Penalty Authority for GLBA May Hinder Its Effectiveness in Enforcing Data Security Provisions

As previously discussed, in some circumstances, FTC enforcement authority can include civil money penalties. This includes cases of knowing violations of FCRA. For example, in a 2014 settlement, FTC levied $525,000 in civil penalties against a CRA after alleging that the company did not comply with FCRA provisions to ensure the accurate and permissible use of its reports. FTC does not have civil penalty authority for initial violations of the FTC Act but may obtain civil penalties from companies for violations of FTC Act orders.

FTC’s civil penalty authority does not extend to initial violations of GLBA’s privacy and safeguarding provisions, which require administrative, physical, and technical safeguards with an emphasis on protection against anticipated threats and unauthorized access to customer records. For violations of GLBA provisions, which are enforced pursuant to FTC Act authority, FTC may seek an injunction to stop a company from violating these provisions and may seek redress (damages to compensate consumers for losses) or disgorgement. However, determining the appropriate amount of consumer compensation requires FTC to identify the consumers affected and the amount of monetary harm they suffered. In cases involving security or privacy violations resulting from data breaches, assessing monetary harm can be difficult. Consumers may not be aware that their identities have been stolen as a result of a breach and or identity theft, and related harm may occur years in the future. In addition, it can be difficult to trace instances of identity theft to specific data breaches. According to FTC staff, these factors can make it difficult for the agency to identify which individuals were victimized as a result of a particular breach and to what extent they were harmed and then obtain related redress or disgorgement. Having civil penalty authority for GLBA provisions would allow FTC to fine a company for a violation such as a data breach without needing to prove the monetary harm to individual consumers.

FTC staff told us and testified before Congress that civil penalties are often the most appropriate remedy for a data breach, and that such penalties serve as an effective deterrent in cases involving weak data privacy and security policies and practices. FTC staff noted that in the case of a data breach, each consumer record exposed could constitute a violation; as a result, a data breach that involved a large number of consumer records could result in substantial fines. Unlike FTC, other regulators have civil penalty authority to punish entities that violate provisions of GLBA. For example, the Office of the Comptroller of the Currency has said that it can enforce GLBA privacy and safeguard provisions with civil money penalties against any insured depository institution or institution-affiliated party subject to its supervision.

In our 2009 report on modernizing the financial regulatory framework, we stated that financial regulators should have the authority to carry out and enforce their statutory missions. In the case of FTC, this includes having the tools necessary to meet its mission of protecting consumers from harm, including the harm caused by misuse of personal information, by having the range of authorities to punish entities for violations of the statutes and regulations the agency enforces.

In 2006, we suggested that Congress consider providing FTC with civil penalty authority for its enforcement of GLBA’s privacy and safeguarding provisions. We noted that providing this authority would give FTC a practical enforcement tool to more effectively enforce provisions related to security of data and consumer information. Following the 2008 financial crisis, Congress introduced several bills related to data protection and identity theft, which included giving FTC civil penalty authority for its enforcement of GLBA. However, in the final adoption of these laws, Congress did not provide FTC with this authority. Since that time, data breaches at Equifax and other large organizations have highlighted the need to better protect sensitive personal information. Accordingly, we continue to believe FTC and consumers would benefit if FTC had such authority.

CFPB Enforces and Examines CRAs for Compliance with Consumer Protection Laws but Does Not Fully Consider Data Security in Prioritizing Examinations

CFPB Enforces and Examines CRA Compliance with Consumer Protection Laws

CFPB enforces compliance with most provisions of FCRA; several provisions of GLBA; and the prohibition of unfair, deceptive, or abusive acts or practices under the Dodd-Frank Act. According to CFPB staff, CFPB cannot enforce data security standards under these statutory provisions or the FTC’s implementing rules because CFPB does not have authority to supervise for or enforce compliance with the GLBA’s safeguards provision or FCRA’s red flags or records disposal provisions.

Since 2015, CFPB has had five public settlements with CRAs. Four of these settlements included alleged violations of FCRA and three included alleged violations of unfair, deceptive, or abusive practices provisions. For example, in March 2017, CFPB settled with Experian for $3 million in civil penalties for an alleged violation of FCRA and alleged deceptive acts or practices. Experian marketed to consumers an “educational credit score” that the company claimed lenders used to make credit decisions. CFPB alleged that lenders did not use these “educational credit scores” for this purpose, and that Experian violated FCRA’s implementing regulation by requiring consumers to view Experian advertisements before obtaining a free credit report. In December 2015, CFPB levied a fine of $8 million against another CRA—Clarity Services, Inc.—for obtaining consumer reports without a permissible purpose in violation of FCRA and failing to investigate consumer disputes. CFPB is also continuing its investigation of Equifax’s data breach.

CFPB supervises the larger market participant CRAs (those with more than $7 million in annual receipts from consumer reporting, as defined by CFPB) and has the authority to examine these CRAs for compliance with federal consumer financial protection laws. From 2015 through 2017, CFPB examined several CRAs. Some of these examinations resulted in findings of deficiencies related to data accuracy and dispute processes, and follow-up examinations were conducted as necessary. As part of its supervisory role, CFPB also periodically monitors the nationwide CRAs by requesting information on their activities and identifying any changes in risk to consumers and the market. CFPB uses this information to learn of changes to a CRA’s compliance, personnel, issues raised by the CRA’s internal audits, or other developments that might affect CFPB’s strategy for supervising the CRA.

CFPB May Not Be Identifying All CRAs under Its Supervisory Authority

CFPB has examined several larger market participant CRAs, but may not be identifying all CRAs that meet the $7 million threshold. CFPB staff told us that as of October 2018, they were tracking between 10 and 15 CRAs that might qualify as larger market participants (as defined by CFPB). CFPB staff told us that they believe the CRA market is highly concentrated and there were not likely to be many larger market participants beyond the 10 to 15 they are tracking. However, CFPB staff said that the 10 to 15 CRAs may not comprise the entirety of larger market participants because whether CRAs meet the threshold may vary from year to year and CFPB has limited data to determine whether CRAs meet the threshold. Specifically, CFPB staff said that identifying additional larger market participant CRAs can be challenging. For example, the Securities and Exchange Commission does not require nonpublicly traded CRAs to file financial and other information that CFPB could otherwise use to identify these CRAs, which are generally not widely known to the public. In addition, CFPB staff said they do not ask CRAs to provide their annual receipts, with the exception of the specific CRAs being considered for examination in a given year, because CFPB staff said calculating these receipts could create an additional cost to the companies.

Our January 2009 report on reforming the U.S. financial regulatory structure noted that regulators should be able to identify institutions and products that pose risks to the financial system, and monitor similar institutions consistently. One method for identifying institutions for oversight, particularly where data are limited, is to require companies to register with the relevant regulator. For example, among other requirements, insured depository institutions must obtain a charter to operate, and money services businesses generally must register with the Financial Crimes Enforcement Network. Similarly, CFPB could identify CRAs that meet the larger market participant threshold by requiring such businesses to register with them, subject to a rulemaking process and cost-benefit analysis of the burden it could impose on the industry. Another method CFPB could use to identify CRAs and inform its oversight activities would be to leverage information collected by states. Stakeholders we spoke with cited New York and Maine as examples where CRAs are required to register with the state. Implementing strategies such as registration or leveraging existing information could be a cost-effective way for CFPB to identify all CRAs under its authority. Identifying additional sources of information on the population of larger market participant CRAs—including those that are lesser-known, possibly unknown to CFPB, and possibly in possession of large amounts of sensitive consumer information—could help ensure that CFPB has more comprehensive information for carrying out its supervisory responsibilities.

CFPB’s Prioritization of CRA Examinations Does Not Specifically Account for Data Security Risk

To determine which product lines, institutions, and compliance issues to examine, CFPB determines the institutions (for example, banks, credit unions, non-bank mortgage servicers, and CRAs) and the consumer product lines that pose the greatest risk to consumers, and prioritizes these for examinations annually (see fig.2). CFPB segments the consumer product market into institution product lines, or specific institutions’ offerings of consumer product lines. CFPB then assesses each institution product line’s risk to consumers at the market level and institutional level. To assess risk at the market level, CFPB considers market size and other factors that contribute to market risk. Market size includes a consideration of a product’s market size relative to other consumer finance product markets. Other market risk factors include the potential risk to consumers from new or existing products offered in the market as well as emerging risks and trends in consumer financial products. For example, CFPB noted that a market may be considered higher risk if consumers cannot choose the provider of a financial product or service in that market, or if the transactions occur between two businesses rather than between a business and consumers. Because they do not face the same risk of losing customers as companies in other markets, companies in higher-risk markets may not have the same financial incentives to protect the interests of consumers.

To assess risk at the institution level, CFPB considers an institution’s market share within a product line, as well as field and market intelligence. An institution’s market share correlates with the number of consumers who could be affected by that institution’s practices; therefore, CFPB generally places a higher priority on larger providers of products. Field and market intelligence includes quantitative and qualitative information on an institution’s operations for a given product line, including the strength of its compliance management systems, the number of regulatory actions directed at the institution, findings from prior CFPB examinations, information obtained from CFPB’s quarterly monitoring of institutions, public reports, and the number and severity of consumer complaints CFPB has received about the institution. Field and market intelligence can also include information about an institution’s fair lending practices and its ability to provide fair, equitable, and nondiscriminatory access to credit.

Taking market and institutional considerations together, CFPB places institution product lines into tiers based on its determination of their relative risk to consumers. These risk tiers range from 1 to 5, with 1 being the lowest risk and 5 being the highest risk. Risk tiers then feed into CFPB’s development of its supervision strategy, which includes other information, including information from subject matter experts and recent legal and policy decisions that could affect examinations, and consultations with internal stakeholders. CFPB uses both the risk tiers and information from its supervision strategy to identify potential institutions for examination. Following this process, CFPB has regularly determined CRAs’ consumer reporting to be a high priority for examination since it began supervising them in 2012.

After identifying institution product lines to examine, CFPB determines specific areas of compliance to assess. These determinations are made by considering sources such as consumer complaints, public filings and reports, and past examination findings related to the same or similar products or institutions. Most recently, CFPB examinations of CRA’s consumer reporting have focused on issues such as data accuracy, dispute processes, compliance management, and permissible purposes.

Although CFPB’s examination prioritization incorporates several important factors and sources, the process does not routinely include assessments of data security risk, such as how institutions detect and respond to cyber threats. According to CFPB staff, the agency’s process for determining risk tiers incorporates the risk factors specifically cited in the Dodd-Frank Act, including those related to the size of a product market. The Act also states that CFPB should consider other factors it determines to be relevant; as such, CFPB staff noted that certain elements of data protection have been included in the scope of some of its past CRA examinations. For example, CFPB staff said that in assessing compliance with FCRA’s permissible purposes provision, the examination scope would include ensuring that data are not improperly shared. CFPB staff noted that the bureau cannot examine for compliance with or enforce the data security standards in provisions of GLBA and FCRA or FTC’s implementing rules, even at larger participant CRAs. After the Equifax breach, however, CFPB used its existing supervisory authority to develop internal guidelines for examining data security, and conduct some CRA data security examinations. CFPB staff said that they do not routinely consider data security risks during their examination prioritization process and have not reassessed the process to determine how to incorporate such risks going forward.

The Dodd-Frank Act requires CFPB, when implementing its risk-based supervision program, to consider risks posed to consumers in the relevant product and geographic markets. In addition, federal internal control standards state that agencies should identify, analyze, and respond to risks related to achieving defined objectives. This can entail considering all significant internal and external factors to identify risks and their significance, including magnitude of impact, likelihood of occurrence, nature of the risk, and appropriate response. In light of the Equifax breach, as well as CFPB’s acknowledgment of the CRA market as a higher-risk market for consumers, it is important for CFPB to routinely consider factors that could inform the extent of CRA data security risk such as the number of consumers that could be affected by a data security incident and the nature of potential harm resulting from the loss or exposure of information.

CFPB’s reliance primarily on consumer complaints, information from public filings, and information and findings from past examination for prioritizing examinations may not fully detect data security risks that CRAs pose. Data accuracy and dispute resolution feature prominently in consumer complaints, according to CFPB staff, because consumers mostly interact with CRAs in these contexts. But consumers likely did not know, for example, about Equifax’s data security challenges prior to its breach, so that vulnerability was not a focus of complaints. While the three nationwide CRAs acknowledged the risk of data breaches in recent public filings, other larger participant CRAs may not be publicly traded and therefore may not have public filings. Further, if CFPB’s past examinations have not addressed data security, the agency cannot use those past examination findings to target current risks.

The Equifax breach demonstrated the vulnerability that CRAs may face with regard to data security. We have noted that advancements in technology, combined with the increasing sophistication of hackers and others with malicious intent, have increased the risk of sensitive personal information being exposed and compromised. We have also reported that rapid developments in new technologies will continue to pose new threats to security, privacy, and safety. In recent years, insured depository institutions—which, like CRAs, maintain large amounts of sensitive consumer data—have been subject to regular information technology examinations, which, according to one regulator, may include a cybersecurity component. Banking regulators have noted that unauthorized access to the information and systems that support these institutions can affect operations, pose risk to consumers through exposure of private information, and undermine consumer confidence.

The risks may be similar for CRAs—companies that by definition also maintain extensive amounts of sensitive consumer information. By including routine consideration of data security risks into its process for prioritizing CRA examinations, CFPB can better ensure that its supervision of CRAs proactively detects such risks and helps prevent the further exposure or compromise of consumer information.

Regulators Inform Consumers about Protections Available and Consumers Can Take Some Actions after a CRA Data Breach FTC and CFPB Provide Consumers with Information on How to Address Identity Theft Risk

FTC and CFPB provide educational information for consumers on ways to mitigate the risk of identity theft. For example, FTC has a dedicated website (IdentityTheft.gov) that allows consumers to report suspected identity theft to FTC and develop and implement a recovery plan. In addition, FTC offers businesses guidance on steps to take in the event of a data breach, including notification of relevant parties and a model notification letter. CFPB’s website offers consumers tips on how to protect their information and spot identity theft. CFPB also publishes a consumer guide that lists CRAs and their websites, and ways to obtain free credit reports.

After a breach, FTC and CFPB publish information specific to that breach. For example, shortly after Equifax’s announcement of the breach, FTC published information on when the breach occurred, the types of data compromised, and links to additional information on Equifax’s website. Similarly, CFPB released three blog posts and several social media posts shortly after Equifax’s public announcement of the breach. These included information on ways that consumers could protect themselves in the wake of the breach and special protections and actions for service members.

Consumers Have Options to Mitigate Identity Theft Risk and Respond to Breaches

At any time, consumers can take actions to help mitigate identity theft risk. For example, consumers can implement a credit freeze free of charge, which can help prevent new-account fraud by restricting potential creditors from accessing the consumer’s credit report. Similarly, implementing a free fraud alert with a credit bureau can help prevent fraud because it requires a business to verify a consumer’s identity before issuing credit. Consumers also can monitor their credit report for suspicious activity, either through self-review or by using a free or paid credit monitoring service. FTC and others recommend that consumers regularly review their credit card and bank statements to detect fraudulent charges.

Consumers whose data have been compromised in any data breach can file a complaint with FTC or CFPB. FTC has an online “complaint assistant,” and FTC staff told us they use consumer complaints to help inform their investigatory and enforcement activity. CFPB staff told us that they use consumer complaints to help prioritize examinations and inform enforcement activity. In the 6 months following Equifax’s announcement of its data breach, CFPB received more than 20,000 consumer complaints about the impact of the breach or Equifax’s response.

However, consumers are limited in the direct actions they can take against a CRA in the event of a data breach, for two primary reasons. First, consumers generally cannot trace the source of the data used to commit identity theft to a particular breached entity. As a result, it can be difficult to link a breach by a CRA (or any other entity) to the harm a consumer suffers from a particular incidence of identity theft, which may make it challenging to prevail in a legal action. Second, unlike with many other products and services, consumers generally cannot exercise choice if they are dissatisfied with a CRA’s privacy or security practices. Specifically, consumers cannot choose which CRAs maintain information about them. In addition, consumers do not have a legal right to delete their records with CRAs, according to CFPB staff, and therefore cannot choose to remove themselves entirely from the CRA market.

FTC and CFPB have noted that the level of consumer protection required can depend on the consumer’s ability to exercise choice in a marketplace. For example, when determining whether a practice constitutes an unfair practice, FTC considers whether the practice is one that consumers could choose to avoid. Similarly, according to CFPB staff, the consumer reporting market may pose higher risk to consumers because consumers cannot choose whether or which CRAs possess and sell their information.

Conclusions

The 2017 data breach of Equifax highlighted the data security risks associated with CRAs. While companies in many industries have experienced data breaches, CRAs may present heightened risks because of the scope of sensitive information they possess and because consumers have very limited control over what information CRAs hold and how they protect it. These challenges underscore the importance of appropriate federal oversight of CRAs’ data security.

While FTC has taken significant enforcement actions against CRAs that have violated federal privacy or data security laws, it is important that the agency have all of the appropriate enforcement options to fulfill its mission of protecting consumers. However, GLBA, one of the key laws governing the security of consumer information, does not provide FTC with civil penalty authority. The remedies that FTC does have available under GLBA—such as disgorgement and consumer redress—may be less practical enforcement tools for violations involving breaches of mass consumer data. Accordingly, providing FTC with civil penalty authority can enable it to more effectively or efficiently enforce GLBA’s privacy and safeguarding provisions.

Although CFPB is responsible for overseeing larger market participant CRAs, it lacks the data to identify with certainty all the CRAs under its supervision, in part because the sources it is using, such as public filings, are not comprehensive. Using additional methods to obtain information, such as requiring larger market participant CRAs to register with the agency or leveraging state registration information, would help CFPB ensure it is tracking all CRAs under its supervision and is providing appropriate oversight.

CFPB considers a number of market and institutional factors in prioritizing which CRAs to examine, but data security has not routinely been among these factors. Given the nature and amount of consumer information CRAs hold, as well as increasing threats from hackers and others with malicious intent, vulnerabilities in these companies’ data security can pose significant risk to a vast number of consumers. By ensuring that its process for determining the scope of CRA examinations routinely includes factors that would detect data security risks, CFPB can better ensure the effectiveness of its supervision and help prevent further exposure or compromise of consumer information.

Matter for Congressional Consideration

Congress should consider providing the Federal Trade Commission with civil penalty authority for the privacy and safeguarding provisions of the Gramm-Leach-Bliley Act to help ensure that the agency has the tools it needs to most effectively act against data privacy and security violations. (Matter for Consideration 1)

Recommendations for Executive Action

We are making two recommendations to CFPB: The Director of CFPB should identify additional sources of information, such as through registering CRAs or leveraging state information, that would help ensure the agency is tracking all CRAs that meet the larger participant threshold. (Recommendation 1)

The Director of CFPB should assess whether its process for prioritizing CRA examinations sufficiently incorporates the data security risks CRAs pose to consumers, and take any needed steps identified by the assessment to more sufficiently incorporate these risks. (Recommendation 2)

Agency Comments and Our Evaluation

We provided a draft of this report to CFPB, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, FTC, and the Office of the Comptroller of the Currency. All of the agencies provided technical edits, which we incorporated as appropriate. In addition, we received written comments from CFPB, which are reprinted in appendix II.

CFPB neither agreed nor disagreed with our recommendations. Regarding our recommendation that it identify additional sources of information that would help ensure that it is tracking all CRAs that meet the larger market participant threshold, CFPB noted that it cannot require CRAs to register with the bureau without first undertaking a rulemaking. While we acknowledge the challenges of tracking larger participant CRAs, we maintain that CFPB should be able to identify and monitor them consistently. In its letter, CFPB stated that this may be feasible. The agency noted that, short of rulemaking, there may be cost-effective ways to better ensure that it is appropriately tracking larger participant CRAs and added that they intend to track these CRAs by exploring ways to leverage state registration information. These actions, if fully implemented, would meet the intent of our recommendation.

With respect to the recommendation that CFPB assess whether its process for prioritizing CRA examinations sufficiently incorporates data security risks, CFPB said it will continue to evaluate risks to consumers, including data security risks, as part of its prioritization process. CFPB also said it will assess whether that process should incorporate data security risks CRAs pose to consumers. However, CFPB expressed concern with the scope of its statutory authority, such as its lack of authority to supervise for compliance with GLBA safeguard provisions.

CFPB noted that we did not adequately consider or discuss its limited statutory authority in the area of data security. Specifically, CFPB stated that it does not have authority to supervise for, enforce compliance with, or write regulations implementing GLBA’s safeguards provisions or FCRA’s records disposal provision. In response, we added language in the report to clarify CFPB’s lack of certain authorities over these data security provisions. Nonetheless, as we discuss in the report, CFPB has conducted data security examinations of some CRAs under its existing authority, including its authority to assess compliance with the requirements of federal consumer financial law. We continue to believe that effective supervision of CRAs and the protection of consumer information require that CFPB consider data security risks in its prioritization of CRA examinations.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, CFPB, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, FTC, and the Office of the Comptroller of the Currency. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact Michael Clements at (202) 512-8678 or clementsm@gao.gov, or Nick Marinos at (202) 512-9342 or marinosn@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to examine (1) the federal laws and regulations governing consumer reporting agencies’ (CRA) collection, use, and protection of consumer information; (2) measures the Federal Trade Commission (FTC) has taken to enforce CRA compliance with requirements to protect consumer information; (3) measures the Consumer Financial Protection Bureau(CFPB) has taken to ensure that CRAs protect consumer information; and (4) FTC’s and CFPB’s roles in assisting consumers following a data breach and actions consumers can take following a data breach of a CRA.

To examine the laws governing CRAs, we identified the relevant laws, including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and statutes related to unfair or deceptive acts or practices. We reviewed these laws for their application to CRAs and their collection, use, and protection of consumer information. We interviewed representatives of relevant federal agencies, including CFPB and FTC, about these laws and regulations and how they apply to CRAs. We also reviewed documents from and interviewed federal banking regulators on their role in overseeing financial institutions’ management of third-party risk, including those of CRAs. We selected four states with existing or proposed information protection laws or regulations that vary from federal requirements (California, Illinois, Massachusetts, and New York); reviewed related documentation; and interviewed Attorneys General from these states about their enforcement of state laws. In addition, we interviewed and reviewed documentation from the three nationwide CRAs and interviewed three other CRAs that produce or compile consumer reporting information. We selected these CRAs because they are not sector-specific and hold information on a broad segment of the population. We conducted a site visit to Equifax’s Alpharetta, Georgia data center to learn more about steps the company takes to comply with relevant consumer protection laws. We also interviewed representatives of furnishers and users of CRA consumer information—the American Bankers Association, the Property Casualty Insurance Association of America, and the National Retail Federation—about their roles in the collection, use, and protection of consumer data, and steps their members take to comply with relevant laws.

To assess FTC’s and CFPB’s measures to enforce information protection provisions and to ensure CRAs’ proper collection, use, and protection of consumer information, we reviewed agency documentation and interviewed agency officials on their oversight activities. We reviewed the types of enforcement actions available to FTC and CFPB for violations of laws related to consumer reporting, as well as specific enforcement actions these agencies have brought against CRAs, data furnishers, and users of consumer reports. We also interviewed agency staff about FTC enforcement actions against CRAs and how it determines when to pursue such actions. We reviewed CFPB documentation on the scope of its supervisory examinations of larger market participant CRAs since 2015, as well as findings from recent CRA examinations. In addition, we reviewed CFPB examination guidance for supervising these CRAs, including CFPB’s internal guidelines for conducting data security examinations. We also reviewed documents related to CFPB’s process for prioritizing which institutions and which product lines (specific product offerings) should receive supervisory examination, and we interviewed CFPB staff about this process. Finally, we interviewed representatives of industry, consumer, and privacy groups for their views on the supervision of CRAs. These included the three nationwide CRAs, three other CRAs, the Consumer Data Industry Association, National Consumer Law Center, Consumer Federation of America, Consumers Union, World Privacy Forum, ID Theft Resource Center, and Consumer Action.

To assess FTC and CFPB roles in assisting consumers, and actions consumers can take following a data breach of a CRA, we reviewed the two agencies’ efforts to inform and educate consumers following breaches. Specifically, we reviewed consumer education materials on FTC’s and CFPB’s websites related to data breaches and identify theft in general, as well as specific information posted after the Equifax data breach. We also interviewed staff from these agencies about their roles in assisting consumers following a breach. To identify actions consumers can take following a data breach, we reviewed our prior related reports and spoke with representatives of the industry and consumer representatives noted above.

We conducted this performance audit from November 2017 to February 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Bureau of Consumer Financial Protection

Appendix III: GAO Contacts and Staff Acknowledgments

GAO Contacts

GAO Staff Acknowledgments:

In addition to the individuals named above, John de Ferrari and John Forrester (Assistant Directors); Winnie Tsen (Analyst-in-Charge), Bethany Benitez, Kavita Daitnarayan, Farrah Graham, Andrea Harvey, Thomas Johnson, Tovah Rom, Rachel Siegel, Jena Sinkfield, and Tina Torabi made key contributions to this report.