2012 was a year of heightened consumer protection enforcement activity by federal regulators. The Consumer Financial Protection Bureau (“CFPB”) exercised its authority to enforce federal consumer protection laws by entering into three consent decrees with credit card issuers. Two imposed fines and reimbursement penalties against the issuers in excess of $200 million for deceptively advertising aftermarket products. The Federal Trade Commission (“FTC”) came down on five auto dealers for deceptive advertising as well, entering into 20-year consent decrees, that will require the five dealers to have their advertising and compliance procedures audited every other year by an outside auditor with any violations potentially incurring fines of $16,000 each. The FTC also brought its first Safeguards Rule action against an auto dealer in Georgia, entering into another 20-year settlement and requiring oversight and outside audits of the dealer’s privacy, data protection, and data destruction practices. Again, the ante is $16,000 per violation.
What seemed to emerge in consumer finance generally in 2012 was a much more aggressively pro-consumer attitude by all of the federal regulators including banking regulators who collaborated with the CFPB on the three credit card issuer consent decrees. The FTC had never previously brought enforcement actions against dealers for deceptive advertising or Safeguards violations, and their doing so shows that the FTC is actively monitoring what dealers are doing, both online and in the real world. The FTC also sent out information subpoenas seeking data about spot delivery practices and dealer rate markups to many dealers to gather information. Recall that in 2011 the FTC held three roundtable hearings on dealer financing procedures and alleged wrongful practices to consumers.
Credit discrimination was a top issue for the U.S. Department of Justice (DOJ) and the CFPB in 2012 and will likely continue to be so again in 2013. In one case, a California lender settled a credit discrimination action with the DOJ. The DOJ then drilled down to identify the dealers that had originated the discriminatory contracts and brought an Equal Credit Opportunity Act (ECOA) credit discrimination violation against the dealer as well. The dealer got no protection from the fact that the lender had settled.
Both the DOJ and CFPB have prioritized credit discrimination for 2013. Both agencies use the “disparate impact” or “effects test” to prove credit discrimination. Under this theory, intent to discriminate or even knowledge of discrimination is irrelevant. If a creditor’s practices result in worse terms to similarly situated consumers of a protected class (race, sex, religion, marital status, etc.), then the class is deemed to have been discriminated against. It’s a purely statistical analysis and often focuses on dealer rate markups. In one case, the DOJ alleged that as little as a 5BP markup differential was statistically significant to prove a disparate impact theory of credit discrimination.
The CFPB has been studying “buy-here-pay-here” dealers for close to a year now. Expect some type of action—probably an enforcement proceeding—against a buy-here-pay-here dealer, very possibly one located in close proximity to a military base. Protecting service members from creditor abuse is a priority for the CFPB, and it was the Defense Department that attempted to bring franchised dealers within the CFPB’s supervisory authority by arguing in 2010 that the conduct of auto dealers located near military bases was a threat to national security.
The CFPB has indicated it will regulate more by enforcement actions than by writing rules. Its Director, Richard Cordray, said that would be the case with “abusive trade practices,” a new form of violation from the Dodd-Frank Act, that focuses on taking advantage of a consumer’s lack of understanding or trust in a creditor to act in the consumer’s best interests. It would not be surprising for the FTC to take a more expansive view of its authority to prohibit “unfair and deceptive acts and practices” under Section 5 of the FTC Act to cover abusive practice-type behavior and use an enforcement action against an auto dealer to do so.
The re-election of President Obama makes it unlikely that the trend toward aggressively protecting consumers will lessen. Although the CFPB has no supervisory or enforcement authority over franchised dealers, it is likely the FTC will move in step with actions taken by the CFPB against buy-here-pay-here or other independent dealers over which the CFPB does have jurisdiction. The FTC also has its own priorities and Safeguards, and data security seem to be close to the top of the list.
Now would be a good time to review your Safeguards plan particularly as hacking and online threats continue to multiply. The dealer in Georgia was cited by the FTC for allowing customer names to be exposed to a “P2P” (person-to-person) file sharing application in which members of the P2P network share and download from each other music, games, videos and other files. The FTC warned about P2P networks in February 2011 and the P2P network to which the dealer’s customer files were exposed enabled any user in the network to download the non-public personal information of approximately 96,000 consumers. The morale is to know what programs have been downloaded to your system, delete any P2P or other risky applications, and eliminate the ability to download consumer information onto remote devices like USB drives or external hard drives. The wide use of cell phones to access dealer servers also can pose security problems if the devices are not properly configured.
Social media is becoming an increasingly widespread way for customers to find and share information. The rules for advertising on social media are not different from advertising in other media. Truths in Lending’s “triggering terms” require you to disclose certain information if you disclose other information and deceptive advertising is prohibited in all media. In the FTC’s consent decrees with the five dealers for deceptive advertising, the FTC staff trolled the Internet and found the offensive ads on YouTube. No consumers had filed complaints. Advertising does not have to actually deceive a consumer to be unlawful. It only needs to have the potential to do so.
Attorneys general were given broader powers under the Dodd-Frank Act to enforce federal as well as consumer laws. There were numerous $100,000-plus settlements by dealers with attorneys general in states like Massachusetts, Washington, and New York. State-starved coffers will make attorneys general look to dealer advertising as the “low-hanging fruit” for violations and enforcement. Make sure your ads are literally true and do not leave a deceptive sting. The FTC and AGs are watching especially online.
Look for a more activist FTC following the lead of the CFPB in 2013 and raise your own compliance awareness. The FTC is out there and watching auto dealers for privacy, Safeguards, advertising and unfair and deceptive conduct. They are sharing complaint information with the CFPB and attorneys general. So 2013 will not be the year to play fast and loose with compliance. As seen from 2012, the penalties can be long and harsh.
Randy Henrick is associate general counsel and lead compliance counsel for DealerTrack, Inc. This article is intended for information purposes only and does not constitute the giving of legal or compliance advice to any person or entity.The information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations from a knowledgeable attorney or compliance professional licensed to practice in your state.
