Red Flags and Address Discrepancies FAQs

Posted on June 15, 2009 by Proskauer Rose LLP

On Thursday, the staff of the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, National Credit Union Administration, Office of the Comptroller of the Currency, Office of Thrift Supervision and the Federal Trade Commission issued a set of Frequently Asked Questions (FAQs) to assist financial institutions, creditors, users of consumer reports, and card issuers in complying with the Red Flags and Address Discrepancies Rules under FACTA.  Among the answers to the FAQs:

  • Although there is no specific record retention requirement under the Rules, covered entities must be able to demonstrate that they have complied with the requirements of the Rules;
  • All banks, savings associations, and credit unions are covered by the Red Flags Rules as “financial institutions,” whether or not they hold a transaction account belonging to a consumer;
  • The Red Flags Rules do not apply to the foreign branches of U.S. banks but, as a matter of safety and soundness, financial institutions are strongly encouraged to implement an effective identity theft prevention program throughout their operations, including in their foreign offices, consistent with local laws;
  • “Covered accounts” include accounts established in the U.S. by non-U.S. residents;
  • A broker, dealer, investment advisor, or investment or insurance company that is a “financial institution” or “creditor” under the FCRA is covered by the Red Flags Rules, including any such entity that is a subsidiary of a bank or savings association;
  • Corporate credit unions are covered by the Red Flags Rules;
  • If a consumer loan is purchased by another financial institution or creditor, then that entity becomes responsible for applying its Identity Theft Prevention Program to the loan as an existing covered account;
  • The Address Discrepancy Rules only apply to notices of address discrepancy received from an NCRA (Experian, Equifax, and TransUnion).  However,  a notification of address discrepancy received from an entity that is not an NCRA may be a red flag for purposes of the Red Flags Rules;
  • If a consumer withdraws his or her application to open a new account, a user of a consumer report that receives a notice of address discrepancy need not take steps to establish a reasonable belief that the consumer report relates to the consumer.

For more, check out the FAQs here, and our prior discussions of the Red Flags and Address Discrepancy Rules here.

Tags: , , , , , , , , , , , , , , , , , , , , ,

When Reckless Means Willful - High Court Issues Landmark Decision Under the Fair Credit Reporting Act

Posted on June 12, 2007 by Proskauer Rose LLP

Since December 4, 2006, consumers have filed dozens of class actions against retailers and other businesses across the country alleging “willful” violations of the Fair and Accurate Credit Transactions Act (“FACTA”) amendments to the Fair Credit Reporting Act (“FCRA”), prohibiting the printing of more than five digits, or the expiration date, of a credit card on receipts provided to the customer. Defendants in those cases have been waiting anxiously for the Supreme Court to rule in Safeco Insurance Co. of America, et al. v. Burr, et al. 551 U.S. _____ (2007), a factually inapposite matter in which the Court granted certiorari to determine whether “reckless disregard” suffices for willfulness under the statute. In a decision that raises as many questions as it answers, the Supreme Court held on June 4, 2007 that “reckless” failure to comply with FCRA can be considered willful. The Court’s opinion begs the question whether it was objectively reasonable for retailers to continue the printing of expiration dates on customer receipts after FACTA took full effect.

Defendants who "willfully" violate FCRA are subject to significant statutory damages of $100 to $1,000 for every instance of violation, as well as punitive damages. Safeco involved notice obligations to consumers regarding adverse action based on consumer reports, but the relevant provision of FCRA - §1681n(a) - imposes penalties for violation of other provisions of the statute, including the FACTA amendments mandating credit card truncation. Unfortunately, after Safeco, the boundaries of what constitutes "willful" remain unclear.

Safeco Insurance Co. and GEICO were involved in separate suits, both in the Ninth Circuit, that were consolidated to resolve a Circuit split as to whether Section 1681n(a) reaches "reckless disregard." The Ninth Circuit held that a defendant "willfully" fails to comply with FCRA if it acts with "reckless disregard" of a consumer’s rights.

The high Court was quick to point out that "willfully" is a "‘word of many meanings whose construction is often dependent on the context in which it appears’" (quoting Bryan v. United States, 524 U.S. 184, 191 (1998) (internal quotation marks omitted)). Although the Court did not furnish a clear-cut definition, it confirmed that reckless disregard - or "action entailing ‘an unjustifiably high risk of harm that is either known or so obvious that it should be known’" - can be considered willful. The defendant’s actions must be objectively unreasonable. "[A] company subject to FCRA does not act in reckless disregard of it unless the action is not only a violation under a reasonable reading of the statute’s terms, but shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless." The Court did not find it necessary to identify the "negligence/recklessness line." However, it is clear that a defendant need not have actual knowledge of a violation to be found to have willfully violated the statute.

Both the Safeco and GEICO cases stemmed from an insurance company’s notice obligations to certain customers under Section 1681m. Under that provision, companies must inform a customer if "adverse action" is taken based in whole or in part on information contained in the customer’s consumer report. Since the initial rate offered by GEICO to the plaintiff/respondent was the one he would have received if his credit score had not been taken into account, the Court determined that GEICO had not violated the statute at all, let alone willfully. The Court found that Safeco Insurance Co. did violate FCRA by failing to notify certain individuals based on its erroneous determination that the statute did not apply to initial insurance applications.

However, the Court ruled that Safeco’s conduct fell short of action with "unjustifiably high risk" of violating the statute. Its interpretation of the statute, while "erroneous, was not objectively unreasonable," because Safeco’s position had a "foundation in the statutory text." Invoking authority holding that the determination of reasonableness for qualified immunity purposes is guided by legal rules that were "clearly established" at the time, the Court also acknowledged that, "[b]efore these cases, no court of appeals had spoken on the issue, and no authoritative guidance has yet come from" the Federal Trade Commission. The Court did not address the question of whether good-faith reliance on legal advice should render companies immune to claims under Section 1681n(a), but did "not foreclose the possibility."

Safeco’s Implications

The impact of this decision extends far beyond notification of adverse actions taken by insurance companies. Currently pending are the dozens of FACTA class action lawsuits alleging willful violations of FACTA’S prohibition on printing more than five digits, or the expiration date, of a credit card on receipts provided to the customer. It remains to be seen how those courts will apply the rule enunciated in Safeco. However, given (a) the dearth of legal authority or guidance on the proper interpretation of the FACTA provision at issue in those cases, Section 1681c(g) - a provision that did not even go into full effect until December 4, 2006; (b) the lack of any apparent connection between the printing of an expiration date and the risk of identity theft; and (c) the large number of businesses that plaintiffs have accused of violating the language of the statute, there exists ample ground for a court to find that a retailer’s decision to continue printing expiration dates on receipts after FACTA was not objectively unreasonable.
Tags: , , , , , , , ,