On July 12, 2022, the Consumer Financial Protection Bureau (“CFPB”) issued an advisory opinion that states its strict interpretation of the permissible purposes for which a consumer reporting agency may provide a consumer report and for which consumer report users may obtain consumer reports.  Section 604(a) of the Fair Credit Reporting Act (“FCRA”) identifies the “permissible purposes” for which a consumer reporting agency may furnish a consumer report. 

The advisory opinion explains that the CFPB interprets the permissible purposes listed in FCRA section 604(a)(3) (i.e. for purposes related to credit, employment, insurance and rental housing) apply only to the consumer who is the subject of the user’s request.  Thus, the CFPB states that a consumer reporting agency may not provide a consumer report to a user under FCRA section 604(a)(3) unless it has reason to believe that all of the consumer report information it includes pertains to the consumer who is the subject of the user’s request.  The CFPB specifically notes that it views the use of certain matching procedures, such as name-only matching, as insufficient and that the use of such matching procedures could result in an FCRA violation.  The advisory opinion confirms that insufficient identifiers such as name-only matching would both fail to meet the FCRA’s accuracy provisions and be insufficient to form a reason to believe that all of the information it includes in a consumer report pertains to the consumer who is the subject of the user’s request.  This position precludes consumer reporting agencies from being able to provide a list of possible matches to users instead of taking further steps to match the information to the specific consumer who is the subject of the request. The CFPB further notes that disclaimers will not cure a failure to have a reason to believe that a user has a permissible purpose for a consumer report.

The advisory opinion also addresses users of consumer reports, stating the CFPB’s position that FCRA section 604(f) strictly prohibits a person who uses or obtains a consumer report from doing so without a permissible purpose.  Consumer report users should heed the CFPB’s statement that credit applications that are initiated in error through inputting wrong consumer information that result in the consumer report user obtaining a consumer report for the wrong person would violate the FCRA’s permissible purpose provisions and the privacy of that consumer.  As a whole, the advisory opinion should be viewed as creating risk for both the consumer report user and the consumer reporting agency, particularly should name-only matching be used to generate consumer reports.