As we predicted here, the Consumer Financial Protection Bureau (CFPB or Bureau) last week proposed new and, in some cases, streamlined rules governing what mortgage servicers must do after a borrower becomes delinquent. The proposed rules incorporate some pandemic-era practices, such as allowing servicers to offer assistance without a comprehensive review of the borrower’s financial situation. According to the CFPB, the new rules would require mortgage servicers to prioritize loss mitigation over foreclosing, reduce paperwork requirements, improve communication with borrowers, and ensure critical information is provided in the borrowers’ preferred language.

As discussed here, on February 3, 2023, an Illinois federal court dismissed a case brought by the Consumer Financial Protection Bureau (CFPB or Bureau) in 2020 against Townstone Financial, Inc., a Chicago mortgage lender, for alleged violations of the Equal Credit Opportunity Act (ECOA). The CFPB had accused Townstone of discouraging prospective African American applicants in the Chicago metropolitan area from applying for mortgages.

On July 5, the California Privacy Protection Agency (CPPA) published a Notice of Proposed Rulemaking regarding Data Broker Registration pursuant to Senate Bill 362 (the Delete Act). The Delete Act requires the CPPA to establish an accessible deletion mechanism. This mechanism allows a consumer, through a single verifiable consumer request, to request that every data broker delete any personal information related to that consumer held by the data broker or associated service provider or contractor. The stated aim of the proposed rulemaking is to clarify and enhance the registration process for data brokers.

The California Department of Financial Protection and Innovation (DFPI) has once again modified its proposed rulemaking on earned wage access (EWA) products. As discussed here, this spring the Office of Administrative Law (OAL) rejected the proposed regulations for failure to comply with the clarity standard of the Administrative Procedure Act (APA) and failure to follow the required APA procedures. These new modifications attempt to address those concerns.

Dear Mary,

One of our employees recently fell victim to a phishing attack, allowing unauthorized access to their email account for a brief period. To be safe, we reset everyone’s passwords and terminated all active sessions. We’re now in the process of hiring a law firm to determine if we need to notify anyone about the incident. It’s taking a little longer to get them engaged, but I’m hoping to have this done soon. In the meantime, is there anything else we should be considering?

– Not Entirely Clueless in Connecticut

On July 1, amendments to Florida’s Consumer Finance Act took effect. Among other things, the amendments raise the maximum tiered interest rates on consumer finance loans, increase the grace period before late fees can be imposed from 10 to 12 days, require licensees to offer free credit education courses to borrowers at the time a loan is made, provide for the suspension of certain collection activities in the event of a disaster, and require branches of businesses making consumer finance loans to obtain a license.

Both houses of the New Jersey Legislature recently passed Assembly Bill No. 3861 (AB 3861), known as the Louisa Carman Medical Debt Relief Act. The legislation’s stated aims are to prevent undue financial hardship and protect patients from aggressive debt collection practices. Medical debt in general and how and whether it can be included in consumer reports has been a hot topic at the state and federal level. We have written on recent developments regarding medical debt here, here, here, and here.

A U.S. District Court in the Eastern District of Missouri recently dismissed a lawsuit under the Fair Debt Collections Practices Act (FDCPA), finding that two letters sent to the plaintiffs’ attorney did not constitute harassment or abuse under 15 U.S.C. § 1692d.