Compliance Blog

Written by Shereefat Balogun, Regulatory Compliance Counsel

Lately, we have been receiving a good amount of questions relating to the Fair Credit Reporting Act (FCRA). Specifically, many of our compliance officers want to know whether a credit union may use a credit report, pulled with a permissible purpose, to subsequently cross-sell other products. The answer to this generally is a resounding NO!!!!

As an initial matter, Section 604 of the FCRA provides the permissible purposes for which a consumer report may be obtained and used. Except for prescreen offers, a consumer reporting agency may provide a consumer report under specific circumstances. As it pertains to credit unions and member transactions, these circumstances are limited to:

• When a member provides written instructions giving authority to obtain the report;
• When the information contained in the report will be used in connection with a loan application or to review an existing member's loan or account; and
• When there is a legitimate business need for the information in connection with a business transaction that is initiated by the consumer; or to review an account to determine if it still meets the terms.

See, 15 U.S.C. 1681b(a).

In all pulls for consumer reports, the credit union must ensure that there is a permissible purpose. Moreover, for all pulls, credit unions must certify the purposes for which the information is sought, and certify that the information will be used for no other purpose.  See, 15 U.S.C. 1681e(a).

So now, the credit union pulled a consumer report with the permissible purpose of using the information in connection with a car loan application. Now, the credit union wants to use the report to market a credit card.  NO!!!! This would be an impermissible use. A credit union may not use a consumer report that it previously obtained for a permissible purpose, to later market a particular product or service.  This question was addressed in the FTC's Gowen Letter. Below is the relevant section of the letter:

Your questions raise the issue of whether a creditor in a closed end credit transaction may exploit consumer reports obtained for review purposes in order to market its products or services. In the circumstances you described, we believe the answer is no.

Moreover, this position is reaffirmed throughout the FTC's comments stated in their 40 Years of Experience with the Fair Credit Reporting Act  Below are some relevant excerpts of the FTC's commentary:

Section 603(m) states that the term credit or insurance transaction that is not initiated by the consumer does not include the use of a consumer report by a person with whom the consumer has an account or insurance policy, for purposes of (1) reviewing the account or insurance policy; or (2) collecting the account.

1. GENERAL

Section 604(c) provides that, generally, it is not a permissible purpose to provide a consumer report in connection with any credit or insurance transaction not initiated by the consumer unless the consumer consents or the transaction consists of a firm offer of credit or insurance. However, an existing creditor's use of consumer reports for review or collection of its accounts does not fall within the definition of credit or insurance transaction that is not initiated by the consumer. Rather, an existing creditor may obtain consumer reports for review or collection of its accounts under section 604(a)(3)(A), but its use of those reports is limited to that purpose. Accordingly, a CRA may provide reports to creditors to review or collect existing credit accounts, but not to market other products or services.  See comment 604(a)(3)(A)-4A.

(emphasis added).

4. REPORTS FOR REVIEW OR COLLECTION OF AN ACCOUNT PERMISSIBLE PURPOSE DOES NOT EXIST

5. Marketing purposes. This section does not allow a CRA to provide a creditor with consumer reports to review accounts in order to market its other products or services. See also comments 603(m)-1 and 604(a)(3)(F)-6.

(emphasis added).

While the Gowen letter, as well as the provisions highlighted above, appear to narrow its discussion and application to the review of accounts, it appears that this analysis has been applied more broadly and the general position is that cross marketing is restricted.  In fact, the commentary makes clear that prescreening is the only circumstance in which consumer report information may be used for marketing purposes.  The commentary states in relevant part:

2. PRESCREENING

Prescreening is the common term for the process by which creditors and insurers use consumer report information to identify consumers to receive firm offers. Prescreening is the only circumstance in which consumer report information may be used for marketing purposes, and one of the few circumstances in which consumer report information may be provided in the absence of a consumer-initiated transaction. A CRA either edits a list of consumers developed by the requesting creditor or insurer (or its agents) or independently creates a list of consumers according to the requesting entity's specifications.

(emphasis added).

The prescreening and firm offers provisions are addressed in section 604(c) of the FCRA.  Section 604(c) allows the credit union to prescreen members for credit transactions not initiated by the member. Generally, the credit union sends its criteria to the credit bureau and the credit bureau then determines which members meet the criteria. Members meeting the criteria are sent the prescreened offer, provided that the member has not opted out of prescreening and the member is not under 21 (unless that member has opted in). See, 15 U.S.C. 1681b(c). Note, that a firm offer of credit must be provided to members meeting the criteria. See, 15 U.S.C. 1681b(c). The prescreen disclosure and opt-out requirements can be found in Regulation V, 12 CFR 1022.54.

So to reiterate- a credit union may not use a consumer report that it previously obtained for a permissible purpose, to cross-sell other products or services.  However, the credit union may be able to obtain the member's written authorization that specifically grants the ability to cross sell. However, the instructions should expressly state the reason for the use; a general blanket consent will not be sufficient. It may be worthwhile to check with local counsel regarding the specific verbiage in your account agreement.  The commentary on this issue provides:

Section 604(a)(2) allows CRAs to furnish consumer reports in accord with the written instructions of the consumer to whom it relates.

2. CONSUMER INSTRUCTION

A consumer's written consent qualifies as an instruction that provides a permissible purpose under this section if it clearly authorizes the issuance of a consumer report on that consumer.  For example, a consumer's clear and specific written statement that I authorize you to procure a consumer report on me provides a permissible purpose under this section. However, the consumer's signature on a form that includes the statement I understand that where appropriate, credit bureau reports may be obtained is not a sufficiently specific instruction from the consumer to authorize a CRA to provide a consumer report. This language is more in the nature of a notification that a consumer report might be procured, as opposed to a grant of permission to obtain the consumer report.  

(emphasis added).

Moreover, the FTC has some advisory letters on the consent issue which credit unions may want to spend some time reviewing.

If you have any questions relating to this article or any other FCRA issues, please contact NAFCU's regulatory compliance team. We're here for you!

###

NAFCU has a couple of scheduled webinars this month available for our members:

Upcoming Webcasts

Blockchain Technology: What You Need to Know

FREE Webcast Live Broadcast: June 21, 2016

FLSA Understanding the New Overtime Regulations

Live Broadcast: June 22, 2016