The Fair Credit Reporting Act (FCRA) provides several "permissible purposes" for which a company can obtain a consumer's credit report. For lenders and other financial services providers, two purposes are often central: (1) the evaluation of a consumer applying for an extension of credit and (2) the written instructions of the consumer. Often, lenders may operate under both permissible purposes by obtaining written authorization to pull a consumer's credit report in the context of an application for credit. The interplay between different permissible purposes and the limits of consumers' control over their credit reports can occasion a heightened risk of consumer confusion (and the accompanying risk of complaints and lawsuits).
For example, a federal district court in the Seventh Circuit (E.D. Wis.) recently held that a consumer could not proscribe a company's permissible purpose for obtaining her credit report. The case, Long v. Bergstrom Victory Lane, Inc., No. 18-cv-688 (E.D. Wis. Oct. 4, 2018), arose from a consumer's auto financing application. Over the course of the application process, the consumer directed the auto dealer to "only run her credit" with one lender (with which she was pre-qualified). The consumer brought suit after the dealer submitted the credit application to multiple lenders, resulting in several inquiries of the consumer's credit report. The dealer argued that the permissible purpose for credit applications covered its use of the consumer's credit report, notwithstanding her instructions.
The district court analyzed the complaint to determine whether the auto dealer acted with a statutorily permitted purpose when it obtained and used the consumer's credit report. Reviewing the FCRA's permissible purposes, the court agreed with the auto dealer and held that the consumer's application for financing qualified as a permissible purpose under the FCRA. The court reiterated that "[u]nder the FCRA, a business does not require the consent of the potential customer, so long as it has a statutorily defined 'permissible purpose.'" Thus, a consumer's attempt to restrict access to her credit report is ineffectual, as long as the user has a valid permissible purpose other than the consumer's written instruction.
In so deciding, the court followed judicial precedent that, with permissible purpose, a company can obtain a credit report even over the consumer's objection, which is addressed in the Santangelo case in the Northern District of Illinois. In this case, a consumer pursued claims against a company for obtaining his credit report despite an oral agreement to the contrary. The consumer alleged that the company "agreed not to pull his credit report in return for a payment of $50.00" and thus violated the FCRA by acting without a permissible purpose when it nonetheless obtain his credit report. Nevertheless, the court found that the company had a permissible purpose (in this case, a legitimate business need for the information in connection with a business transaction that is initiated by the consumer) outside of any authorization or denial by the consumer, and thus the consumer's FCRA claim failed.
The Victory Lane decision is an important reminder of the interplay between the various "permissible purposes" set out in the FCRA. Often, lenders and other companies will seek consumers' permission to obtain their credit reports, even if another permissible purpose applies. Such practices can be useful—disclosures or authorizations can serve as a notice to consumers that their credit reports are being obtained as part of an application or transaction, ideally forestalling complaints or inquiries when a consumer notices that his or her credit report has been pulled. A written authorization also serves as a clear record of compliance with the FCRA requirements.
However, cases such as Victory Lane and Santangelo highlight the need to address instances in which a consumer does not provide permission (or attempts to revoke or deny it), and a credit report is obtained anyway. The plaintiffs in both cases alleged, but the courts did not directly address, that the companies agreed to restrict the use of the credit report (Victory Lane) or agreed not to obtain it (Santangelo). The failure to honor such agreements could create breach of contract or unfair trade practices claims.
The corollary to the situations above provides an important compliance lesson. When companies seek consumers' written instruction to pull their credit reports, the relevant policies and procedures, as well as employee training, should take into account what happens in the event that permission is denied or pulled back – including, for example, whether the company has a parallel permissible purpose, and what effect the denial may have on the company's representations regarding the use of the credit report and similar claims. Mapping out these issues in advance can provide the proverbial ounce of prevention that is worth a pound of cure.