Amidst Covid-19 Pandemic Credit Reporting Concerns, CFPB Reaffirms That Name-Only Matching Violates FCRA

On November 4, 2021, the Bureau of Consumer Financial Protection (the “Bureau”) issued an advisory opinion reaffirming its stance that a consumer reporting agency (“CRA”) using name-only matching procedures violates 15 U.S.C. § 1681e of FCRA.  The advisory opinion is an interpretive rule and became effective upon publication in the Federal Register, on November 10, 2021. 

The majority of the opinion provides background on the dangers of inaccurate reporting—especially during the COVID-19 pandemic—and the consequences inaccurate reporting can have on consumers.  The Bureau highlights that since 1970 Congress has been involved in regulating consumer reporting and underscores the expansions Congress has made to FCRA since 2003.  According to the Bureau, data has shown that complaints from consumers concerning the reporting of inaccurate information has skyrocketed and “[i]n 2020 alone, companies provided responses to more than 191,000 such complaints, which represents approximately 68 percent of credit or consumer reporting complaints responded to by companies that year.”

In particular, the Bureau singles out the dangers of name-only matching procedures.  The opinion explains that name-only matching “occurs when a consumer reporting agency uses only first and last name to determine whether a particular item of information relates to a particular consumer, without using other personally identifying information such as address, date of birth, or Social Security number.”  Due to demographic and naming conventions, there exist millions of consumers sharing the same surname and an overwhelming commonality of first and last names.  Therefore, the Bureau has emphasized the high risk of mismatching consumer information when a CRA fails to cross check a consumer’s information from multiple sources and instead, only matches the name of that consumer in the public record.  Furthermore, the Bureau emphasized the disparate impact name-only matching has on minority communities which have “less last-name diversity” — possibly foreshadowing an increase in disparate impact enforcement actions against CRAs that continue to use name-only matching procedures. 

The opinion discusses the Bureau’s history of enforcement actions centered around violations of 15 U.S.C. § 1681e and the failure of CRAs to “use reasonable procedures to assure maximum possible accuracy of consumer report information” by using name-only matching.  Pursuant to a nationwide settlement, “starting July 1, 2017, public record data obtained by the nationwide consumer reporting agencies for inclusion on credit reports must contain name, address, and Social Security Number and/or date of birth and must be refreshed at least every 90 days.”  However, the Bureau has found, that while many CRAs have discontinued the practice of name-only matching, some CRAs continue to use this procedure.  Notably, this was the same issue that gave rise to the Ramirez v. TransUnion LLC case which ultimately reached the U.S. Supreme Court on other issues.

Therefore, the Bureau issued this interpretive rule to “remind” CRAs “that their matching practice must comply with their FCRA obligation to follow reasonable measures to assure maximum possible accuracy” and “that the practice of name-only matching in particular is far from sufficient to meet that standard.”  

Ultimately, the Bureau stresses that “[w]henever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.”  The Bureau emphasizes that information concerning a “different consumer than the consumer report purports to relate to would not have any utility” and also violates FCRA as “a consumer reporting agency may not provide a consumer report about a particular consumer unless there is a permissible purpose.”    

Note: While the opinion addresses the insufficiency of name-only matching, the Bureau does not provide additional guidance as to what it would consider sufficient.  In fact, the Bureau is clear that “the advisory opinion does not create a safe harbor to use insufficient matching procedures involving multiple identifiers.  Other practices, for instance name combined with a date of birth, could also lead to cases of mistaken identity.”  (emphasis added) Therefore, CRAs should carefully evaluate their matching procedures in light of the issues raised in the advisory opinion.