CFPB: States Can Issue Their Own Credit Reporting Laws

States can issue their own fair credit reporting laws that protect residents, the U.S. Consumer Financial Protection Bureau (CFPB) said in a ruling Tuesday (June 28).

The bureau’s interpretive ruling said that with a few exceptions, states can enact their own laws that are stricter than the federal Fair Credit Reporting Act (FCRA).

“Given the intrusive surveillance that Americans face every day, it is critical that states can protect their citizens from abuse and misuse of data,” CFPB Director Rohit Chopra said in a news release. “The legal interpretation issued today makes clear that federal law does not automatically hit delete on state data protections.”

The 52-year-old FCRA establishes permissible uses of credit reports and sets up guidelines for the information they can include. It also gives people a way to dispute their information.

The CFPB said its ruling makes it clear that states have the authority to protect people from harm posed by credit reporting issues, using the example of a state barring a credit reporting company from “including information about a medical debt for a certain period of time after the debt was incurred.”

Related: CFPB: Credit Denials Must Have Specific, Accurate Explanations

In addition, the ruling said that state laws aren’t preempted by federal law unless they conflict with the FCRA, except within a few preemption categories. The FCRA doesn’t preempt, for example, state laws that determine whether eviction information or overdue rents show up on credit reports.

Last month, the CFPB issued a reminder to consumers that federal law mandates companies must give specific reasons for denying credit applications, even when they use credit models based on complex algorithms.

“Companies are not absolved of their legal responsibilities when they let a black-box model make lending decisions,” Chopra said. “The law gives every applicant the right to a specific explanation if their application for credit was denied, and that right is not diminished simply because a company uses a complex algorithm that it doesn’t understand.”