This week, the Consumer Financial Protection Bureau (CFPB) issued a Notice of Proposed Rulemaking that could significantly alter the landscape of consumer reporting practices. The CFPB also issued a press release on the proposal. This proposed rule includes sweeping changes that redefine key terms, expand regulatory oversight, and impose new restrictions on the use and handling of consumer data. RMAI is continuing its in-depth review and analysis but is providing the following initial summary of key provisions and their potential impacts.

Expanded Definition of Consumer Reports:

  • Any information about a consumer’s credit history, credit score, payment history, etc., will be deemed a “consumer report,” regardless of the intended use or purpose of the data.
  • Any information used for a purpose covered by the Fair Credit Reporting Act (FCRA) will also be considered a consumer report, even if the provider did not know or intend for it to be used that way.
  • Credit Header Data: Personal identifiers collected during the creation of a consumer report will now also be classified as consumer reports, even if shared separately. No exceptions are made for anti-fraud measures, with the CFPB stating that entities with permissible purposes can still use consumer reports for fraud prevention.

Broader Definition of Consumer Reporting Agencies:

  • Entities that collect, retain, or contribute to consumer information are now defined as consumer reporting agencies (CRAs).
  • The terms “assembling” and “evaluating” are expanded to include nearly any activity involving consumer data.

Redefinition of “Furnishing” Consumer Reports:

  • Facilitating a user’s use of consumer report information for financial gain now qualifies as “furnishing a consumer report,” even if the data is not directly transferred to the user.

Limitations on Consumer Consent:

  • Written authorizations for permissible purposes must include detailed disclosures and will be valid for no more than one year.

The expanded definitions may subject RMAI members to additional FCRA compliance, requiring reviews of data handling and reporting practices.

The public comment deadline is March 3, 2025.

This shifts the next phase to the Trump administration, potentially jeopardizing its chances of being finalized or leading to significant alterations. RMAI is closely monitoring this proposed rule and will keep you updated on developments. If you have specific concerns or questions, please reach out to Mike Becker ([email protected]).

This Member Alert is intended for members of the Receivables Management Association International, is for informational purposes only, and is in no way intended to provide legal advice. Members are encouraged to consult with an attorney of their choice for legal advice concerning this matter.