Article by Kevin G. Fitzgerald 1
1. FAIR AND ACCURATE CREDIT TRANSACTIONS ACT OF 2003
A. Introduction
On December 4, 2003, President Bush signed into law the Fair and Accurate Credit Transactions Act of 2003, also referred to as the "FACT Act."2 This new law is the first major overhaul of the Fair Credit Reporting Act (FCRA) since 1996. The FACT Act contains various consumer protection provisions aimed at combating identity theft, enabling consumers to correct errors in their credit files, and authorizing the government to study various aspects of the credit reporting industry.
The FACT Act also imposes limitations on information sharing among affiliates. At the same time, it preempts state laws which impose more restrictive limitations on certain types of information sharing, including portions of the stringent privacy laws recently enacted in California. Given these new legislative developments, members of the insurance industry should review their information sharing practices to ensure compliance with this ever-evolving web of state and federal consumer privacy laws.
B. Impact On Information Sharing Among Affiliates
The FACT Act imposes limitations on the sharing of consumer information among affiliates for marketing and solicitation purposes. Any company that receives certain consumer information from an affiliate may not use the information to make a solicitation for marketing purposes unless (1) it is clearly disclosed to the consumer that such information may be communicated among affiliates for purposes of making solicitations to the consumer, and (2) the consumer is provided an opportunity and a simple method to prohibit the making of such solicitations by the company.
As in the past, the notice requirements under the FACT Act may be coordinated and consolidated with any other notices required by law, including a company’s GLB privacy notice. Notices must allow the consumer the opportunity to prohibit all solicitations arising from information sharing among affiliates but may allow the consumer to choose from different options when electing to prohibit the sending of such solicitations, including options regarding the types of entities and information covered and the methods of solicitation prohibited.
The limitations on information sharing and solicitations do not apply in all situations. For example, the limitations do not apply to companies that use consumer information to make solicitations for marketing purposes to consumers with whom the company has an existing business relationship. In addition, the limitations do not apply when information is used by a company to perform services on behalf of an affiliate. Furthermore, the FACT Act does not prohibit a company from using consumer information in response to solicitations authorized or requested by the consumer.
C. Preemption Of State Laws
One of the primary purposes of the FACT Act was to permanently reauthorize various preemption provisions contained in the FCRA that were scheduled to sunset on January 1, 2004. These preemption provisions serve to prevent states from establishing certain laws regarding how companies use specific types of consumer information or exchange this information among affiliates. In some instances, the FACT Act also preempts more restrictive state laws already in existence, including certain portions of the stringent consumer privacy laws enacted late last year in California.3
D. Impact On State Credit Scoring Laws
Notwithstanding these broad preemptions, the FACT Act does not limit, annul, or supersede state laws regulating the use of credit-based insurance scores in insurance activities by any person engaged in the business of insurance. The FACT Act also calls for a government study of the effects of the use of credit scores and credit-based insurance scores on the availability and affordability of financial products and services, including property and casualty insurance.
2. FEDERAL COURT’S INTERPRETATION OF "ADVERSE ACTION" UNDER FCRA
Insurance companies using credit scores or consumer reports for underwriting purposes may be relieved from sending adverse action notices to consumers who are quoted or charged a higher initial premium rate based on their credit history. Under the FCRA, insurers must provide consumers with an adverse action notice any time they take an "adverse action" that is based in whole or in part on any information contained in a consumer report. In the context of insurance, the term "adverse action" means one of four things: a denial of coverage, cancellation of coverage, an increase in any charge for insurance, or a reduction or unfavorable change in the terms or amount of coverage, whether existing or applied for. According to a federal district court in Oregon, however, an adverse action does not occur when an insurer charges an initial premium rate that is higher than its optimal rate based on information from the insured’s credit report.4
A. Summary Of The Mark Decision
The Mark court examined a practice common in the insurance industry of using credit scores or information from consumer reports as a factor in determining premium rates. In this case, insureds brought a class action lawsuit against Valley Insurance Company ("Valley") asserting violations of the FCRA’s adverse action notice requirements. The lawsuit claimed that Valley took adverse actions against the insureds based on information in their consumer credit reports and then failed to notify them of these adverse actions.
Like many insurers, Valley used consumer credit scores as a factor in setting initial premium rates for its auto coverage. To qualify for Valley’s optimal rate, applicants had to meet or exceed a certain credit score, in addition to satisfying other criteria. Applicants with lower credit scores were charged a higher rate than similarly situated applicants with higher credit scores. Insureds argued that this constituted an adverse action because Valley was increasing its charge for insurance based on information obtained from a consumer credit report.
The Mark court, however, rejected the insureds’ argument that an adverse action occurs any time an insurer charges an insured more than another insured based on information in a consumer credit report. Instead, the court reasoned that the statutory definition of "adverse action" clearly anticipates that an insurer must have made an initial charge or demand for payment before the insurer can increase that charge. In other words, an insurer cannot increase the charge for insurance unless the insurer previously set and demanded payment of premium for that insured’s insurance coverage at a lower price. Thus, the court concluded that setting an initial rate for a new customer cannot constitute an increase in the charge for insurance, and thus is not an adverse action, even though a consumer’s credit information may have been used to establish that rate.
B. Court Rejects FTC Interpretation
The Mark court rejected an informal staff opinion issued by the FTC in 2000 which provided a contrary interpretation of the term "adverse action" in the context of insurance.5 In that staff opinion, the FTC stated that an adverse action occurs any time an insurer issues an initial charge for insurance that is higher than the charge demanded of similarly situated insureds with better credit histories. Based on this interpretation, the FTC concluded that an insurer’s refusal to provide existing or potential customers with a "good credit" discount based on information contained in a consumer report constituted an adverse action. The Mark court strongly disagreed with this interpretation and refused to grant any deference to the FTC’s informal opinion.
C. Impact On Insurers
Insurers should be cautious in relying too heavily on the opinion rendered in Mark. The Mark decision represents a case of first impression issued by a federal district court in Oregon and conflicts with a prior FTC interpretation of a very similar issue. Thus, other district courts may not follow the Mark decision. It is also possible that the FTC will address the Mark decision as the FTC drafts regulations under the FACT Act. While the FACT Act does not change the definition of an adverse action, making it unclear why the FTC would be issuing any rules on that topic, the Mark court did refuse to follow a prior FTC interpretation to the obvious disappointment of the FTC. Finally, as discussed in the final section below, it appears the NAIC is also attempting to address the Mark decision by way of proposed "Best Practices".
D. Notice Requirements Under State Credit Scoring Laws
The Mark decision analyzed adverse action notice requirements in the context of the FCRA. Insurers should be aware, however, that many states have adopted "credit scoring" laws which impose similar requirements on insurers at the state level. While Mark may relieve insurers from sending adverse action notices under the FCRA when setting initial premium rates, insurers may face similar notice requirements in states that have adopted credit scoring laws.6
3. NAIC BEST PRACTICES
Notwithstanding (or perhaps because of) the Mark decision, the NAIC is proposing "Best Practices" relating to a variety of credit scoring issues. The Market Regulation and Consumer Affairs (D) Committee issued a revised discussion draft of these "Best Practices" on March 14, 2004.7 These "Best Practices" address six factors, all of which relate in one way or another to the use of credit scoring in the insurance context. The six topics are: adverse action, extraordinary life circumstances, neutral score/no hit, scoring model submission standards, sole factor prohibition, and periodic review of credit scores. I will address each of these in turn.
A. Adverse Action
Under this section, the NAIC attempts to define what constitutes an adverse action under the FCRA and under subsection 4(A) of the NCOIL Model Act Regarding Use of Credit in Personal Insurance ("NCOIL Model Act"). The NAIC states, "an adverse action occurs when an insurer offers insurance at less favorable terms than it would have offered an applicant or insured if the applicant’s or insured’s credit-based insurance score would have been more favorable." What is interesting to note is that this is not what constitutes an adverse action under the FCRA as interpreted by one federal district court.8 Rather, the NAIC thought it more appropriate to rely on the FTC’s position on what constitutes an adverse action, even though the FTC’s position "is an informal staff opinion and is not binding on the Commission."9
It is certainly questionable whether the NAIC can expound on what constitutes an adverse action when such term is defined by federal law and interpreted by the federal courts. Nonetheless, this appears to be what the NAIC Best Practices is attempting to accomplish.
It is also interesting to note that while the FCRA, under the FACT Act, does preserve state statutes pertaining to credit-based insurance scores, the federal law does preempt any state statutes that purport to regulate the sending of adverse action notices.10 Thus, the remainder of the discussion relating to adverse action notices, which follows sections 8.A and 8.B. of the NCOIL Model Act, is also in question.
B. Extraordinary Life Circumstances
The NAIC "Best Practices" adds an additional requirement on insurers who take an adverse action on a consumer that has undergone an "extraordinary life circumstance". The concept of an extraordinary life circumstance exception, however, does not exist in any federal or state law this author is familiar with. Thus, it would appear that the NAIC is attempting to legislate and create such an exception by way of these "Best Practices".
C. Neutral Score/No Hit
Here the NAIC states that if an applicant has insufficient credit history to develop a credit score, the consumer "must be underwritten and rated in accordance with the remaining actuarial principles and standards of practice set forth in the appropriate rate filing that are exclusive of the credit score." A sentence previously contained in this section, allowing insurers to use insufficient or no credit history as a rating factor if they could show how the absence of credit related to the risk of loss, was deleted by the NAIC at its March, 2004 meeting.
D. Scoring Model Submission Standards
Under this provision, insurers (and others) must submit their credit-based insurance score models to the regulators for review and approval, but only upon the request of the insurance commissioner. At this point it is uncertain what this will entail, and upon what basis the insurance commissioner can "disapprove" such model. Presumably this is merely a proposed expansion of the rate filing requirements already in existence in most states, and presumably the same standards for approval and disapproval will apply.
E. Sole Factor Prohibition
This section requires insurers to rely on factors other than just a credit score to justify an underwriting decision. Arguably, this is merely a reiteration of the limitations on the use of credit information already contained in the NCOIL Model Act.11
F. Periodic Review Of Credit Scores
Consumers (and their agents) are given a right annually to require an insurer to reunderwrite and re-rate a policy based on a current credit report or current credit-based insurance score. In addition, even without a request by the consumer, an insurer must pull a new credit report no later than every 36 months following the last time the insurer obtained such a report. These requirements do not apply if credit was not used for underwriting or rating purposes.
The insurance industry’s primary objection with these "Best Practices" is that the NAIC is attempting to legislate by way of a "Best Practices". The industry believes that these are matters better left to state legislatures. More fundamental, however, is what is the intended legal impact of these "Best Practices." Clearly they are not law; nor are they being promulgated as regulations. These "Best Practices" are not set up as a bulletin or other notice to insurers. Perhaps they are intended to be part of the market conduct examiners handbook (although this is not how they are currently being offered). At this point, the legal ramifications of these "Best Practices" is somewhat unclear.
Conclusion
The FCRA and the related activity at the NAIC/State level concerning credit scoring clearly impacts the insurance industry. How this regulation will evolve, however, remains uncertain.
Footnotes
1 Kevin G. Fitzgerald is a partner in the Milwaukee office of Foley & Lardner LLP. He also practices in the Tallahassee, Florida office. He is a member of the Insurance Industry Group, and his practice is concentrated in the fields of corporate and regulatory insurance law, privacy legislation, captive insurance matters, agent and agency licensing and reinsurance transactions. Mr. Fitzgerald is a graduate of the University of Wisconsin Law School (J.D., cum laude, 1987) and Marquette University (B.S., magna cum laude, 1984). He was admitted to the Wisconsin Bar in 1987 and The Florida Bar in 1994. Mr. Fitzgerald gratefully acknowledges the assistance of Brian S. Kaas, an associate in Foley & Lardner LLP’s Milwaukee office, in the preparation of this article.
2 Pub. L. 108-159, 117 Stat. 1952.
3 On April 19, 2004, three banking and financial services groups filed a lawsuit in federal court seeking to block a portion of California’s new financial privacy law restricting the sharing of customer information among affiliates based on federal preemption grounds. See American Bankers Ass’n v. Lockyer, No. 04CV7778 (E.D. Cal).
4 See Mark v. Valley Ins. Co., 275 F. Supp. 2d 1307 (D. Or. July 17, 2003), see also Rausch v. The Hartford Fin. Serv. Group, Inc., 2003 WL 22722061 (D. Or. July 31, 2003). In Rausch, a federal district court, relying on its prior decision in the Mark case, granted an insurance company’s summary judgment motion to dismiss plaintiffs’ FCRA claims that the initial setting of plaintiffs’ insurance premiums constituted an "adverse action" under the FCRA where plaintiffs did not receive the best available premium rate based on information contained in their credit reports. The Rausch decision is currently on appeal before the Ninth Circuit.
5 See FTC Advisory Letter, Stires-Ball (March 1, 2000).
6 See, however, the preemption discussion in note 7 below.
7 At the Spring NAIC meeting held in New York, the Credit Scoring Working Group unanimously adopted 3 of the 6 "Best Practices" as amended at that meeting. The 3 adopted were: (1) extraordinary life circumstances, (2) scoring model submission standards, and (3) periodic review of credit scores. The remaining 3 "Best Practices" are still being reviewed.
8 See Mark discussion above.
9 See FTC Advisory Letter, Stires-Ball (March 1, 2000), p. 4.
10 15 U.S.C. §1681t(b)(1)(C) (FCRA § 624(b)(1)(C)). This provision states: "No requirement or prohibition may be imposed under the laws of any State … with respect to any subject matter regulated under … subsections (a) and (b) of section 615 [§ 1681m], relating to the duties of a person who takes an adverse action with respect to the consumer." Given this clear language in the FCRA, it would appear that Sections 8.A. and 8.B. of the NCOIL Model Act are preempted.
11 See NCOIL Model Act, Sections 5.B., 5.C., and 5.D.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
