CFPB Hits Credit Reporting Agency with $8 Million Penalty for FCRA Violations
The Consumer Financial Protection Bureau (“CFPB” or “Bureau”) recently ordered a Florida subprime credit reporting company and its owner to pay an $8 million civil penalty and to halt illegal practices in a December 3 Consent Order.
Clarity Services, Inc., a consumer reporting agency headquartered in Clearwater, Florida does business throughout the U.S., focusing on the subprime market. As part of its business model, Clarity compiles and sells credit reports to financial service providers, including check cashers, credit card and prepaid card issuers, collection agencies, auto loan providers, and installment lenders. Clarity describes itself on its website as providing “powerful real-time fraud detection and credit risk management solutions for Middle America.” The company is a “covered person” under the Dodd Frank Consumer Financial Protection Act because it offers a consumer product or service.
The CFPB found that Clarity violated the Fair Credit Reporting Act (FCRA) by accessing hundreds of thousands of fully-identified consumer reports from third-party credit reporting agencies to compile marketing presentations for prospective lender clients without permission. According to the Consent Order, in one instance, notwithstanding objections from Clarity’s staff, Clarity obtained over 190,000 consumer reports to create a marketing presentation. The FCRA requires that access to consumer reports be limited to those with a “permissible purpose,” such as for use in underwriting decisions, which helps to ensure that consumer privacy rights are protected. The CFPB found that Clarity was pulling reports for the impermissible purpose of marketing its services, and such inquiries often appeared on the consumer’s credit file as a permissible inquiry by a lender. When lenders and consumers questioned these inquiries, Clarity asked the credit reporting companies to delete evidence of its unauthorized access of the consumers’ reports.
The CFPB further found that Clarity failed to properly investigate consumer disputes, including but not limited to, disputes regarding unauthorized credit inquiries, even though Clarity was aware that some of the information contained in its consumer files was from unreliable sources. Clarity improperly refused to open a reinvestigation if a consumer’s dispute lacked “supporting documentation,” even when a consumer identified specific tradelines and the reason why the consumer believed the item was inaccurate or incomplete. Clarity further failed to provide information regarding consumer disputes to furnishers and failed to perform reinvestigations where consumers made claims of identity theft. Among other things, Clarity failed to notify furnishers of disputes and failed to promptly notify consumers of the results of its investigations. All of these actions were found to be violations of the Fair Credit Reporting Act.
Clarity and its owner Timothy Ranney were ordered to pay an $8 million civil monetary penalty. They were further ordered to stop pulling consumer reports for marketing purposes or the purpose of selling them to users who lack a legitimate purpose and to implement policies and procedures to ensure that users have a permissible purpose to obtain consumer reports. They must also require consumer data furnishers to provide accurate data and correct data inaccuracies. Finally, Clarity must improve its policies and procedures for investigating consumer reports and may not impose any impermissible preconditions for investigation, such as requiring documentation or other evidence before commencing an investigation.
Pursuant to Dodd Frank amendments, certain FCRA enforcement functions and all regulatory authority were transferred from the FTC to the Bureau. Additionally, while the FTC may seek limited penalties for violations, only the CFPB may require monetary remediation and impose discretionary civil penalties through its administrative enforcement authority. The action against Clarity and its owner is the Bureau’s tenth enforcement action asserting violations of the FCRA.
