In a case of first impression in its circuit, the Second Circuit held that a business may not be liable under the Fair Credit Reporting Act (FCRA) for publishing false information unless it specifically intended the report to be a “consumer report.” Kidd v. Thompson Reuters, —F.3d — (2019 WL 2292190, 5/30/19). It then held that  defendant Thompson Reuters established it did not have the requisite specific intent by showing that at each step in its processes it instructed its users and potential subscribers that its platform was not to be used for FCRA purposes, such as employment eligibility–but only for the non-FCRA purposes of law enforcement, fraud prevention and identity verification–and required them to affirm their understanding of that restriction. Accordingly, the Second Circuit Court of Appeals affirmed the granting of summary judgment to Thompson Reuters, even though its subscriber had used its inaccurate report to determine a job applicant’s employment eligibility.

The take-away: If your business regularly assembles consumer information, distributes it to third parties, and fears it may be used for a FCRA-related end that is not intended, your business should forbid such uses in its subscriber contract, monitor the actual uses of that information, and take adequate measures to stop FCRA-related uses when it learns of them.  

The background to the Eleventh Circuit’s decision in Marchisio v. Carrington Mortgage Services, LLC, — F. 3d — (11th Cir. March 25, 2019)(2019 WL 1320522) demonstrated repeated recklessness by a lender in updating its reporting databases after repeated litigation and settlements.

The borrowers defaulted on their home loans in 2008; the loan servicer brought a foreclosure action; in 2009, the parties settled with a deed in lieu of foreclosure that extinguished first and second loans and required the loan servicer to report to the credit reporting agencies that nothing more was due on the loans. The loan servicer failed to correct the credit reporting and continued to try to collect on the nonexistent debt, prompting the borrowers/Plaintiffs in 2012 to file a lawsuit under the Fair Credit Reporting Act. The parties settled the FCRA suit in 2013, with the loan servicer/Defendant agreeing to correct the credit reporting. The loan servicer failed to timely comply with this correction requirement within 90 days and issued three erroneous reports that the second loan was delinquent.

The Plaintiffs then disputed with the credit reporting agencies the reporting of a balloon payment due on the second loan. In response, the loan servicer investigated the dispute. However, because the loan servicer had not updated its database to reflect the settlements, it erroneously verified to the credit reporting agencies that the Plaintiffs were delinquent, and then in 2014 charged them for lender-placed insurance on the property, which the Plaintiffs no longer owned. This led in 2014 to the second lawsuit with the FCRA claim that the 11th Circuit addressed. This lawsuit “caught Defendant’s attention” and immediately prompted it to update its database, correct its previous errors and accurately report the status of Plaintiffs’ second loan, finally.

On July 13, 2018, in Dutta v. State Farm Mutual Automobile Insurance Company, 895 F.3d 1166 (9th Cir. 2018), the United States Court of Appeals for the Ninth Circuit affirmed summary judgment against a plaintiff that lacked Article III standing to assert a claim under the Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq. (“FCRA”).

The Ninth Circuit relied on Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), and held that the plaintiff lacked standing because he “failed to establish facts showing that he suffered actual harm or material risk of harm.”

This ruling is significant in the Ninth Circuit and elsewhere because it provides construct under which defendants may successfully challenge a plaintiff’s Article III standing to assert claims under the FCRA or other federal statutes.

Bryan Cave Leighton Paisner’s full client alert on the Dutta decision is available here.

On August 4, 2014, FinCEN released proposed rules that would require banks and certain other financial institutions to identify the “beneficial owners” of their business entity customers and to verify the identity of each such beneficial owner (the “Proposal”).  If the Proposal results in final rules that are substantially identical to the proposed rules, financial institutions might be unable to comply without violating the federal Fair Credit Reporting Act (“FCRA”).

Under the Proposal, “beneficial owners” would generally include at least one manager of the entity and each individual owning 25% or more of the entity.  This could mean up to five individuals if no manager also owns 25% or more of the entity.

The Proposal would require a financial institution first to identify the customer’s beneficial owners.  This should be reasonably manageable because institutions would be able to provide a certification form to its customer and require that the customer name its beneficial owners.  Financial institution’s would not be required to take independent steps to verify the status of such persons as beneficial owners.

The potential legal conflict arises under the second prong of the Proposal, under which the financial institution would be required to verify the identity of those persons whom it has been told are the customer’s beneficial owners.  The Proposal would require a financial institution to verify the identity of each beneficial owner using risk-based procedures that are “identical to the covered financial institution’s Customer Identification Program procedures required for verifying the identity of customers that are individuals.”

Whether in a deposit or loan context, banks often will obtain a single credit report or other consumer report for the combined purposes of an initial OFAC screen, to confirm the customer’s creditworthiness, and to verify the customer’s identity under the institution’s Customer Identification Program (“CIP”).  Such reports are “consumer reports” under the FCRA and therefore subject to the FCRA’s rules, including with respect to when such reports may be obtained.