Consumer Advertising Law Blog

CFPB and FTC Reach Agreement on Cooperation

On January 23, 2012, the Consumer Financial Protection Bureau (CFPB) and the FTC announced that they had signed a memorandum of understanding (MOU). In doing so, the two agencies fulfilled requirements of the Dodd-Frank Act that they negotiate an agreement to coordinate enforcement actions against entities subject to both agencies’ jurisdiction and to harmonize certain rulemakings.

Under section 1024 of the Dodd-Frank Act, the CFPB has enforcement authority over nonbank entities that offer or provide consumer financial products or services. Because the FTC retains enforcement authority over such entities under the Dodd-Frank Act, both agencies could bring separate, and perhaps inconsistent or duplicative, enforcement actions against the same entity over the same issue in the absence of coordination. Accordingly, the Dodd-Frank Act requires the CFPB and the FTC to negotiate an agreement to coordinate enforcement actions against nonbank entities subject to the enforcement authority of both agencies regarding the offering or provision of financial products or services. Under the MOU, each agency has agreed to give notice to the other before commencing an investigation, filing an action or commencing a proceeding, settling an action or proceeding, or intervening in an action against a supervised entity where the other agency also has the authority to bring an enforcement action against the supervised entity. They will coordinate to avoid duplicative or conflicting enforcement actions.

The Dodd-Frank Act also requires the two agencies to negotiate an agreement to coordinate CFPB rulemaking to prohibit “unfair, deceptive, or abusive acts or practices” under section 1031 of the Dodd-Frank Act and FTC rulemaking to prohibit “unfair or deceptive acts or practices” under section 18 of the Federal Trade Commission Act as applied to nonbank entities that are subject to the jurisdiction of both the CFPB and the FTC. Under the MOU, each agency has agreed to provide the other agency with notice before proposing or issuing any rules or formal comprehensive guidance documents under these statutory provisions. They will consult on such rules or guidance documents.

As with other MOUs the FTC has entered into in the past, for example, its MOU with the FDA over review of labeling and advertising of food, cosmetics, medical devices and dietary supplements), the devil is often in the details, and a plan for coordination does not mean that there will be perfect efficiency or consistency. Given that many of the attorneys working at the CFPB came from the FTC, we expect the communication between the two agencies to be open and frequent. It is clear from the detail in this MOU that the agencies have given considerable thought on how to manage the overlapping jurisdiction to maximize agency resources.  Whether this results in more or less aggressive rulemaking, supervisory and/or enforcement actions overall remains to be seen.

UPDATE: For a more detailed discussion of this issue, click here.

- Nancy Perkins and Harry Wu

Non-Bank Entities Providing Financial Services: Get Ready to be Examined

The Consumer Financial Protection Bureau (CFPB) announced in a press release last Thursday the launching of its nonbank supervision program. Following the recess appointment of Richard Cordray as its Director, the CFPB announced that, effective immediately, it has authority to oversee, regardless of size, nonbank mortgage companies, private education lenders, and payday lenders.  Cordray has indicated that the CFPB will be aggressive despite the fact that he is a recess appointment.

Nondepository providers of consumer financial products and services are subject to federal supervision for the first time under the Dodd-Frank Wall Street Reform and Consumer Protection Act.  While the Dodd-Frank Act grants the CFPB authority to supervise nonbank mortgage companies, private education lenders, and payday lenders, regardless of size, the CFPB can generally only supervise entities in other markets for consumer financial products or services if the entity is deemed to be a “larger participant” of such market.  Examples of other markets that could be subject to a “larger participant” rule include debt collection, consumer reporting, auto financing, and money service businesses.

Last June, the CFPB issued a notice seeking comment on how “larger participants” are to be identified.  For a discussion of that notice click here. The CFPB stated on Thursday that it will issue an initial “larger participant” rule in the near future. The Dodd-Frank Act provides that the CFPB may also supervise any nonbank that it has a reason to determine “is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.” The CFPB also stated that it plans to publish rules regarding the implementation of this provision.

The CFPB’s nonbank supervision program will be a risk-based program. The CFPB will assess whether nonbanks are conducting their business in compliance with federal consumer financial laws, such as the Truth in Lending Act, the Real Estate Settlement Procedures Act, and the Equal Credit Opportunity Act.  An examination may include, among other things, a review of marketing materials, products, and lines of business, and a requirement that nonbanks file certain reports.  According to the CFPB, the agency will apply the same approach to nonbank examination as it does to bank examination, including notifying nonbanks in advance of examinations.  Nonbanks should familiarize themselves with the CFPB’s Supervision and Examination Manual, published on its website, to prepare themselves for eventual examinations.

- Michael Mierzewski and Jeremy Hochberg

Consumer Financial Protection Bureau’s New Supervisory Manual Focuses on Risk to Consumers

On October 13, 2011, the Consumer Financial Protection Bureau (CFPB) released a supervisory manual.  The Manual provides the CFPB’s examiners with guidelines for determining whether entities providing consumer financial products and services are complying with the consumer protection laws subject to the CFPB’s jurisdiction. Consistent with the purpose of the agency, and not surprisingly, the Manual indicates that when the CFPB examines an institution, it will focus on the risk to consumers. 

The Manual incorporates exam procedures developed by the Federal Financial Institutions Examination Council for many of the federal consumer financial laws now enforced by the CFPB. The exam structure and approach presented in the Manual is generally similar to that of the other federal banking agencies (indeed, it was drafted based largely on guidance issued by the other agencies). There are, however, aspects that are new and significant.  For example, the Manual includes detailed exam procedures for mortgage servicing, which is an indication that the agency plans to devote a great deal of attention to that area.

Under the CFPB’s new procedures, mortgage servicers will be subject to nine exam “modules": (1) servicing and loan-ownership transfers; (2) payment processing and account maintenance; (3) customer inquiries and complaints; (4) maintenance of escrow accounts and insurance products; (5) credit reporting; (6) information sharing and privacy; (7) collections; (8) loss mitigation; and (9) foreclosures.

In addition, the Manual states that the CFPB expects each entity it regulates to have an effective compliance management system. An effective compliance management system commonly has the following four components: (1) board management and oversight; (2) a compliance program comprised of policies, procedures, training, and monitoring and corrective action; (3) a system for responding to consumer complaints; and (4) a compliance audit program.

The Manual specifies that every exam will include a review of the entity’s compliance management system, as well as a review for any potential unfair, deceptive, or abusive practice (UDAAP), and regulatory compliance matters presenting risks to consumers. The Manual also provides that every exam covering lending activities must include a review for discrimination and fair lending compliance.

Notably, the Manual’s provisions relating to UDAAP do not provide any insight as to how the term “abusive” will be interpreted and applied in practice. In a departure from the normal exam process of the other federal banking agencies, the Manual also instructs examiners to interview consumers, as necessary, if the examiner uncovers a potential UDAAP issue.

The CFPB has indicated that in the coming months it will release additional guidelines, like these mortgage servicing modules, organized by product and line of business.  If the mortgage servicing procedures are any guide, the forthcoming guidance will likely be more detailed than that currently used by the other federal banking agencies.  As the CFPB updates the Manual and shifts its regulatory focus to new products and business lines, regulated entities may wish to review and enhance corporate compliance policies to directly address the agency’s new priorities and areas of concern.

For a more detailed description on this topic, click here.

- Beth DeSimone, Nancy Perkins, and Jeremy Hochberg

Prepaid/Stored Value Card Providers and Sellers: Prepare to Monitor for Suspicious Activity

On July 29, 2011, the Financial Crimes Enforcement Network (FinCEN) issued a Final Rule that modifies the government’s treatment of stored value, prepaid cards, and other prepaid access products under the Bank Secrecy Act (BSA) regulations. The Final Rule replaces FinCEN’s current construct of treating “issuers and redeemers” of stored value separately from other Money Service Businesses with one in which “providers” and “sellers” of “prepaid access” are subject to BSA requirements. The nuanced definitions given to these terms in the Final Rule will require participants in the prepaid area to analyze carefully their activities to determine their formal role in the process. Most notably, under the Final Rule “providers” of prepaid access will be responsible for suspicious-activity monitoring and reporting, as well as for other registration, customer identification, and recordkeeping activities. “Sellers” of prepaid access will share in each of these requirements, except for the registration requirement, for which the provider will retain sole responsibility.

The Final Rule covers prepaid devices such as plastic cards, mobile phones, electronic serial numbers, key fobs, and other mechanisms that provide access to funds that have been paid for in advance and are retrievable and transferable by replacing the term “stored value” with the term “prepaid access.” The changes made by the Final Rule have the potential to impact significantly the relationship among participants in the prepaid industry, as well as the products they sell. Industry participants should review their operations to determine the extent to which any revisions may be necessary to existing policies and procedures in light of the Final Rule. In addition, industry participants must assess their prepaid programs to determine who will become the “provider” for registration and other compliance purposes, lest FinCEN make the decision itself. In light of the compressed timeframes imposed by the Final Rule, it is important that such assessments commence promptly. For more details on the Final Rule, click here.

- Beth DeSimone and Jeremy Hochberg

Consumer Financial Protection Bureau Opens Its Doors: Will it be the Cop Folks Expect?

Tomorrow, exactly one year after the passage of the Dodd-Frank Act, the Consumer Financial Protection Bureau officially becomes a new cop on the consumer “banking beat,” responsible for enforcing the laws on credit cards, mortgages, student loans, prepaid cards, and other kinds of financial products and services. But as it opens its doors, it does not have the full force that many hoped or expected.

Only Monday, President Obama finally nominated a director for the CFPB, and it was not Elizabeth Warren, who envisioned the agency and its powers, and spent the last year setting it up. Rather, it was former Ohio Attorney General Richard Cordray ─ the CFPB’s current Assistant Director for Enforcement and one who is seen as an effective consumer advocate. However, Cordray’s confirmation is likely to be highly contested and may not move at all. In fact, dozens of Republican senators have announced their intent not to confirm any nominee, unless substantial changes are made to the CFPB, including turning it into a five-member commission ─ setting up the possibility of a controversial recess appointment.

Without a confirmed director at its helm, the CFPB will not be able to exercise all of the powers provided to it by the law. For example, the CFPB may not start supervising non-bank providers of consumer financial products until a director is in place. Yet many believe that it is these non-bank providers ─ i.e., payday lenders, student lenders, nonbank mortgage companies, and auto lenders ─ that most need federal oversight.

Bank Regulator Reminds Banks: Pay Attention To Risks Associated With Prepaid Products

On June 29, 2011, the Office of the Comptroller of the Currency (OCC) issued a bulletin to national banks focusing on their obligation to assess and manage the risks associated with what the OCC calls prepaid access programs. The OCC defines “prepaid access” as a wide range of devices that provide consumers with access to money electronically, including general purpose reloadable cards, payroll cards, government benefit cards, retail gift cards, mobile phones, and Internet sites. The Bulletin states that it applies to any other electronic devices or vehicles that are in use or may be developed in the future. Because the other federal banking agencies have not issued similar guidance, the Bulletin imposes expectations on national banks that are not imposed on other banks, although the guidance will also apply to federal savings banks as of July 21, 2011.

While prepaid access devices are attractive to banks because they can be marketed to a broad range of persons that are not usually bank customers, the OCC is concerned that they can also increase a national bank’s risks if not implemented appropriately.

Thus, the Bulletin reminds national banks that offer prepaid access devices to consumers that they should have a comprehensive risk management program that identify, measure, monitor, and control the risks related to those products. The program also should clearly assess how prepaid access devices fit within its overall business strategy and risk appetite. Additional components of such a program include:

• Policies and procedures to govern the program, including a due diligence process for selecting third-party service providers;
• Policies and procedures to ensure that disclosures to consumers about pricing, fees, transaction limits, and other program requirements and restrictions are clearly outlined;
• Robust audit and compliance functions; and
• Parameters for reporting to the bank’s board of directors.

For example, the Bulletin reminds banks that their arrangements with third-party service providers that often market these products should be governed by a well-constructed, enforceable service contract that clearly defines the rights and obligations of each party, as required by the OCC’s policies on use of third party service providers.

The Bulletin also states that national banks should ensure that the audit and compliance functions provide for sufficient consumer protection transaction testing (i.e. fees and disclosures), and BSA/AML and OFAC compliance. The program should also include procedures to evaluate any proposed changes or additions to the product prior to implementation.

The Bulletin finally outlines the duties of the national bank’s board of directors with respect to these programs, including receipt of periodic reports from bank management that allow the board to determine whether the prepaid access program is operating within established risk limits.

While the OCC is the only agency issuing such guidance to date, the guidance in the Bulletin is very broad and essentially is covered by more generic agency guidance such as the guidance for third party service providers. See Financial Institution Letter 44-2008, Guidance for Managing Third Party Risk (June 6, 2008). Thus, while the issuance continues to show agency concern over prepaid access generally, it does not really break new ground in the area. However, with the CFPB scheduled to take over responsibilities for this area this week, stay tuned for more substantive developments in the near future.

- Beth DeSimone and Jeremy Hochberg

Large Banks Beware: A CFPB Examiner is Coming to See You Soon

In an attempt to get off to a strong start, the Consumer Financial Protection Bureau (CFPB) warned the banking industry that, on July 21, it will begin supervising the 111 depository institutions that have total assets exceeding $10 billion for compliance with federal consumer protection laws. In guidance issued on July 12, the CFPB outlined the scope of its bank supervision program. Significantly, the CFPB stated that its examiners will review an institution’s products and services to determine whether they comply with consumer rules over their entire life cycle, including through development, marketing, sale, and management.

The CFPB also stated that it will conduct periodic examinations for most of the banks that it regulates and implement a year-round supervision program for the largest and most complex banks in the country. The CFPB stated that it will assess each institution’s ability to detect, prevent, and remedy violations that may harm consumers. It will evaluate an institution’s policies and practices for compliance with the consumer financial protection laws and regulations, and bring enforcement actions as necessary. It will also conduct fair lending reviews to detect and address potential discriminatory practices.

Managed out of satellite offices in Chicago, New York, San Francisco, and Washington, DC, the CFPB supervision team will initially be comprised of more than 100 members transferred from the other federal banking agencies. The CFPB expects that number to eventually rise to several hundred examiners. The CFPB anticipates that it will conduct its first round of on-site examinations in the coming weeks, after it coordinates with other regulators and finalizes its supervision plans. The CFPB will post its examination manual on its website with an invitation for feedback and suggestions. The CFPB stated that it will provide additional information to the 111 institutions by letter, and hold informational roundtables starting in August.

The Dodd-Frank Wall Street Reform and Consumer Protection Act gave the CFPB authority to exam and enforce the consumer financial protection laws against depository institutions with total assets exceeding $10 billion, and their affiliates. For all institutions with less than $10 billion in total assets, however, compliance with consumer financial protection laws will continue to be enforced by their primary federal regulators. For a more extensive discussion of the CFPB’s regulatory powers, click here.

Nondepository providers of consumer financial products and services also will be subject to federal supervision for the first time, but the CFPB’s power to start supervising such entities is constrained by the fact that a director has not yet been appointed. For more information about the CFPB’s supervision of nondepository entities, click here.

- Beth DeSimone and Jeremy Hochberg

Are you a "Larger Participant" in the Consumer Financial Area? How Big is Big Enough to Be CFPB-Supervised?

On June 23, 2011, the new Consumer Financial Protection Bureau (CFPB) issued its first notice and request for comment. The Notice requested input on how the CFPB should define “large participants” for purposes of its supervision of nondepository entities. The reason for the Notice is that nondepository providers of consumer financial products and services are subject to federal supervision for the first time by the CFPB under the Dodd-Frank Wall Street Reform and Consumer Protection Act. While the Dodd-Frank Act grants the CFPB authority to supervise nonbank mortgage companies, private education lenders, and payday lenders, regardless of size, the CFPB can generally only supervise entities in other markets for consumer financial products or services if that entity is deemed to be a “larger participant” of such market.

The Dodd-Frank Act thus requires that the CFPB issue an initial rule to define the entities that are “larger participants of a market for other consumer financial products or services.” A variety of consumer financial products and services offered by nondepository entities could potentially be subject to supervision by the CFPB under the “larger participant” rule. The Notice identifies the following market categories for possible inclusion:

1. Debt collection;
2. Consumer reporting;
3. Consumer credit and related activities;
4. Money transmitting, check cashing, and related activities;
5. Prepaid cards; and
6. Debt relief services.

No State Consumer Protection Act Claim in Competitor False Advertising Case

The Lanham Act is not a “consumer protection act,” and courts have recognized that the Lanham Act false advertising cases vindicate “competitive” injuries virtually without regard to “consumer” interests. A recent decision confirms a related principle: Lanham Act plaintiffs may not automatically tack on state consumer protection claims to their competitor cases.

In a decision on May 26, 2011 involving competing tax services, Jackson Hewitt v. H&R Block, the Southern District of New York dismissed a New Jersey consumer protection act (CPA) claim from a lawsuit alleging competitive misconduct. In its complaint, Plaintiff Jackson Hewitt alleged that H&R Block, plaintiff’s “direct competitor” in the tax preparation business, disparaged Jackson Hewitt by suggesting that 2 out of 3 tax returns prepared by Jackson Hewitt contained errors (see H&R Block's Second Look Review program here). The court noted that Jackson Hewitt’s case alleged “unfair practices that have disadvantaged Jackson Hewitt in the marketplace.” Significantly, however, the court found that “[n]owhere does Jackson Hewitt allege a harm associated with consuming H&R Block's services”. While the allegations stated a claim under the Lanham Act, the court dismissed the New Jersey CPA claim because that statute remedies “consumer fraud,” not competitive injuries.

This is the outcome, even though the advertising at issue actually was directed to consumers, and, if the advertising is false, consumers could bring a separate lawsuit for the same conduct. But not in this lawsuit. The court concluded that “Jackson Hewitt has brought this lawsuit as a competitor of H&R Block, not a consumer of its services, and therefore cannot avail itself of the [consumer protection] Act.” This will not be the result in all competitor cases because some state CPA statutes also reach competition injuries.

- Randy Miller

Inside Scoop on the Consumer Financial Protection Bureau - Members of the Implementation Team Speak

The Women in Housing and Finance (WHF) hosted a panel last week with two key members of the Consumer Financial Protection Bureau’s (CFPB’s) implementation team, Peggy Twohig and Steve Antonakes.Twohig, formerly the Treasury Department’s Director of the Office of Consumer Protection, is the Assistant Director for Non-Bank Supervision. Antonakes, who has served as the Massachusetts Banking Commissioner for the past seven years before joining the CFPB, is the Assistant Director for Large Bank Supervision.

As the date of enforcement authority (July 21, 2011) quickly approaches, Twohig stated in the opening remarks that the CFPB’s implementation team has focused on organizational efforts to translate the agency’s mission statement into a functioning organization. The agency currently has 570 employees and has already brought in a number leaders for its operational units. For instance, one of the more recent additions was the appointment of Gail Hillebrand, formerly a senior attorney with Consumers Union, as the Associate Director of Consumer Education and Engagement.

The two panelists shared remarks about their current initiatives in their specific groups. Antonakes stated that his activities fall into two main buckets. First, he and his team are educating themselves on the 110 financial institutions that fall under the purview of the Large Bank Supervision unit. These institutions have approximately $10 trillion in assets and represent 80 to 90 percent of the total bank assets in the United States. In order to learn more about these institutions, his group has entered into information-sharing agreements with other state and federal regulators and stressed that his group will continue to work closely with these regulators in sharing information. The education efforts will help determine the scope of examinations, as most of the 110 institutions will be subject to point-in-time supervision, while the largest institutions will be subject to continuous supervision (similar to the resident examination programs of other federal agencies). The second initiative involves the recruitment of examiners. Antonakes plans to recruit from two sources: transferees from existing agencies, and external recruiting of entry-level examiners, including candidates with previous financial services experience. The challenge will be to train these examiners in the short period of time before the CFPB launches.

Twohig then shared that the main challenge facing the Non-Bank Supervision group is determining which entities are to be regulated. Non-bank entities, including mortgage lenders, mortgage servicers, student lenders, payday lenders, credit bureaus, and debt collectors, will definitely be supervised by the group. Other types of entities to be regulated will be defined through the rulemaking process. Twohig indicated that they are consulting with trade associations to define what types of industries are to be regulated. An entity that does not fall under the statute can still be examined if the group receives information that the entity is selling a financial product that is posing a risk to consumers. Twohig called this exception the “risk catchall provision.” The most important factor in initiating an examination is the risk posed to consumers. The group will then consider asset size and the extent to which existing state laws already regulate the entity. The group will initially focus on larger firms for examination. Twohig also discussed how the group will interact with state regulators. The group has entered into information-sharing agreements with state regulators in order to develop a common standard for examination of non-banking entities. Twohig sees the group augmenting a state’s role in regulation in non-banking entities. In areas where there is no state regulation, there is likely more risk to consumers and thus, more authority for the non-banking supervision group to act.

Antonakes and Twohig then opened the floor for questions, many of which focused on the examination process. One question posed asked was what extent would the CFPB interfere with prudential federal regulators’ safety and soundness exams. Antonakes stated that there is a statutory obligation to coordinate with prudential federal regulators to avoid any overlap. He anticipates robust information sharing and coordination so that there will be no duplicative information requests. Another question asked was whether information provided to CFPB examiners will receive similar privileged treatment as it does with other prudential regulator examinations. Antonakes responded that the examination process will likely be similar to what has been done in the past, but that procedures are still being worked out. Another question was raised about whether fees will be assessed for examinations, and the panelists stated that they believed the necessary funding would be provided so that fees would not be necessary. Finally, there was a question as to whether there would be a problem if no director is named for the CFPB before July 21. Twohig had no answer, but Antonakes believes that the Large Bank Supervision unit will be able to function without CFPB having a director.

While there is still much work to be done in defining the scope and procedures of the examinations before the July 21 rollout date, the two common themes from the panelists were: that the primary focus of CFPB examinations will be on consumer risk and that significant efforts will be made to ensure that examinations do not overlap with existing federal and state regulations.

- Chester Choi and Amy Mudge

Obama Nominates Leibowitz for New Term as FTC Chairman

Last week, President Obama announced his intention to nominate Jon Leibowitz for a second term as chairman of the Federal Trade Commission (FTC). The announcement likely signals a continuation of the rigorous consumer protection and antitrust enforcement that we have seen from the FTC under his leadership.

The FTC is an independent agency and, as such, operates differently than many other US agencies. It is headed by five commissioners who are nominated by the President and confirmed by the Senate to serve staggered seven year terms. No more than three sitting commissioners may belong to the same political party. The current Republican commissioners are William E. Kovacic and J. Thomas Rosch, whose terms expire on September 25th of 2011 and 2012, respectively, and the current Democrats are Edith Ramirez and Julie Brill, whose terms expire on September 25th of 2015 and 2016, respectively. Commissioner Leibowitz originally was appointed by former President George W. Bush in 2005 when a democratic seat became vacant. The President selects one commissioner to serve as chairman. The Chairman names the directors of the FTC's bureaus, including the Consumer Protective Bureau.

Since being appointed Chairman in 2009, Leibowitz has tackled a number of high profile consumer protection issues. For example, in the wake of the financial crisis, Leibowitz urged Congress to expand the FTC’s rulemaking and enforcement powers to more effectively target financial fraud. Though such legislation was never enacted, the FTC persisted in its consumer financial protection efforts by bringing dozens of lawsuits against debt relief and credit repair scams, issuing a rule prohibiting the use of advance fees and false claims by mortgage relief companies, and proposing a rule banning deceptive mortgage advertising.

Leibowitz has also led the FTC’s aggressive consumer privacy agenda. He has encouraged robust enforcement against companies that fail to protect consumers’ personal information, including treating the failure to maintain reasonable security as an “unfair” practice that violates the FTC Act. In addition, under his chairmanship, the agency has issued revised behavioral advertising self-regulatory principles, brought eight new actions against the use of harassing “robocalls,” and shut down a rogue ISP that helped distribute illegal spam and child pornography (this action temporarily decreased worldwide spam by thirty percent).

Going forward, we expect to see clearer and broader guidance with respect to behavioral advertising, where Leibowitz feels there is “still work to be done.” Likewise, although the Consumer Financial Protection Bureau now has primary regulatory authority over consumer financial products, the FTC will likely remain active in this area, as Leibowitz is determined to weed out corrupt foreclosure consultants, debt collectors, and payday lenders. He foresees the two agencies working collaboratively to meet these goals. Finally, we expect to see more high profile deceptive advertising cases, larger settlements, and an increased willingness by the FTC to take matters to court. All-in-all, expect a bumpy ride for companies who previously may have been able to stay under the radar. Leibowitz's consumer protection agenda is aggressive, ramped up, and, assuming no unexpected bumps in the process of extending his term, well on track.

- Amy Mudge and Anita Kalra

Watch Your End User: FTC Goes After Credit Reporting Agencies for Failing to Monitor Their Clients’ Security Protocols

The Federal Trade Commission (FTC) recently reached a settlement with three credit reporting agencies, SettlementOne, ACRAnet, and Statewide Credit Services. These companies (respondents) have contracted to received credit reports and their accompanying bits of sensitive information from the three major consumer reporting agencies, Equifax, Experian, and TransUnion. With this information, the respondents create “trimerge reports” that can be accessed by the respondents’ clients via a user name and password to assess the credit worthiness of individuals seeking credit. The essential issue, according to the FTC, was that these companies had failed to monitor the security protocols of their clients, resulting in a situation where hackers were able to breach clients’ systems in order to access sensitive information on approximately 1,800 consumers.

Data security has become a major issue to the Commission given the impact of identity theft and other data crime. The FTC’s latest report on the matter estimates that 8.3 million Americans were victims of identity theft in 2005. Aside from the financial harm, which the Report estimated at $15.6 billion, consumers also face lingering issues, such as problems obtaining additional lines of credit or new loans, unpleasant dealings with collection agencies, and hours upon hours of lost time trying to restore their financial and data security.

The FTC’s Complaints against the respondents (SettlementOne, ACRAnet, Statewide Credit Services) and affiliated entities alleged violations of the Gramm-Leach-Bliley Act Safeguards Rule, Fair Credit Reporting Act (FCRA), and Section 5 of the FTC Act by, among other things, (1) neglecting to create and articulate security policies for end users to follow; (2) not establishing and maintaining adequate security protocols; (3) failing to ensure that the end users of their products would properly protect sensitive information; (4) failing to provide training on security measures to end users; (5) not creating a system to monitor end users’ access of trimerge reports (including odd patterns or suspicious viewing); and (6) not remedying security issues even after known breaches.

The FTC alleged that, because of these failures, the respondents had allowed their clients to access reports without ensuring that they had “basic security measures in place, such as firewalls and updated antivirus software.” The FTC further asserted that after the alleged data breaches occurred, the respondents did not take reasonable steps to find out the causes of the breaches or to ensure that such breaches would not occur again in the future. Altogether, the crux of the FTC’s allegations was that the reporting agencies had failed to take “reasonable and appropriate measures” in maintaining the confidentiality and security of sensitive information by failing to ensure that only persons with—in the words of the FCRA—a “permissible purpose[ ]” would receive third-parties’ credit reports (i.e., that unauthorized persons could not access such information), and that the reporting agencies’ actions thereby threatened to cause or caused substantial injury to consumers.

In the Consent Orders (SettlementOne, ACRAnet, Statewide Credit Services), each respondent agreed to implement “comprehensive information security program[s]” that would protect the security of confidential information contained in the trimerge reports. Each signed off on having a key employee to oversee the program and to updating the program regularly to keep up with ongoing security needs. To ensure compliance with these terms, the respondents agreed to undergo assessments by independent parties, with assessment reports to be submitted to the FTC for the next 20 years. These assessment reports must certify the adequacy of the safeguards the respondents have in place as well as that the respondents’ information protection systems are working properly.

Separate from the final agreement, Commissioner Brill issued a statement — which was joined by Chairman Leibowitz and Commissioners Rosch and Ramirez — indicating that, in the future, these Commissioners “will call for imposition of civil penalties against resellers of consumer reports” who do not go to the appropriate lengths to protect the sensitive information contained in these reports. It seems that the Commission was not willing to go that far in this case, with Commissioner Brill’s statement recognizing that this was the first instance in which the FTC had held credit reporting agencies responsible for the data-protection failures of their clients. While the respondents did not bear the full burden of the FTC’s potential enforcement mechanisms, this case makes clear that information brokers should scrutinize the information security policies of their clients and should at all times be as knowledgeable as possible regarding the security and confidentiality measures their clients are taking.

- Ronald Lee, Nancy Perkins, and Michael Thorpe

CFPB Moving into the Sunshine; Clouds Remain

Last week, the new Consumer Financial Protection Bureau (CFPB) moved out of the shadows and more into the sunshine, by releasing a letter to Rep. Randy Neugebaurer summarizing its organization, budget and goals and by launching a website listing its priorities.

The letter to Rep. Neugebaurer, who chairs the Oversight subcommittee of the House Financial Services Committee, responds to his letter of January 18, which asked for additional information on the Bureau. Released on Monday, the letter gives some details on the Bureau’s expected structure. As the letter notes, the Bureau is expected to have six divisions: consumer engagement and education, supervision and enforcement, research markets and regulations, legal matters general counsel, external affairs, and the organization's own internal operations. These divisions mirror the responsibilities given to the Bureau by the Dodd Frank Wall Street Reform and Consumer Protection Act.

The letter emphasizes that the structure is designed to meet what it sees as its mission, which, among other things is: (1) to engage with consumers in everything it does; (2) enforce consumer financial laws efficiently and effectively ; (3) create a level playing field between large banks, other financial institutions and non-bank providers of consumer products; (4) advance financial education; and (5) make the Bureau a data-driven agency by having research and market analysis become a core to all of its work.

These details are also reflected in the website in a more user friendly format. The site is organized around consumer education and feedback, with various opportunities for user input, complaints and feedback. It also is peppered with YouTube videos and other visual media designed to appeal to a tech-savvy generation.

 

Yet these releases still leaves many questions unanswered. While Elizabeth Warren is meeting with industry representatives and others to assure them that her goal is to streamline regulation and only go after the bad actors, there is still a lot that is undefined and disquieting. The regulation and enforcement areas are particularly undefined. The emphasis on data collection and consumer complaints bring additional fear of regulatory burden and unfounded “gotcha” actions. And the lack of a named, confirmed Director that can issue regulations add to that unease. Much of this is understandable, given that this is a new agency still under construction. It remains to be seen if these fears are eased as the Bureau continues its building activities.

- Beth DeSimone

FTC Chair Forecasts a Business-Friendly Partnership with the Consumer Financial Protection Bureau

Last week, in remarks to the US Chamber of Commerce, Federal Trade Commission (FTC) Chairman Jon Leibowitz sought to defend the Consumer Financial Protection Bureau (CFPB) to one of the CFPB’s primary opponents. Indeed, during the speech, Chairman Leibowitz quipped that the FTC and the CFPB would be so busy focusing on “bottom feeder” companies that the agencies would not have the resources to excessively regulate “legitimate” businesses.

As has been reported previously, The Dodd-Frank Wall Street Reform and Consumer Protection Act created the CFPB to serve as the primary regulatory authority over consumer financial products and nearly every federal consumer financial protection law. The CFPB and the FTC will share regulatory authority over nondepository institutions, and also coordinate enforcement efforts through a negotiated memorandum of understanding - the difference is that the CFPB will have a budget that dwarfs that of the FTC. The CFPB is scheduled to begin its regulatory operations on July 21, 2011, and the President, with Senate’s consent, must still appoint a single director to run the agency for a five-year term.

In the speech to the Chamber of Commerce, Chairman Leibowitz acknowledged that the CFPB’s broad power, independent (and large) budget, and enormous staff should cause anxiety within the business community. However, Chairman Leibowitz noted that these fears are unfounded primarily because the Obama Administration has signaled a more pro-business direction following the 2010 mid-term elections.

Actually, the biggest signal of the CFPB’s impact on business will likely occur when the President nominates the Director of the CFPB. The Director, in conjunction with White House Special Advisor Elizabeth Warren, will set the culture and policies for how the CFPB’s broad authorities will be applied.

Chairman Leibowitz envisioned a regulatory world where the FTC and CFPB will work collaboratively to “weed[] out crooks and scam artists who divert dollars from legitimate businesses.” He would like for the two agencies to focus on “fly-by-night ‘foreclosure consultants’ taking advantage of struggling homeowners, debt collectors engaged in illegal harassment, and payday lenders failing to disclose outrageous fees.” Given those priorities, he remarked that the remaining “legitimate” businesses should be subject to limited regulatory burden. The future will show whether Chairman Leibowitz’s more powerful, and yet to be determined counterpart at the CFPB will share this regulatory vision.

- Beth DeSimone and Brian Larkin

Paying for Coffee with an App is New; Consumer Protection Laws are Not

Starbucks announced last week with some fanfare that it now will let customers pay for their coffee with their BlackBerry or iPhone if it has the Starbucks Card Mobile App (see here).

How does this app work? According to Starbucks, the app is “a complement to your plastic card.” Thus, you still have to get a plastic Starbucks Gift Card, which has been around for years. What the app does is display a barcode on your smartphone. The barcode is linked to the Starbucks Card number, so when it is scanned, money can be deducted from the Starbucks Card to pay for the purchase. Starbucks may be the first major chain of coffee shops in the US to offer this type of app, but it would seem that other retailers could easily follow suit if customers like it.

And what’s not to like? Whether you use a retailer-issued plastic card or a barcode linked to that card to pay for your purchases, the applicable consumer financial protection laws are the same (and they are very limited). A retailer-issued card like the Starbucks Card does not work like a bank debit card. In fact, it is not linked to any account at any financial institutions, and most of the traditional disclosure requirements and other restrictions of the Electronic Fund Transfer Act and Regulation E do not apply. Also, if no fees are charged for the issuance or use of the card and the card has no expiration date, as in the case of the Starbucks Card, the gift card disclosure requirements added to the EFTA by the CARD Act of 2009 would not apply, either.

Nevertheless, debiting a customer’s bank account in order to load value onto the customer’s card would be subject to Regulation E, which means the retailer must obtain the customer’s authorization properly to do so (through the swipe of a debit card or otherwise). Alternatively, using a credit card to load funds onto the card would be subject to the protections of Regulation Z. From the consumer’s perspective, the important thing to remember is that, when you lose a retailer-issued card like the Starbucks Card or the smartphone that carries the corresponding barcode, it is no different than losing cash, unless you call the retailer immediately and you have registered the card with the retailer. If you hadn’t registered the card, the retailer would not be able to identify the card you lost. In contrast, when your bank debit card gets lost and someone else uses it, your loss is limited to $50 by law, assuming that you provide timely notice.

But while the protection is limited, the convenience of using the app may turn out to be too tempting. Modern society likely could function without nutrients (which is not a synonym for food or coffee) for a moment; but could it without BlackBerries or iPhones - or coffee?

- Beth DeSimone and Harry Wu

New Consumer Financial Protection Bureau Taking Shape

While President Obama and his family took a rest and Congress was home during the holidays, the individuals at the US Treasury hired to organize the new Consumer Financial Protection Bureau were busy.

The results of their efforts have been announced over the last number of weeks, including the naming of the heads of the different divisions and offices within the CFPB:

• Outgoing (and outspoken) Ohio Attorney General Richard Cordray to head the enforcement division
• Leonard Chanin, the current Deputy Director of the Federal Reserve Board Division of Consumer and Community Affairs, to lead the rule writing team
• David Silberman of Kessler Financial Services, and formerly of the AFL-CIO, to head the card markets division
• Tim Duncan of Story Street Investment Management, to head the CFPB’s technology operations
• David Forrest of the Motley Fool to head the online engagement team
• Holly Petraeus, the wife of General David Petraeus, to head the Office of Service Member Affairs

These most recent implementation team members join Steve Antonakes, former Massachusetts Commissioner of Banks, who had been named to head the depository institution supervision area, and my former colleague, Peggy Twohig, who is heading the non-depository institution supervision team.

Another development included the execution on January 4, 2011 of a memorandum of understanding with the Conference of State Bank Supervisors for the coordination of examination and enforcement resources between the CFPB and state regulators in the consumer area. Under this MOU, state regulators and the CFPB will endeavor to promote consistent examination procedures and effective enforcement of state and federal consumer laws to minimize regulatory burden and efficiently deploy supervisory resources. The MOU also provides that state regulators and the CFPB will consult each other regarding the standards, procedures, and practices used by state regulators and the CFPB to conduct compliance examinations of providers of consumer financial products and services, including non-depository mortgage lenders, mortgage servicers, private student lenders, and payday lenders

In addition, Elizabeth Warren, the White House adviser assigned to set up a CFPB, has been meeting with various financial services firms to assess their needs and concerns, at the same time as she has continued to be outspoken about the need for clear, simple terms and disclosures for all consumer financial products. More announcements about the organization of the CFPB are surely coming. All this activity suggests that the CFPB will be well prepared to hit the ground running on July 21, 2011 when it is scheduled to be officially launched. Both bank and non-bank lenders should be prepared for active supervision and enforcement by the new agency by reviewing their marketing, product terms and compliance programs now.

- Beth DeSimone

Deadline for Sales of Noncompliant Gift Cards Runs January 31

Once again, gift cards were a big seller during the holiday season. A National Retail Foundation survey showed that well over half of adults wanted gift cards over clothing, books, entertainment and other options.

The cards offered this season carry more legal protections for consumer than those offered in previous years, thanks to the Credit Card Accountability Responsibility and Disclosure or CARD Act. Most of the gift card provisions of the CARD Act became effective in August 2010, and included expiration date and replacement date requirements, as well as limits on fees such as dormancy, inactivity and service fees. (See prior blog here for all the details.)

The CARD Act also requires that the expiration date and any fees that may apply to the card be actually placed on the face of the gift card, along with a toll-free telephone number people can call for more information. However, to allow gift card issuers to use up their old card stock, Congress amended the CARD Act in July to give businesses with cards produced before Apri l1, 2010 up to January 31, 2011 to replace all their card stock with cards that comply with these disclosure requirements.

Those businesses selling these non-compliant cards in the interim period have been required to inform the consumer of the expiration date and applicable fees by providing notice via in-store signs, web site disclosures, general advertising, or service calls. In addition, the business is required to advise consumers that:

• Any gift card or gift certificate for which funds expire shall be deemed to have no expiration date with respect to the underlying funds;
• Consumers holding these cards have the right to a free replacement card or certificate that includes the packaging and materials that are typically associated with these cards; and
• Any dormancy fee, inactivity fee or service fee for such cards or certificate that might otherwise be imposed may not be charged unless they would otherwise comply with the CARD Act fee restrictions.

However, as of January 31, 2011, businesses that still hold gift cards or certificates produced prior to April 2010 must replace those cards or certificates with cards that comply with the on-card disclosures required by the CARD Act. Depending on sales, these replacements may be costly. In any event, conducting a thorough inventory of gift cards being sold at your business likely should top a retailer’s New Year’s resolution list.

- Beth DeSimone

UPCOMING WEBINAR: Avoiding the Pitfalls of Selling to California Consumers

The editors of the Consumer Advertising Law Blog wanted to let our readers know about an upcoming webinar that may be of interest to you, entitled, Avoiding the Pitfalls of Selling to California Consumers. [Full disclosure: Our firm, Arnold & Porter LLP, is sponsoring the event]

Companies that sell to consumers, directly or indirectly, are subject to an array of federal and state laws and regulations. Selling goods and services to California consumers is especially challenging because the state has a panoply of uniquely stringent consumer protection and antitrust laws. Particularly given California's active plaintiffs' bar, these laws can be a trap for the unwary, with potentially expensive consequences.

And They’re Off!! Elizabeth Warren to Help Organize CFPB. Transfer Date Set For July 21, 2011. Mortgage Forum Set for Tomorrow

Developments are starting to occur in rapid fire succession in the highly anticipated organization of the CFPB.

As expected, on Friday, President Obama appointed Elizabeth Warren as Assistant to the President and Special Adviser to the Secretary of the Treasury on the Consumer Financial Protection Bureau. According to an official White House statement, Ms. Warren will play the lead role in setting up the Bureau and ensuring it is as effective as possible. It is expected that she will assist the Treasury Department, which is tasked under the Dodd-Frank Act with organizing the Bureau, in the structure of the agency and in recruiting staff. She also likely will have a voice in who is nominated to serve as the Bureau’s first director.

At the same time, the Treasury Department published the anticipated “transfer date” for the official transfer of the consumer protection functions of various federal bank agencies, HUD and the FTC to the Bureau. This date has been set for July 21, 2011 - one year from the date of enactment of the Dodd Frank Act. On that date, for example, the CFPB will take over supervision of consumer financial protection for large financial institutions (ie., those over $10 billion in assets), as well as certain non-bank providers of financial services, such as mortgage companies, pay day lenders, debt collectors and credit reporting agencies.

As of that date, the CFPB also will be able to take over the promulgation of regulations under the various consumer financial laws, such as the Truth in Lending Act, the Real Estate Settlement Procedures Act, the Truth in Savings Bank, the Electronic Funds Transfer Act, the Equal Credit Opportunity Act and Fair Credit Reporting Act, among others.

According to the Federal Register notice, published today, in the intervening period, the CFPB will lay the groundwork for an efficient transfer of these functions. For instance, the notice states that prior to the designated transfer date, the CFPB “will begin to conduct research relating to consumer financial products and services, develop its nationwide consumer complaint response center, plan and take steps to implement the risk-based supervision of non-depository covered persons, and prepare for the opening of outreach offices.” The notice goes on to note that development of the supervision program - particularly the hiring and training of examination staff, and the development of supervision policies and procedures - for certain nondepository covered persons is particularly significant because no Federal agency previously has had the responsibility of supervising these entities.

Finally, the Treasury Department and the CFPB are holding a roundtable tomorrow to begin gathering public input regarding the merger of overlapping mortgage forms required by TILA and RESPA. This form merger is required to be completed within a year of enactment of the Dodd Frank Bill - or by the designated transfer date of July 21, 2011.

Given the large number of things that need to occur to get the CFPB in place by July 21, 2011, we expect that developments will continue to occur on a regular basis going forward. We will stay on top of these developments as they occur and let you know their implications.

- Beth DeSimone

Consumer Financial Protection Bureau - When Will Treasury Pull the Switch?

Everyone it seems is focused on whether and when Elizabeth Warren will be named as the director of the new Consumer Financial Protection Bureau. Today, the reports are that she will not be named either a permanent or interim head, but rather just to install her as a special advisor at the Treasury Department.

The identity of the CPFB director is important, as that person will set the tone and priorities of the new agency, and lend legitimacy to its efforts.

Arguably, however, a more important and looming deadline is the designation by the Treasury Secretary of the date by which the functions of the CFPB are to be transferred from the Treasury Department, the various federal banking agencies, and the FTC (the so-called Designated Transfer Date). This designation is required to be made by the Dodd Frank Act by 60 days from the date of enactment of the Act or by this Sunday, September 19, 2010. The date itself is required to be a date between 180 days and 12 months from the Act’s enactment date, but can be extended by the Treasury Secretary to 18 months from the enactment date.

Designation of this date is important because it will become the inauguration date of the new agency. Existing regulations will come under the purview of the agency as of that date and new regulations can be issued and enforced by it as of that date. Thus, priorities will be set and the effectiveness of the CFPB in meeting those priorities will be measured as of that date.

There is some speculation that, if an interim director is named, or the nomination of a director is postponed, the Treasury Secretary will designate a later Designated Transfer Date, so as to allow the interim or named director time to organize the CPFB and set priorities. However, we do not know what actually is being contemplated as the Designated Transfer Date, and little has been written about it. The Act allows the Secretary to set a date and then change it, upon consultation with heads of the federal banking agencies and the FTC, the Secretary of HUD and the Director of the OMB.

Regardless, the Obama Administration can use this deadline to create some momentum about the CFPB that appears to have been somewhat lost amid the speculation as to its Director.

- Beth DeSimone