Using Big Data in Compliance with Consumer Protection Laws

big-data-4-15-16.pngThere has been increased focus in the past 18 months by the federal regulators on the use of “big data” by companies in designing and marketing products to consumers, including credit products and services. While there are many potential advantages to the use of big data, including positively impacting credit opportunities for low-income and underserved populations, recent statements and reports by the Consumer Financial Protection Bureau (CFPB) and the Federal Trade Commission (FTC) have raised concerns that the use of big data that involves consumer information could violate certain consumer protection laws.

Based on an FTC report issued in the fall of 2015 concerning the use of big data, the agency noted that all of the following apply to the use of big data: the Fair Credit Reporting Act (FCRA); equal opportunity laws such as the Equal Credit Opportunity Act (ECOA) and the Fair Housing Act; and the FTC Act with respect to unfair, deceptive or abusive acts or practices (UDAAP). Generally, in the credit context, “big data” would include information obtained from Internet searches, social media and mobile apps, in addition to traditional factors such as late payment history, to determine a consumer’s creditworthiness. The CFPB has indicated that it is reviewing how to analyze the use of big data, with a focus on fair lending issues under the disparate impact analysis. As such, it is important that financial institutions monitor the regulatory developments in this area. To the extent they use big data in marketing, credit decisions or in other similar ways that may impact consumer protection, they need to make sure there is a procedure in place to analyze and monitor the effects of utilizing such data under the consumer protection laws.

With respect to the FCRA, the FTC report noted that there is a growing trend toward using predictive analytics (which may include non-traditional factors such as social media usage, shopping history or a consumer’s zip code) in addition to traditional factors (such as a consumer’s debt payment history) to determine a consumer’s eligibility for a product and to make a decision as to whether a consumer is a good credit risk. Given that the FTC will apply the same standards to non-traditional factors that it applies to traditional factors in considering the applicability of the FCRA in an enforcement action, institutions should take this into account if they are using big data when making a eligibility determination covered by the FCRA.

The equal opportunity laws prohibit discrimination on the basis of race, color, religion, sex, disability, age, national origin, sexual orientation and genetic information. For financial institutions, the ECOA and the Fair Housing Act can be violated if an institution makes a credit decision based on non-traditional factors and that results in disparate treatment or has a disparate impact. For example, the FTC Report notes that if credit decisions are based on consumers’ zip codes, such decisions may have a disparate impact on a protected class that is not justified by a legitimate business necessity. At a recent industry conference, CFPB senior staff advised creditors that are using third party vendors to collect or analyze big data to ensure they are following applicable regulatory guidance on oversight of third-party vendors.

Both the FTC and the CFPB have authority over UDAAP violations. According to the FTC report, companies that are engaging in big data analytics should review their practices to determine whether they have failed to disclose any material information to consumers or have violated any material promises to consumers, such as those relating to data sharing and safeguarding of consumer information. A UDAAP determination would be fact-specific and would be based on whether a company is offering or using big data analytics in a deceptive, unfair or abusive manner.

The FTC report also raised the concern that the use of big data analytics could potentially have a discriminatory effect on low-income and underserved populations, while acknowledging that it could also create positive opportunities for those consumers. The FTC, in summarizing the results of the research on big data, recommended that companies take steps to maximize the benefits and limit the harms caused by big data by considering the following questions in utilizing such data: (1) how representative is your data set; (2) does the data model account for biases; (3) how accurate are your predictions based on big data; and (4) does your reliance on big data raise ethical or fairness concerns?

As many financial institutions either use data they collect from their customers or data they obtain from third-party data aggregators, such as data brokers, to design, offer or provide banking products and services, directors and executive management of financial institutions should keep themselves apprised of developments in this area and adopt appropriate policies and procedures to ensure that their use of big data complies with applicable consumer protection laws and regulations.