District Court (Cal.) Says CRAs Maintenance of Behavioral Data Was Not Part of “File” Under FCRA

In Tailford v. Experian Info. Sols., No. SACV 19-02191JVS(KESx), 2020 U.S. Dist. LEXIS 84658 (C.D. Cal. May 12, 2020), Judge Selna dismissed a claim against Experian for failure to disclose in a “file” under the FCRA behavioral data that it maintained on the consumer.  The data the Experian maintained was as pleaded as follows:

Experian also collects “non-traditional” consumer data such as household income and purchase history (the “Behavioral Data”). Id. at ¶ 30. The Behavioral Data is sold to affiliates and third parties through a credit product called “OmniView” which includes a database called “ConsumerView.” Id. at ¶ 31. ConsumerView includes “thousands of attributes on more than 300 million consumers and 126 million households.” Id. Such information is Personally Identifiable Information because it either relates to individual consumers, or is derived from Personally Identifiable Information “which was stripped away prior to sale,” or can be combined with other “easily obtainable data to construct a comprehensive view of individual consumers.” Id. The ConsumerView database was formerly known as the “InSource Database” and Experian in a past public filing described it as “consumer socio-demographics, lifestyles, culture and behavior” data which it analyzes and categorizes into a compilation of datasets. Id. at ¶¶ 32-33. ConsumerView also includes Experian’s “Premier Aggregated Summarized Credit Statistics” which is a “series of aggregated credit attributes and proprietary scores that represent “the entire U.S. credit population.” Id. at 39. The product brochure from the Premier Aggregated Summarized Credit Statistics indicates that it is derived from “Experian’s National Consumer Credit File” and identifies its data source as the File One database. Id. at ¶ 40-42. It also states that the product “incorporates credit reporting agency data elements” such as available credit, collection activity, credit capacity, etc. Id. at ¶ 42. Plaintiffs contend that Experian offers the ConsumerView information “for the purpose of serving as a factor in determining eligibility for credit” because one offering of the product states that “summarized credit statistics are ‘calculated by aggregating the available consumer credit data in each Zip+4 and are most useful to identify prospects for invitations to apply for credit . . . offers.” Id. at ¶ 44. The data can be applied to “[t]arget candidates for invitations to apply for credit.” Id. Plaintiffs allegations as to the Behavioral Data contained in the ConsumerView product are best summarized in paragraph 45 of the Complaint: Although ConsumerView is purportedly a marketing database, the foregoing allegations make clear that the information contained therein is derived, at least in part, from Experian’s File One database, and that this information is used for purposes related to determining consumers’ eligibility for credit, employment, insurance, or other purposes articulated under Section 1681b of the FCRA. The non-traditional consumer information collected by Experian — including but not limited to education, income, and the type of residence a consumer lives in — has been used as a factor in determining consumer creditworthiness, in addition to its use as a marketing tool. Id. at ¶ 45. Experian also sells the consumer Behavioral Data through a suite of services called “Collection Advantage.” Id. at ¶ 36. Collection Advantage “permit[s] the user to combine data from Experian’s File One database and the database known as “MetroNet.” Id. MetroNet contains demographic information from “INSOURCE” the “nation’s largest repository of consumer marketing demographic data.” Id. B. Data Breach On October 6, 2017, UpGuard, a cyber-security research firm, discovered an Amazon cloud storage space that allegedly contained information regarding 123 million American households. Id. at ¶¶ 56-57. This data, allegedly placed in cloud storage by data analytics company Alteryx, was stored so as to be accessible to over one million specified users. Id. The information did not include the names of individual consumers; however, it included 248 columns of specific data points, among them address, phone number, number of adults and children living in the dwelling unit, length of residence, and other, more detailed consumer purchasing data. Id. The data could be cross-referenced with voter registration data and associated with specific individuals. Id. at ¶ 57. The information was provided to Alteryx by Experian through its “ConsumerView” product. Id. at ¶ 37-39, 57. The existence of this information was made public by UpGuard on December 19, 2017, and news stories regarding the information were published later that day. Id. Through these news stories, Plaintiffs became aware for the first time that Alteryx allegedly procured their information directly or indirectly from Experian, or that Experian was collecting, storing and selling behavioral information. Id.

Judge Selna found no obligation to disclose the behavioral data under the FCRA.

Experian argues that the CRFA does not require that Experian disclose the Behavioral Data under Section 1681g because it “does not bear on a consumer’s eligibility for credit, employment, or insurance, [and] its transmission does not constitute a consumer report.” Mot., 8. Plaintiffs argue that information does not need to “independently be a consumer report in and of itself, but must appear on a consumer report” and that if it is, it is subject to the disclosure requirements of Section 1681g. See Opp’n., 3-4, 20-21. Under Section 1681g, consumer reporting agencies are required to clearly and accurately provide consumers with all “information in the consumer’s file” upon their request subject to certain exceptions. Fundamentally then, the question the Court must answer is whether Plaintiffs theory of liability plausibly states  a claim under Section 1681g given that it is an attenuated theory that the ConsumerView product contains information derived in part from the File One database which itself contains information that “might” be used in a credit report and therefore is subject to disclosure requirements. This requires answering another question — is the ConsumerView data information in a consumer’s file? “The term ‘file’, when used in connection with information on any consumer, means all of the information on that consumer recorded and retained by a consumer reporting agency regardless of how the information is stored.” 15 U.S.C.A. § 1681a(g). However, the Ninth Circuit in Shaw v. Experian Info. Sols., Inc., clarified that a “consumer’s file includes ‘all information on the consumer that is recorded and retained by a [CRA] that might be furnished, or has been furnished, in a consumer report on that consumer.'” 891 F.3d 749, 759 (9th Cir. 2018) (citing Cortez v. Trans Union, LLC, 617 F.3d 688, 711-12 (3d Cir. 2010) (quoting Gillespie v. Trans Union Corp., 482 F.3d 907, 909 (7th Cir. 2007)). “A consumer, or credit, report is a CRA-prepared report that a CRA issues to third parties for certain qualifying purposes.” Id. at 755, n.3. The FCRA clarifies that: [t]he term “consumer report” means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for– (A) credit or insurance to be used primarily for personal, family, or household purposes; (B) employment purposes; or (C) any other purpose authorized under section 1681b of this title. 15 U.S.C.A. § 1681a(d)(1). Plaintiffs focus on to the word “might” in Shaw to argue that they only need to allege that the “information stored in File One, ConsumerView, or other databases that might be contained on a consumer report is subject to Section 1681g(a)(1)’s disclosure requirement.” Opp’n., 17-19. However, this Court agrees with the interpretation of the Steinmetz v. Am. Honda Fin. Court that noted that Shaw’s definition of a consumer file “does not open the door for every shred of information to be included in a consumer disclosure simply because there is some slight chance it might someday be in a consumer report.” 2019 WL 4415090, at *7 (D. Nev. Sept. 16, 2019) (appeal pending); see also Gillespie, 482 F.3d at 909-910 (explaining that the word “file” has a narrow meaning – “information included in a consumer report”). To find in the alternative would essentially mean that any and all information ever retained by a CRA even if it is not data that would appear in a credit report could be considered “consumer report” data. Plaintiffs alleging that information “might be furnished” must do more than make conclusory or speculative statements. They must show that defendants included similar information in a consumer report in the past or plan to do so in the future. See Gillespie, 482 F.3d at 909. No such, allegations exist here as to the Behavioral Data.2 Plaintiffs have provided no binding precedent for their apparent position that Behavioral Data constitutes information that might be in a consumer report. In Shaw the Court rejected an assertion that Experian was required to disclose upon a consumer request that Fannie Mae had mishandled its data because it was “not information retained by Experian in any credit report [and therefore,] falls outside the bounds of a ‘file’ for purposes of § 1681g(a).” 891 F.3d at 760. Similarly here, Behavioral Data is not alleged to be information retained for use in a credit report and therefore is not part of the consumer file