Letter to CFPB on Credit Header

The Honorable Rohit Chopra
Director, Consumer Financial Protection Bureau
1700 G Street, NW
Washington, DC 20552

Dear Director Chopra:

On February 8, 2023, a number of "immigrant rights, consumer rights, and privacy organizations" wrote to the Consumer Financial Protection Bureau (CFPB) requesting that the CFPB issue an advisory opinion to define credit header data as a consumer report under the Fair Credit Reporting Act ("FCRA"). "Credit header" information includes identifying information such as name, address, date of birth, and Social Security number. Such information may be obtained from a credit report "header" and from other reports that only contain identifying information.

The trade associations below use identifying information in lawful, responsible ways, among them, to prevent fraud and crime. The CFPB should not classify identifying information such as credit header information as a consumer report for important reasons:

• It will harm consumers and facilitate fraud, identity theft, and other crimes and thwart know your customer efforts. The identifying information is vital for verifying that people with an existing financial account and those applying for a financial product or service are who they claim to be and are not impersonating someone else or creating a synthetic identification to commit crimes. The information is used, for example, to prevent fraudsters from opening and maintaining bank accounts that they can use to induce people into sending them money.
  
  Indeed, FCRA itself requires that financial institutions verify the identity and addresses of their customers. For example, under §605A(h), users of consumer reports may not extend credit, issue an additional card on a credit card account, or increase a credit limit without verifying the identity of the person making the request. Under §1022.82(d) of the CFPB’s Regulation V implementing FCRA’s §615(e)(C), users of reports that receive a notice of an address discrepancy from a consumer reporting agency must confirm the address of the consumer and report it to the consumer reporting agency. Report users might rely on entities specializing in providing identifying information including addresses to comply with this provision.
  
  In addition, to comply with federal customer identification procedures and customer due diligence rules intended to prevent money laundering and terrorism financing, financial institutions obtain and confirm the name, address, date of birth, and identifying number (e.g., a Social Security number) of applicants for financial services.
  
  Subjecting identifying information such as credit header information to FCRA means financial institutions will have more difficulty verifying a person's identity. In some cases, they may be unable to obtain the information as they may lack an FCRA's "permissible purpose" to obtain a report. When access might be permissible, they would be subject to a variety of burdensome compliance requirements and compliance, litigation, and financial risks.
• Classifying identifying information as a consumer report under the FCRA would be contrary to the statute and well-settled regulatory and judicial precedents.
• An advisory opinion or other regulatory action is unnecessary as the use and disclosure of identifying information obtained from financial institutions is sufficiently regulated under the Gramm-Leach-Bliley Act (GLBA). GLBA allows financial institutions to share personal information with certain nonaffiliated entities under specified exceptions to the requirement that consumers receive notice and the right to not allow information to be shared. However, entities that receive the information under these exceptions may only disclose and use the information in the ordinary course of business to carry out the purpose for which it was received.

Our members play critical roles in providing the financial services that allow consumers to obtain and manage financial services and improve their financial lives. As part of that role, financial institutions seek to prevent fraud, including identity theft that harms consumers and disrupts their lives. Financial institutions also play an important part in preventing money laundering, the financing of terrorism, and crime. Being able to confirm identities is critical—and required by law—to those responsibilities. Regulating identifying information, as recommended in the letter from the group of advocates, will thwart the ability to confirm identities and advance anti-crime policies.

For these reasons, we urge that the CFPB not take actions to define identifying information such as credit header information as consumer reports. Treating this information under the present legal framework allows the Bureau to meet its mission to "make consumer financial markets work for consumers, responsible providers, and the economy as a whole."

Sincerely,
American Bankers Association
ACA
Consumer Data Industry Association
Credit Union National Association
Independent Community Bankers of America
National Association of Federally-Insured Credit Unions