September 28, 2020

Volume X, Number 272

September 28, 2020

Subscribe to Latest Legal News and Analysis

September 25, 2020

Subscribe to Latest Legal News and Analysis

NYDFS Proposes Regulation of Consumer Reporting Agencies

Last week, New York Governor Andrew Cuomo issued a press release directing the New York Department of Financial Services (“NYDFS”) to impose new rules on consumer reporting agencies (“CRAs”).  The proposed regulation would subject CRAs that issue consumer reports (as defined in a manner similar to the federal Fair Credit Reporting Act) about consumers located in New York to new requirements, including:

  • Annual registration with NYDFS – such registration must identify officers and/or directors that are responsible for the CRAs’ compliance with the new regulation;

  • Annual, and in some cases quarterly, information reporting requirements to NYDFS;

  • NYDFS examinations to be conducted as often as NYDFS considers “necessary”;

  • Prohibitions against various activities, such as including inaccurate information in a consumer report or engaging in any unfair, deceptive, abusive, and/or predatory acts or practices;

  • Communicating with consumers’ authorized representatives; and

  • Compliance with the newly issued NYDFS cybersecurity regulation

Except for requiring CRAs to comply with the NYDFS cybersecurity regulation, it is unclear how the other requirements would address the risks posed by the recent Equifax breach, which was the purported reason for Governor Cuomo’s announcement.

Importantly, by requiring CRAs to register on an annual basis, the proposed regulation would empower NYDFS to suspend or revoke such registration based not only on the bad acts of a CRA itself, but also based on the bad acts of individual members, principals, officers, directors, or controlling persons at the CRA.  Without a valid registration, a CRA would be prohibited from providing any consumer reports about consumers located in New York, any companies licensed by NYDFS would be prohibiting from purchasing consumer reports from the CRA, and any companies licensed by NYDFS would be prohibited from furnishing information about consumers located in New York to the CRA.

Although a version of the proposed regulation was released with Governor Cuomo’s announcement, NYDFS is expected to release an official version for public comment in the coming weeks.  CRAs and companies that rely on CRAs to provide information about consumers located in New York should strongly consider participating in this rulemaking process.

Copyright © by Ballard Spahr LLPNational Law Review, Volume VII, Number 268

TRENDING LEGAL ANALYSIS


About this Author

Kim Phan, Ballard Spahr Law Firm, Washington DC, Business and Finance Law Attorney
Of Counsel

Kim Phan writes and speaks frequently about privacy and data security issues for a variety of industries, including consumer financial services, retail, hospitality, higher education, and utilities. Ms. Phan counsels clients on privacy and data security law in areas including the Gramm-Leach-Bliley Act (GLBA), the Fair Credit Reporting Act (FCRA), the Telephone Consumer Protection Act (TCPA), and other federal and state privacy and data security statutes and regulations. Her work in this area encompasses strategic planning and guidance for companies to incorporate...

202-661-2286