Fair Credit Reporting; Name-Only Matching Procedures

AGENCY:

Bureau of Consumer Financial Protection.

ACTION:

Advisory opinion.

SUMMARY:

The Bureau of Consumer Financial Protection (Bureau) is issuing this advisory opinion to highlight that a consumer reporting agency that uses inadequate matching procedures to match information to consumers, including name-only matching ( i.e., matching information to the particular consumer who is the subject of a consumer report based solely on whether the consumer's first and last names are identical or similar to the names associated with the information), in preparing consumer reports is not using reasonable procedures to assure maximum possible accuracy under section 607(b) of the Fair Credit Reporting Act (FCRA).

DATES:

This advisory opinion is effective on November 10, 2021.

FOR FURTHER INFORMATION CONTACT:

Brandy Hood, Courtney Jean, Kristin McPartland, Amanda Quester, or Pavneet Singh, Senior Counsels, Office of Regulations, at (202) 435-7700 or https://reginquiries.consumerfinance.gov/. If you require this document in an alternative electronic format, please contact CFPB_Accessibility@cfpb.gov.

SUPPLEMENTARY INFORMATION:

The Bureau is issuing this advisory opinion through the procedures for its Advisory Opinions Policy. Refer to those procedures for more information.

I. Advisory Opinion

A. Background

Accuracy in consumer reports is of vital importance to the consumer reporting system, particularly as consumer reports play an increasingly important role in the lives of American consumers. Consumer reporting agencies assemble and evaluate credit, public record, and other consumer information into consumer reports. The information in these reports is used by many different types of businesses, from creditors and insurers to landlords and employers, to make eligibility and other decisions about consumers. Creditors, for example, use information in consumer reports to determine whether, and on what terms, to extend credit to a particular consumer. The majority of landlords and employers use background screening reports to screen prospective tenants and employees.

Inaccurate information in consumer reports can have significant adverse impacts on consumers. These impacts are particularly concerning for prospective renters and job seekers struggling to recover from the impacts of the COVID-19 pandemic. Consumers with inaccurate information in their consumer reports may, for example, be denied credit or housing they would have otherwise received, or may be offered less attractive terms than they would have been offered if their information had been accurate. For example, an applicant whose tenant screening report shows past litigation or a poor rental payment history may find it difficult or more expensive to rent property. Job-seekers with inaccurate information in their consumer reports may also be denied employment opportunities. Inaccurate information in consumer reports can also harm the businesses that use such reports by leading them to incorrect decisions. Consumer report accuracy relies on the various parties to the consumer reporting system: the three nationwide consumer reporting agencies—Equifax, Experian, and TransUnion; other consumer reporting agencies, such as background screening companies; entities such as creditors who furnish information to consumer reporting agencies ( i.e., furnishers); public record repositories; users of credit reports; and consumers.

The FCRA, enacted in 1970, regulates consumer reporting. The statute was designed to ensure that “consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information.” The FCRA was enacted “to protect consumers from the transmission of inaccurate information about them and to establish credit reporting practices that utilize accurate, relevant, and current information in a confidential and responsible manner.” Because of the importance of consumer report accuracy to businesses and consumers, the structure of the FCRA creates interrelated legal standards and requirements to support the policy goal of accurate credit reporting. Among these is the requirement that, when preparing a consumer report, consumer reporting agencies “shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” This requirement remains as important today as it was when the statute was enacted in 1970.

Concerns about the accuracy of information included in consumer reports are long-standing. In 2003, Congress passed the Fair and Accurate Credit Transactions (FACT) Act, which, in addition to expanding the FCRA's substantive consumer protections, required the Federal Trade Commission (FTC) to conduct an ongoing study of consumer report accuracy and completeness. In 2012, the FTC published a report summarizing results of that study, finding, among other things, that one in five consumers who participated in the study had an error on at least one of their three nationwide credit reports. More recently, the Bureau and the FTC hosted a full-day public workshop to discuss issues affecting the accuracy of both traditional credit reports and employment and tenant background screening reports.

The Bureau is especially concerned about the effects of these accuracy problems in light of the economic and public health impacts of COVID-19. Income shocks resulting from the pandemic, such as a job loss, reduced work hours, or the death or illness of a family member, have contributed to an increase in housing and financial insecurity for many households. Low-income and minority renters have been disproportionately affected by the economic effects of the COVID-19 pandemic, including job losses. The Bureau is concerned that the risk that inaccurate data will be included in consumer reports may be further heightened by increased volumes of negative information in the consumer reporting system resulting from the pandemic. Inaccurate information in consumer reports can have devastating impacts on consumers, including impairing the ability of renters and job-seekers negatively impacted by the pandemic to secure new rental housing, find employment, and otherwise recover from the pandemic's economic effects. An increase in housing instability and financial distress caused by inaccurate consumer reporting information could undermine the nation's efforts to recover from the pandemic.

Consumer complaints received by the Bureau reflect significant consumer concern about inaccuracies in consumer reports. Complaints about “incorrect information on your report” have represented the largest percentage of consumer complaints received by the Bureau regarding credit or consumer reporting each year for at least the last five years. In 2020 alone, companies provided responses to more than 191,000 such complaints, which represents approximately 68 percent of credit or consumer reporting complaints responded to by companies that year.

Inaccuracies in consumer reports can in part be attributed to errors introduced by consumer reporting agencies during the “matching” process. When preparing a consumer report, a consumer reporting agency must assign or “match” information it obtains from a public data source or receives from a furnisher to the specific consumer who is the subject of the report. Each year, the Bureau receives many complaints from consumers arising from errors that likely occurred during the matching process. Some consumers who submit such complaints include narrative descriptions noting, among other things, their frustration at trying to get such errors corrected, as well as the negative consequences of such errors, such as not being able to complete planned purchases of homes or cars.

One method of matching, “name-only matching,” is particularly likely to lead to inaccuracies in consumer reports. Name-only matching occurs when a consumer reporting agency uses only first and last name to determine whether a particular item of information relates to a particular consumer, without using other personally identifying information such as address, date of birth, or Social Security number. Matching errors are particularly common when using name-only matching because many consumers have the same or similar names. For example, in the United States, the 2010 census (the most recent to have last name statistics available) found more than 2.4 million respondents with the last name of Smith, 1.9 million respondents with the last name of Johnson, 1.6 million respondents with the last name of Williams, and more than 1 million respondents each with the last name of Brown, Jones, Garcia, Miller, Davis, Rodriguez, Martinez, or Hernandez. Given the commonality of many first and last names, it is not unlikely that thousands, or even tens of thousands, of consumers, might share a particular first and last name combination.

The risk of mismatching from name-only matching is likely to be greater for Hispanic, Asian, and Black individuals because there is less last-name diversity in those populations than among the non-Hispanic white population. For example, a study of 2010 census data indicated that the percentage of non-Hispanic white respondents covered by the top 10 most common last names is lower than the corresponding percentages for Hispanic, Asian, and Black respondents. The study found the highest level of last-name clustering among Hispanic respondents, noting that just 26 last names cover a quarter of the Hispanic population (as compared to 319 last names required to cover a quarter of the population identified as non-Hispanic white alone) and that 16.3 percent of Hispanic respondents reported one of the top 10 most common last names (as compared to 4.5 percent for non-Hispanic white alone respondents). The study further noted that these clustering patterns were similar for Asian and Black respondents.

The Bureau, the FTC, and State attorneys general have brought enforcement actions in this area. In 2014, a background screening company settled FTC allegations that it violated FCRA section 607(b) by failing to use reasonable procedures to assure maximum possible accuracy of consumer report information when it provided employers background screening reports about job applicants that included, based on name-only matching, information about whether the applicants were registered in a National Sex Offender Registry. In 2019, the Bureau settled allegations that a background screening company violated FCRA section 607(b) by matching publicly sourced criminal records to job applicants based only on limited personal identifiers, which could include first and last name and either date of birth or address, a practice that resulted in “a heightened risk of false positives” because commonly named individuals ( e.g., John Smith) might share the same first and last name and date of birth or address. Similarly, in 2015, the Bureau took action against a background screening company for violating FCRA section 607(b) by permitting, but not requiring, employers to provide middle names for job applicants for purposes of matching criminal record information to particular consumers. According to the Bureau's complaint, the company's procedures resulted in the reporting of mismatched criminal record information about consumers.

In March 2015, the three nationwide consumer reporting agencies—Equifax, Experian, and TransUnion—launched the National Consumer Assistance Plan (NCAP), an initiative aimed at enhancing the accuracy of credit reports and making it easier for consumers to correct errors on their credit reports. The NCAP was the result of a settlement between the nationwide consumer reporting agencies and over thirty State Attorneys General that required the nationwide consumer reporting agencies to, among other things, form a working group to establish standards regarding the collection of public record data for consumer credit reports. Pursuant to the NCAP, starting July 1, 2017, public record data obtained by the nationwide consumer reporting agencies for inclusion on credit reports must contain name, address, and Social Security Number and/or date of birth and must be refreshed at least every 90 days.

Courts have also spoken on this topic. For example, a decade ago, the Third Circuit in Cortez v. Trans Union, LLC considered a case in which the nationwide consumer reporting agency TransUnion had indicated in a consumer report that the consumer's name matched a name on a list maintained by the Office of Foreign Assets Control (OFAC), despite the fact that TransUnion had information within its own files showing that the OFAC alert was not about the correct consumer. The Third Circuit upheld the district court's ruling that TransUnion's matching protocols that compared only the consumer's name to the names on the OFAC list did not satisfy the requirement of FCRA section 607(b). Nonetheless, TransUnion did not adequately update its matching practices, and it was sued a second time for similar practices in Ramirez v. TransUnion LLC. In a 2020 decision that was later overturned on other grounds, the Ninth Circuit ruled that “despite [ Cortez ], TransUnion continued to use problematic matching technology. . . . In doing so, it ran an unjustifiably high risk of error.” The court upheld a jury verdict deeming TransUnion liable for violating section 607(b) because it used “rudimentary name-only matching software without any additional checks to avoid false positives.” The Ninth Circuit held that the violation was willful because the correct reading of the FCRA should have been clear to TransUnion after Cortez.

Despite these enforcement actions, the steps taken by the nationwide consumer reporting agencies pursuant to the NCAP, and these court decisions, it appears that some consumer reporting agencies continue to use matching practices that do not satisfy the standard of “reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates,” as required by FCRA section 607(b). The NCLC stated in a 2019 report that some background screening companies are still relying on name-only matches. NCLC and other consumer and civil rights groups recently requested that the Bureau provide guidance that name-only matching is a practice that fails to comply with the FCRA.

The Bureau is issuing this advisory opinion to remind consumer reporting agencies that their matching practices must comply with their FCRA obligation to ”follow reasonable procedures to assure maximum possible accuracy” under section 607(b), and that the practice of name-only matching in particular is far from sufficient to meet that standard. Indeed, as illustrated by the foregoing discussion, multiple additional elements beyond names may often be required to meet the FCRA standard of “reasonable procedures to assure maximum possible accuracy.”

B. Coverage

This advisory opinion applies to all consumer reporting agencies as defined in FCRA section 603(f). As used in this advisory opinion, “name-only matching” refers to matching information to the particular consumer who is the subject of a consumer report based solely on whether the consumer's first and last names are identical or similar to the first and last names associated with the information, without verifying the match using additional identifying information for the consumer. “Matching procedures” refers to the broader set of practices and procedures consumer reporting agencies use to link information to a consumer's consumer report.

C. Legal Analysis

FCRA section 607(b) provides that “[w]henever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” The Bureau interprets the requirement in section 607(b) to include as an integral component that the information in fact pertains to the consumer who is the subject of the report. Indeed, the text of section 607(b) refers explicitly to “the individual about whom the report relates.” This interpretation is consistent with the core purpose of the FCRA as described in FCRA section 602— i.e., to require consumer reporting agencies to adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner that is fair and equitable to the consumer with regard to confidentiality, accuracy, and the proper use of such information.

Other provisions of the FCRA that directly relate to section 607(b) also support this interpretation. For example, section 603(d) of the FCRA defines “consumer report” to include certain communications “bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living” that are “used or expected to be used . . . for the purpose of . . . establishing the consumer's eligibility” for credit, employment, insurance, and other purposes. Information in a consumer report on a different consumer than the consumer report purports to relate to would not have any utility in serving as a factor in establishing the eligibility of the person the consumer report purports to relate to. Additionally, section 604 of the FCRA generally provides that a consumer reporting agency may not provide a consumer report about a particular consumer unless there is a permissible purpose, such as a legitimate business need related to a transaction initiated by the consumer. The FCRA expressly ties many of these permissible purposes to the specific consumer who is the subject of the report, making it clear that Congress intended that information in the consumer report would relate to that specific consumer. For instance, in FCRA section 604(a)(3)(A), Congress allowed consumer reporting agencies to release a consumer report to a person if they have reason to believe the person “intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished.”

The steps that a consumer reporting agency takes in matching information it obtains or receives to the correct consumer in preparing consumer reports are critical in assessing whether a consumer reporting agency is following “reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates” under FCRA section 607(b). As detailed in part I.A. above, matching information to the consumer who is the subject of a consumer report by name alone creates significant accuracy concerns because most names are shared with other consumers and, in some cases, with thousands of other consumers. In preparing consumer reports, it is not a reasonable procedure to assure maximum possible accuracy to use insufficient identifiers to match information to the consumer who is the subject of the report. In particular, it has been the consistent view of the Bureau that name-only matching is not a procedure that assures maximum possible accuracy, and thus, consumer reporting agencies that use name-only matching violate FCRA section 607(b). That continues to be the Bureau's position as outlined in this advisory opinion. Moreover, nothing in this analysis creates a safe harbor for the FCRA requirement of “reasonable procedures to assure maximum possible accuracy” with respect to matching.

Based on the high risk that name-only matching will result in the inclusion of information that does not pertain to the consumer who is the subject of the report and the relative lack of burden on a consumer reporting agency associated with utilizing additional identifiers or not including name-only matched information in a consumer report, the Bureau continues to conclude that it is not a reasonable procedure to use name-only matching to match information to the consumer who is the subject of the report in preparing a consumer report.

In some cases, in preparing consumer reports, consumer reporting agencies may obtain information from a data broker, database, or other source that does not have or use identifying information other than consumers' names. It is not a reasonable procedure for the consumer reporting agency to simply include information from such sources in a consumer's report without taking additional steps to match the information to the consumer who is the subject of the report, such as consulting other databases or sources of information that contain additional identifying information.

II. Regulatory Matters

This advisory opinion is an interpretive rule issued under the Bureau's authority to interpret the FCRA, including under section 1022(b)(1) of the Dodd-Frank Wall Street Reform and Consumer Protection Act, which authorizes guidance as may be necessary or appropriate to enable the Bureau to administer and carry out the purposes and objectives of Federal consumer financial laws.

As an interpretive rule, this advisory opinion is exempt from the notice-and-comment rulemaking requirements of the Administrative Procedure Act. Because no notice of proposed rulemaking is required, the Regulatory Flexibility Act does not require an initial or final regulatory flexibility analysis. The Bureau has also determined that this advisory opinion does not impose any new or revise any existing recordkeeping, reporting, or disclosure requirements on covered entities or members of the public that would be collections of information requiring approval by the Office of Management and Budget under the Paperwork Reduction Act.

Pursuant to the Congressional Review Act, the Bureau will submit a report containing this interpretive rule and other required information to the United States Senate, the United States House of Representatives, and the Comptroller General of the United States prior to the rule's published effective date. The Office of Information and Regulatory Affairs has designated this interpretive rule as not a “major rule” as defined by 5 U.S.C. 804(2).