Texas Enacts Data Privacy and Security Act with Small Business Exception

Texas Gov. Greg Abbott on June 18 signed into law House Bill 4, the Texas Data Privacy and Security Act.  This makes Texas the 10th state to enact a comprehensive consumer data privacy law, following California, Virginia, Colorado, UtahConnecticutIowa, Indiana, Tennessee, and Montana.

The Act will go into effect July 1, 2024, except for a section related to authorized agents which will go into effect Jan. 1, 2025.

[article_ad]

Applicability

The Act applies to a person that:

  1. conducts business in Texas or produces a product or service consumed by residents of Texas;
  2. processes or engages in the sale of personal data; and
  3. is not a small business as defined by the United States Small Business Administration, except to the extent it sells sensitive data which requires consumer consent.

Exemptions

Exemptions include:

  1. financial institutions or data subject to the Gramm-Leach-Bliley Act;
  2. covered entities or business associates governed by the Health Insurance Portability and Accountability Act and the Health Information Technology for Economic and Clinical Health Act;
  3. nonprofit organizations;
  4. institutions of higher education;
  5. protected health information under HIPAA;
  6. personal information to the extent its collection, maintenance, disclosure, sale, communication, or use is regulated and authorized by the Fair Credit Reporting Act.

Consumer Rights

Consumers have the right to:

  1. confirm processing of their personal data and access such data;
  2. correct inaccuracies;
  3. delete personal data;
  4. obtain personal data provided by the consumer in a portable and readily usable format, if stored digitally;
  5. opt out of processing if for the purpose of targeted advertising, sale, or profiling.

Sensitive Personal Information

Sensitive personal data may not be processed without the consumer’s consent or, in the case of a known child, pursuant to the Children’s Online Privacy Protection Act.

Sensitive Data includes:

  1. personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status;
  2. genetic or biometric data that is processed for the purpose of uniquely identifying an individual;
  3. personal data collected from a known child; or
  4. precise geolocation data.

Contract Requirements

A contract between a controller and processor must include:

  1. clear instructions for processing data;
  2. the nature and purpose of processing;
  3. the type of data subject to processing;
  4. the duration of processing;
  5. the rights and obligations of both parties;
  6. a requirement the processor will ensure the confidentiality of the data;
  7. a requirement the processor delete or return all personal data to the controller as requested after the provision of the service is completed;
  8. a requirement the processor make available all information in the processor’s possession necessary to demonstrate compliance;
  9. a requirement the processor will allow and cooperate with reasonable assessments by the controller; and
  10. a requirement subcontractors be engaged pursuant to a written contract mirroring the processor’s requirements.

Data Assessments

Controllers must conduct and document a data protection assessment of each of the following processing activities:

  1. the processing of personal data for purposes of targeted advertising;
  2. the sale of personal data;
  3. the processing of personal data for purposes of certain profiling;
  4. the processing of sensitive data; and
  5. any processing that presents a heightened risk of harm.

Enforcement

There is no private right of action. Provided a person cannot cure a violation within 30 days, the attorney general may seek injunctive relief and a civil penalty not to exceed $7,500 for each violation.

Maurice Wutscher Impressions

This Act is similar to the non-California data privacy laws recently enacted but is unique in that its scope is not defined by volume thresholds, instead simply exempting small businesses except to the extent they sell sensitive data.

For a chart comparing the state comprehensive data privacy acts, and more information and insight from Maurice Wutscher on data privacy and security laws and legislation, click here.

Texas Enacts Data Privacy and Security Act with Small Business Exception
http://www.insidearm.com/news/00049226-texas-enacts-data-privacy-and-security-ac/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

Land O’ Lakes Director and Former NACARA President Named to Independent Standards Board

Both Mr. Thelen and Mr. Lund were recently approved to join the esteemed board, which is charged with the creation, review and amendment of certification requirements met by each collection agency member to earn Commercial Collection Agencies of America’s Certificate of Accreditation and Compliance.  The Standards Board meets periodically throughout the year to achieve its goal.  

[article_ad]

“Most assuredly, the unique skillset of each gentleman will be a marked benefit to the Independent Board, which has crafted the superior certification program in the industry, considered the platinum standard,” noted Annette M. Waggoner, Executive Director of Commercial Collection Agencies of America.  

Mr. Thelen is the Director of Enterprise Customer Financial Services at Land O’ Lakes, Inc, as well as its subsidiary Land O’Lakes Finance Company.  He is on the advisory board (and past Chairman) of both the National Manufacturers Deduction Resolution Group and the National Food, Health and Beauty Care Credit Group. 

“Mike’s appointment to the Standard Board is a great asset for the association, bringing both a wealth of knowledge from the order to cash discipline and a wealth of experience spanning across both supply chain and industry specific value points.  With Mike’s experience, the board continues to provide thought leadership and a customer centric focus in the delivery of key operational standards that exceed order to cash requirements.  We are extremely pleased to have Mike join in this capacity,” commented Matt Skudera, Standards Board Vice Chair and President/Chief Operating Officer of Credit Research Foundation.   

Mr. Lund is an attorney who held the position of Maine’s Superintendent of Consumer Credit Protection for more than thirty (30) years. In that role, he administered that state’s Fair Debt Collection Practices Act. His office applied for and received from the FTC (later, the CFPB) the only “exemption” from the federal FDCPA ever granted to any state.  He served as a member and chair of the Federal Reserve Board’s Consumer Advisory Council. He is a former president of the North American Collection Agency Regulatory Association, and the National Association of Consumer Credit Administrators. 

“Will brings decades of experience and a new perspective to the Standards Board.  His keen intellect and industry knowledge have already proven to be invaluable during his short time on the Board.  Given our charge and the work before us, thoughtful discussion and careful deliberation by each member is critical. Will is uniquely qualified to fill this role and we are thrilled to welcome him as our newest member of the Standards Board., “commented Christine Hayes Hickey, Standards Board Chair and President/Managing Partner of Rubin & Levin, PC.

A list of certified commercial collection agencies is located at www.commercialcollectionagenciesofamerica.com.

To contact the Commercial Collection Agencies of America, email Executive Director,

Annette M. Waggoner at awaggoner@commercialcollectionagenciesofamerica.com.

Land O’ Lakes Director and Former NACARA President Named to Independent Standards Board
http://www.insidearm.com/news/00049221-land-o-lakes-director-and-former-nacara-p/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

14 Calls in 22 Days is Reasonable, Says Court

Collecting debt can sometimes feel like a delicate balancing
act; debt collectors must navigate challenging situations with precision
and care. Getting a consumer on the phone to discuss their account can be
difficult, especially considering the concern of potential Fair Debt Collection
Practices Act (FDCPA) violations for calling too often. While that is true to
an extent, a recent North Carolina case highlights that reasonable calling is still
permitted despite general inconvenience or annoyance to the consumer.

In Brayton v. Alltran Financial, LP, 21-309 (W.D.
N.C. 2023), the consumer alleged that a debt collector violated the FDCPA by calling the consumer 14 times in 22 days. In response, the debt collector asked the court to issue a judgment in its favor because this call volume is reasonable and did not violate the FDCPA. 

The court agreed, and noted the following in its order granting Summary Judgment in favor of the debt collector: 

[article_ad]

  •  All  14 calls went unanswered, so at no point did the consumer ask the defendant to stop calling.
  • Once the consumer answered and asked the collector to stop, the account was put in a “cease” status, and no other attempts were made to contact the consumer.

  • The FDCPA was intended to address “abusive, deceptive, and
    unfair debt collection practices,” not eliminate reasonable and legal debt
    collection activity.

  • Whether the calls may have inconvenienced or bothered the
    consumer is not material to the analysis; and 

  •  [T]he FDCPA does not
    shield consumers from the “inconvenience and embarrassment that are natural
    consequences of debt collection.

Read the full Order here

insideARM Perspective:

Although the telephone calls, in this case, preceded Reg F, the case is still a breath of fresh air for the collections
industry. It’s important to remember that the 7-in-7 rule in Reg F is a presumption, so we still need cases to show what might, or might not be, presumed reasonable. This case illustrates that collectors can still make
their calls and be reasonably persistent in contacting consumers. While this
may seem like a minor victory, small wins are big wins in today’s debt
collection landscape, and this is surely a case to keep in your defense files.

14 Calls in 22 Days is Reasonable, Says Court
http://www.insidearm.com/news/00049213-14-calls-22-days-reasonable-says-court/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

Seventh Circuit Rules $3.95 in Postage Spent by Plaintiff to Respond to Second Validation Notice Sufficient to Establish FDCPA Standing

The U.S. Court of Appeals for the Seventh Circuit has ruled that a plaintiff in a putative class action had standing to assert FDCPA claims against the purchaser of her debt and the purchaser’s servicer based on the $3.95 she paid in postage to respond to a second validation letter after she had already responded to the first validation notice.

In Mack v. Resurgent Capital Services, L.P., the plaintiff had received an initial validation notice from the debt collector hired by the servicer of her debt.  The letter informed her that her credit card account had been placed for collection and that she owed $7,179.87.  It also identified the purchaser of her debt as the “current creditor.”  Within 30 days of receiving the letter, the plaintiff mailed a validation request to the debt collector, paying $6.70 in postage for priority mail and a $3.45 certified mail fee.  The plaintiff then received a second validation letter sent by the servicer that identified the purchaser of her debt as the “current owner.”  She sent a second validation request to the servicer for which she paid fifty cents in postage for regular mail and a $3.45 certified mail fee.

[article_ad]

Having never received validation of her debt from the purchaser, servicer, or debt collector, the plaintiff filed a class action lawsuit against the purchaser and servicer alleging violations of the FDCPA.  The plaintiff alleged that she was confused and alarmed by the second letter.  She claimed that the defendants had engaged in a deceptive collection practice because the second validation letter “would cause any consumer, let alone the unsophisticated consumer, to believe that she must yet again dispute the Debt despite the fact that such consumer had already submitted a valid dispute of the Debt.” 

The district court, treating the defendants’ motion to dismiss as a summary judgment motion, ruled that the plaintiff had failed to establish standing because the time and money spent to send the second validation request did not rise to the level of detriment required for FDCPA standing.  According to the district court, the second letter “did not adversely affect any interests Congress sought to protect through the FDCPA and instead effectively provided [the plaintiff] with another opportunity to dispute her debt if she failed to properly do so upon receipt of the first letter.”  The district court also vacated its previous order certifying the class.

As an initial matter, the Seventh Circuit indicated that because the district court should not have treated the defendants’ motion to dismiss as one for summary judgment, it would review the case as an appeal from a dismissal.  The Seventh Circuit found that the second letter had caused the plaintiff “to suffer a concrete detriment to her debt-management choices in the form of the expenditure of additional money to preserve rights that she had already preserved.”  According to the Seventh Circuit, “[m]oney damages caused by misleading communications from the debt collector are certainly included in the sphere of interests that Congress sought to protect.” 

The defendants argued that because the plaintiff spent the money to clear up her confusion, the cost was insufficient to establish standing.  While acknowledging that it has previously held that confusion is not itself an injury, the Seventh Circuit indicated that the plaintiff was not alleging that confusion was itself her injury.  Instead, she was alleging that her confusion caused her to act to her detriment, namely to spend extra money to preserve her right to seek validation, which she had been misled to believe she failed to do the first time.  According to the Seventh Circuit, the plaintiff had been misled to her financial detriment and “that the dollar cost was modest is irrelevant.”

The Seventh Circuit reversed the dismissal and remanded the case to the district court to redefine the previously certified class to include only those persons who had acted to their detriment upon receiving a second validation letter.  This restriction on class members is likely to substantially reduce the size of the class and could even mean that no class can be certified because so few people can satisfy this restriction.

Seventh Circuit Rules $3.95 in Postage Spent by Plaintiff to Respond to Second Validation Notice Sufficient to Establish FDCPA Standing
http://www.insidearm.com/news/00049210-seventh-circuit-rules-395-postage-spent-p/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

Collection Triggers: Debt Collectors’ Best Kept Secret [sponsored]

Optimizing your collection strategy is always critical, but getting things right can be especially pressing when faced with economic uncertainty and an increase in delinquencies. A data-driven prioritization strategy can help improve recovery rates while minimizing lost time and costs.

With Collection Triggers℠, you can better monitor and prioritize accounts to level up your collection efforts.

Challenges facing agencies and debt collectors

It’s important to recognize the challenges that agencies and debt collectors often struggle with. These include:

  • Managing their workforce: Dealing with an increased workload will be especially difficult for organizations that struggle to hire and retain staff.
  • Knowing who to contact: Traditional prioritization based on account age can be effective, but it isn’t necessarily the best option. Ideally, you can accurately and quickly identify a consumer’s ability to pay and offer appropriate treatment at the right time.
  • Maintaining correct contact information: Text messaging and social media are giving collectors more options. But you still need to consider consumers’ communication preferences and frequently confirm that you have the correct contact information.
  • Reducing costs and improving operational efficiencies: You might be asked to do more with less. It’s not an easy task, and you’ll need to carefully think through which investments offer a solid return on investment.

Agencies and debt collectors are tackling these challenges in different ways. But it’s clear that finding a solution that can improve recovery rates without increasing agents’ workloads is important.

What is Collection Triggers℠?

Experian’s Collection Triggers is an account monitoring tool that can be customized to notify you whenever there’s a “triggering” event on an individual’s credit profile.

Experian 6-28 article graphic

Triggers can include new employment, new contact information or a new credit line. But they can also be more granular, such as separate triggers for different positive improvements (e.g., a paid loan, paid auto loan or an account going from 60 or 120 days past due to current).

How can Collection Triggers improve the collections process?

You can use Collection Triggers throughout the recovery process — from early-stage delinquencies to post-judgment accounts — to strategically prioritize your outreach and increase profitability.

Having specific triggers is important, as you can define the triggers and monitoring criteria for your accounts. Experian can offer guidance on the best-fit triggers based on previous collectors’ experiences.

For example, we’ve found that payment-related triggers can be highly effective when collecting on bankcard accounts. These include when a consumer pays a different collection account, pays a charged-off account or brings an account current after being 120 to 180 days delinquent.

Bankcard is just one example — triggers are helpful in collecting on personal loans, medical debt, retail, and other trades. Such “positive improvements” indicate that the consumer may have a willingness to pay and available resources. Timing may be ideal to reach out to them about other outstanding obligations, as their financial situation has likely improved since your last contact attempt.

Triggers on contact data can also put a spotlight on accounts with a new phone number, address or employer. And the use of Collection Triggers offers a clear return on investment because it prompts collectors to take action on accounts that would otherwise go unworked. The passive monitoring of triggers also removes the need to repeatedly skip trace older accounts.

Experian helps collectors modernize and optimize operations

Collection Triggers is an effective, flexible and cost-efficient solution on its own. There’s no upfront cost for monitoring — you only pay when a trigger event you choose occurs. By taking the guesswork out of managing your portfolio, you can improve right-party contact rates and deploy a powerful, efficient collection strategy.

The recovery process is time-consuming and expensive. Using Collection Triggers can help avoid common pitfalls when managing your portfolio and serve as a best practice for handling aged inventory. Relevant events will be pushed to you in real time for accounts you want monitored and you only pay for what you use. 

Contrast this with the alternative, which repeatedly processes the same files in an exhaustive search for attributes on all your accounts every month. This cumbersome approach involves pulling in reams of data while searching for nuggets of interest. You pay for every search, even when the results provide no benefit to you.

Experian also offers additional solutions for collectors. For instance, our skip tracing tools draw from proprietary credit data and alternative data on over 245 million consumers, including unlisted phone numbers and rental payments data, to verify and update consumers’ contact information.

Or leverage the latest analytical approaches that segment and identify consumers who are likely to self-cure, require a reminder or are unable to pay. We also help agencies and collectors use machine learning and artificial intelligence to automate collections, enhance customer satisfaction and streamline processes.

Contact Experian to learn more about Collection Triggers and our debt recovery solutions.

[article_ad]

Collection Triggers: Debt Collectors’ Best Kept Secret [sponsored]
http://www.insidearm.com/news/00049215-collection-triggers-debt-collectors-best-/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

OneTouch Direct Celebrates Employee Appreciation Day with a Two Car Giveaway

TAMPA, Fla — OneTouch Direct, a global business process outsourcing company, during its celebration of National Employee Appreciation Day, thanked its valued team members by hosting a fun filled day of special activities, featuring classic arcade games, catered food, employee recognition awards, and multi-level prizes. The highlight of the day, of the year, was the company’s NEW car giveaway. Two of OneTouch Direct’s top employees each won a brand-new car; after winning, they went to the dealer and picked out their car with all expenses paid by OneTouch Direct. Additionally, multiple eligible employees across our US centers were awarded their choice of a large screen TV, Grill, Kitchen Aid Stand Mixer, Laptop, and/or an iPhone with accessories.

“National Employee Appreciation Day is a time for all of us to show our sincere appreciation for the contributions made by our loyal employees,” said Chris Reed, EVP of OneTouch Direct. “We welcome this opportunity to thank all our employees for the excellence they bring to our company every day.” 

OneTouch Direct prides itself on creating a positive, collaborative work environment that actively promotes each person’s strengths and capabilities through strong leadership, opportunities for growth and development, and a good work/life balance. We actively recognize and support the unique value each employee brings to our company. Our people first philosophy creates a culture of everyday recognition within the organization, genuinely celebrating employees all year long.

About OneTouch Direct

OneTouch Direct, parent company for OTD Americas, its wholly owned subsidiary, is a US based business process outsourcing company delivering best-in-class customer experiences (CX) for some of the world’s largest and most loved brands. Rooted in our passion and deep expertise, OneTouch Direct creates unified brand experiences that break the rules and foster meaningful relationships. For over 20 years, our people-centric, data driven outsourcing solutions have powered better revenues and profitability across the full customer life cycle. For more information visit onetouchdirect.com.

OneTouch Direct Celebrates Employee Appreciation Day with a Two Car Giveaway
http://www.insidearm.com/news/00049218-onetouch-direct-celebrates-employee-appre/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

FTC Submits Annual Enforcement Report to CFPB

On June 7, the FTC announced that it submitted its 2022 Annual Financial Acts Enforcement Report to the CFPB. The report covers FTC enforcement activities regarding the Truth in Lending Act (TILA), the Consumer Leasing Act (CLA), and the Electronic Fund Transfer Act (EFTA). Highlights of the enforcement matters covered in the report include, among other things:

  • Automobile purchase and financing. The report discussed an April 2022 settlement with a car dealership group, which resolved claims that the dealership group added on unwanted fees to consumers and allegedly failed to include details on repayment and annual percentage rates in advertising mailers. The settlement led to a redress sent to consumers.

  • Payday lending. The report highlighted a settlement reached with a payday lending enterprise for allegedly overcharging consumers millions of dollars. The FTC claimed the enterprise made deceptive statements about the terms of their loan agreements and payments and withdrew funds from consumers’ accounts without consent. The order resulted in consumers receiving refunds.

  • Credit repair and debt relief. The report included a settlement with the operators of a student loan debt relief scheme, who were charged with “falsely promising consumers it could lower or eliminate student loan balances, illegally imposing upfront fees for credit repair services, and signing consumers up for high-interest loans to pay the fees without making required loan disclosures in violation of the FTC Act and TILA.” The order also resulted in consumers receiving refunds.

  • Other credit. The report detailed the first case involving the Military Lending Act, where a jewelry company was charged with allegedly charging military families illegal financing and using deceptive sales practices. Specifically, the company was charged with deceptively claiming that financing jewelry through the company would increase the consumer’s credit score, misrepresenting that their protection plans were required, and adding plans without the consumer’s consent. The company was also charged with failing to provide clear terms for preauthorized electronic fund transfers. The settlement required the company to provide refunds, stop collecting debt, and cease operations and dissolve.

Additionally, the FTC addressed rulemaking that is underway. The agency highlighted an impending ban on junk fees and bait and switch advertising tactics, and briefly discussed two advance notices of proposed rulemaking issued last October that would crack down on junk fees and fake reviews and endorsements. The FTC also highlighted the Military Task Force’s work on consumer protection issues.

FTC Submits Annual Enforcement Report to CFPB
http://www.insidearm.com/news/00049209-ftc-submits-annual-enforcement-report-cfp/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

A Closer Look at the Gramm-Leach-Bliley Act (GLBA): Updates to the Safeguards Rule

Protecting personal and financial information is critical in today’s digital age. Where data has its own intrinsic value and where data breaches and cyberattacks are a risk for every business, the Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA) provides financial institutions, including those in the accounts receivable management industry, with guidance on how to safeguard customer information.

The existing Safeguards Rule provided financial institutions with much flexibility and discretion when determining what kinds of safeguards were best for their organizations and risks. With the amendments which go into effect on June 9, 2023 financial institutions now have a more prescriptive recipe for what those safeguards need to be.

What is the Gramm-Leach-Bliley Act (GLBA)?

The Gramm-Leach-Bliley Act, or GLBA, is a federal regulation to control how financial institutions collect, store, and transmit consumer information. Although GLBA was enacted by the Federal Trade Commission (FTC) in 1999, changes have been anticipated for the last few years.

In October 2021, the FTC announced new amendments coming to the Standards for Safeguarding Customer Information, known as the “Safeguards Rule,” and an issuance of a final rule, referred to simply as the “Final Rule.” Originally set to go into effect in 2022, financial institutions—a designation that has also been updated—now need to prepare for the changes or risk non-compliance and its consequences before they go into effect on June 9, 2023.

What is the Safeguards Rule?

The Safeguards Rule took effect January 10, 2021, and its requirements were first set to go into effect beginning December 9, 2022, but the FTC announced it would extend the deadline for financial institutions to develop, implement, and maintain a comprehensive information security program by June 9, 2023.

There are five overarching modifications to the existing Safeguards Rule:

  • Provides covered financial institutions with more guidance on how to develop and implement specific aspects of an overall information security program

  • Improves the accountability of these security programs, such as requiring financial institutions to designate a qualified individual responsible for overseeing, implementing and enforcing the program

  • Exempts financial institutions that collect information on fewer than 5,000 consumers from the requirements of a written risk assessment, incident response plan, and annual reporting to the board of directors

  • Expands the definition of “financial institution” within the scope of the Safeguards Rule – see the expanded definition in the next section below

  • Includes several other definitions and related examples in the amended Safeguards Rule itself in an effort to make it more self-contained and to enable readers to understand its requirements without referencing the FTC’s Privacy of Consumer Financial Information Rule

Along with these updates to the Safeguards Rule, let’s examine a few other specifications of the updates.

What are other updates to the Safeguards Rule?

The expanded scope of financial institutions that are subject to the Safeguards Rule is significant. Under the new Final Rule, “financial institutions” now include entities engaged in activities that the Federal Reserve Board determines to be incidental to financial activities, such as:

Financial Institutions subject to the Safeguards Rule

It is important to note that the Final Rule does not apply to national banks, savings and loan institutions, and federal credit unions, as these institutions are not subject to the FTC’s jurisdiction.

The Final Rule requires these covered financial institutions to comply with specific new requirements, such as:

  • Encrypt all customer information held or transmitted in transit over external networks and at rest

  • Multi-factor authentication for any individual accessing any information system, unless the use of reasonably equivalent or more secure access controls has been approved in writing by a qualified individual at the financial institution

  • Conduct periodic written risk assessments, and the results of such risk assessments should drive the information security program

  • Create procedures for evaluating, assessing or testing the security of externally developed applications used to transmit, access or store customer information

  • Set procedures for secure disposal of customer information no later than two years after the last date the information is used

  • Implement policies, procedures, and controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users

  • Provide personnel with security awareness training, and provide information security personnel with training to address relevant security risks; and that key information security personnel take steps to maintain knowledge of changing information security threats and countermeasures

  • Written incident response plan designed to promptly respond and recover from any security event affecting the confidentiality, integrity, or availability of customer information

  • Qualified individual to regularly, and at least annually, report in writing to an organization’s governing body (e.g., board of directors) regarding the status and material matters of the information security program

  • Regularly test or otherwise monitor the effectiveness of the safeguards’ key controls, and conduct required penetration testing annually and vulnerability assessments at least every six months and whenever there are material operational or business changes

Given the expanded definition of “financial institutions,” some of these organizations may be unfamiliar with the extent of these requirements, and even those familiar with GLBA previously must be ready to comply or face the consequences.

What are the penalties for non-compliance with GLBA?

Whether it’s GLBA, Regulation F, or any of the numerous state laws, companies can face serious penalties for compliance failures—monetary, reputational, and even criminal. When it comes to GLBA, non-compliance penalties include:

Penalties for non-compliance with GLBA

Section 5 of GLBA grants the FTC the authority to audit policies to ensure they are developed and applied fairly—all the more reason to follow the Safeguards Rule’s provisions of self-audits and testing. 

A Closer Look at the Gramm-Leach-Bliley Act (GLBA): Updates to the Safeguards Rule
http://www.insidearm.com/news/00049207-closer-look-gramm-leach-bliley-act-glba-u/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

Revealing the Blind Spots: A Critical Review of the CFPB’s Issue Spotlight on Chatbots in Consumer Finance

As the evolution of Artificial Intelligence (“AI”) dominates headlines throughout the globe, financial institutions have been paying attention. Not surprisingly, so has the Consumer Financial Protection Bureau (“CFPB” or “Bureau”).  Just as financial sector companies feverishly ramp up their use of AI to complete, augment, and personalize customer service interactions, the CFPB is pumping the proverbial brakes.

On June 6, the Bureau published an Issue Spotlight (“Spotlight”) titled “Chatbots in Consumer Finance,” cautioning against the industry’s reliance on advanced chatbots, saying it can lead to violations of consumer finance laws, harm consumers by providing inaccurate information and diminish customer service. The Spotlight indicates that automated chatbots, especially those fueled by AI and related technology, will be a new area of focus for the CFPB, in terms of both supervision and enforcement.

The underlying technologies used in these customer-facing chatbots include large language models, AI, generative machine learning, neural networks, and natural language processing (NLP). These technologies enable chatbots to simulate human-like responses and automatically generate chat responses using text and voice.

The consumer finance industry has widely adopted chatbots as a cost-effective alternative to human customer service and continues to do so at a breakneck pace. According to the research conducted by the CFPB, approximately 37% of the U.S. population engaged with a bank’s chatbot last year, and CFPB indicates this number is projected to grow to 110.9 million users by 2026. The adoption of chatbots has not only resulted in significant cost savings for financial sector firms, but studies indicate that it has also improved consumer experiences. Therefore, the growth rate of chatbot adoption in the financial industry is expected to continue increasing exponentially.

The Spotlight, however, presents the agency’s pessimistic view surrounding the use of chatbots for providing customer service in the consumer finance industry. The Spotlight highlights several risks associated with the use of chatbots including: (1) Risk of noncompliance with federal consumer financial laws; (2) Risk of harming people; (3) Erosion of trust and deterrence from seeking help; and (4) Frustrating customers.

A critical question is how the Bureau came to this conclusion. Was it based on a scientific study, a focus group, or mere conjecture? The Spotlight claims to be based on a significant number of complaints filed by consumers on the CFPB’s complaint portal. However, a simple search of the complaint database reveals that, as of the date of this alert’s publication, there are only 64 total complaints that mention chatbots or artificial intelligence in searchable complaint narratives over the past five years. During the same time period, 50,341 complaints regarding poor customer service experiences (unrelated to chatbots) were filed with the Bureau. Hence, only 0.13% of the poor customer service complaints filed were in relation to bad experiences using a chatbot. If analyzed against the total number of complaints filed with the CFPB this number drops to a mere 0.0024%.

The CFPB’s report points to compliance issues with the use of chatbots in the consumer finance industry. The Spotlight suggests that chatbots have difficulty recognizing and resolving consumers’ disputes. Surprisingly, however, the Spotlight’s supporting evidence is actually based on a consumer’s experiences and frustrations while interacting with a human customer agent. For example, on page 10 of the Spotlight, CFPB presents a consumer complaint as evidence of “parroting” by chatbots. However, a review of the full narrative of the complaint indicates that a “human” agent, not a chatbot, was regurgitating the same information without resolving the consumer’s actual issues.

The Spotlight further argues that the use of chatbots can be problematic for consumers with limited English proficiency. However, human customer service agents can be more prone to language barriers but newer generations of chatbots, are known to support over 50 different languages, which go well beyond the capacity of a human brain.

Next, the Spotlight suggests that AI-powered chatbots pose significant security risks through impersonation and phishing scams. While the mass adoption of these generative AI technologies can certainly increase the frequency of phishing scams, these security risks are still mostly initiated by humans, and AI can also be programmed in a countervailing measure to push back on many types of data breaches. Further, a recent large-scale study from Hoxhunt documents that the scams initiated using chatbots were 69% less effective than those initiated by humans. Earlier this year, the CFPB itself experienced a significant security breach triggered by human error. It is worth considering that a properly trained AI system might have helped the CFPB avert this breach by blocking the transfer of unauthorized data to an external email. As highlighted by Hoxhunt’s study, the CFPB could and should focus on offering security training programs to consumers going forward.

Lastly, the Spotlight also suggests that chatbots lead consumers in “continuous loops of repetitive, unhelpful jargon or legalese without an offramp to a human customer service representative.” This “doom loop” according to the Spotlight, might lead to customer frustrations and dissatisfaction. However, the conclusions drawn by CFPB are seemingly unsubstantiated. By their own records discussed earlier, the CFPB highlights that 37% of the U.S. population is estimated to have interacted with a bank’s chatbot in 2022. If the CFPB’s account of user frustrations with chatbots is accurate, then over 98 million people have interacted with chatbots in the past year. This would certainly result in more than 64 complaints to CFPB. Further, on page 7 of the Spotlight, CFPB highlights that Bank of America’s chatbot, Erica, had been used by nearly 32 million customers with over 1 billion interactions in 4 years since its launch. Even with such a high volume, a simple search for complaints on CFPB’s complaint portal reveals only four bad customer service experiences related to artificial intelligence with Bank of America during the same four-year period.

Finally, it’s important to note that the CFPB itself has been using rule-based AI in its online complaint portal. Upon providing their personal information on the complaint portal, consumers are asked to select categories and subcategories before they are provided with a text editor to file their complaints. The organization of these complaints can only be done by rule-based AI. Additionally, the CFPB also uses rule-based chatbots to support their telephone-based customer service. The Bureau is therefore not immune from enjoying the benefits of automated communication. Perhaps the CFPB might even benefit from the use of more sophisticated models that further leverage AI, so as to avoid the risk of consumer frustration that could be escalated when only rule-based models (aged technology) are used.

The CFPB’s all-or-nothing approach is counter-productive at the early stage of the AI debate. Most consumer-facing companies have been instituting a hybrid approach to AI where the simple or programmatic consumer issues are handled by chatbots which frees up human customer agents’ time to deal with more complex issues. The CFPB makes no mention of the fact that many financial services entities and institutions are using AI to enhance compliance; what is sometimes called “AI for good.” It is essential to balance the need for innovation and progress with the need to protect consumers and ensure fair practices. Undoubtedly, AI is not immune from mistakes, and it certainly instills a tremendous fear of the unknown if it is not used in the right way. The task of protecting consumers requires an honest conversation of the good and bad that surrounds AI, along with a measured approach to the current outcomes and opportunities. Unrealistic hypotheticals may ultimately result in consumers losing out in the end. Striking the right balance is a complex challenge that regulators, companies, and consumer advocates must work together to solve – it will be worth the effort.


Revealing the Blind Spots: A Critical Review of the CFPB’s Issue Spotlight on Chatbots in Consumer Finance
http://www.insidearm.com/news/00049203-revealing-blind-spots-critical-review-cfp/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

Empire Credit and Collections Inc Partners with Skit.ai to Accelerate its Revenue Recovery and Ease its Customers’ Debt Resolution

NEW YORK, NY — Skit.ai, a global conversational voice AI vendor for the Account Receivable Management (ARM) industry in the U.S., today announced that it has deployed its Augmented Voice Intelligence Platform within Empire Credit and Collections Inc., a leading Debt Collection Agency based in NYC, offering No Recovery and No Fee Debt Collections. This partnership enabled the agency to automate its outbound calls with conversational voice AI, accelerating revenue recovery and enhancing customer experience (CX).

As with any debt collection agency in this market, Empire Credit and Collections Inc. had critical concerns about its connectivity, agent productivity, and the projected impact of these issues on its collections rate. While uncovering innovative strategies and optimizing workforce inefficiencies, they sought to deploy Skit.ai’s conversational Voice AI to mitigate these concerns. Thus far, the solution has automated over 400,000 calls with an RPC of 35% and has achieved a key milestone of 63% engagement rate, which has contributed to optimizing the company’s Revenue Recovery, CX, and Agent Productivity in a short span.

“The influence of cutting-edge technologies like Skit.ai’s conversational Voice AI has been the determining factor in addressing critical concerns in a turbulent market like the one we face today; it enables us to remain competitive and capitalize on market opportunities. This collaboration has proved valuable; it has allowed us to connect with a large pool of customers simultaneously while mitigating redundant processes and improving our agent productivity. Additionally, the solution has accelerated our revenue recovery and enhanced our customer experience, proving to be a valuable investment.” stated Peter Roberto Jr, Director of Operations at Empire Credit and Collection Inc.

The deployment has brought about positive outcomes for Empire Credit and Collections Inc and its customers; it has facilitated an unprecedented automation that boosts agents’ efficiency while enabling a customer-centric approach to collections. It allows them to deliver actual business returns while identifying and planning for future risks and value drivers.

Commenting on the partnership’s success, Sourabh Gupta, Founder and CEO of Skit.ai, Stated. “Empire Credit and Collection Inc utilized our solution to its fullest potential in tackling issues related to connecting with delinquent customers and boosting agent productivity. By incorporating a powerful conversational Voice AI system, they accomplished an outstanding milestone of achieving a 63% engagement rate on over 400,000 calls. This groundbreaking approach improved their financial performance and elevated the overall customer experience, establishing a new standard of effectiveness.”

Schedule a meeting to learn more about how Skit.ai can help you accelerate revenue recovery with higher efficiency and infinite scale.

About Empire Credit and Collection Inc: 

Empire Collection Agency is the nation’s leading Debt Collection Agency offering No Recovery, No Fee Debt Collections! New York-based Empire Credit and Collections Inc collects delinquent accounts using its vast network of debt collection experts. Our personal collections experience and communications with other agencies and law firms convinced us there are better ways of collecting your debts faster and with a higher collection rate. https://empirecollectionagency.com

About Skit.ai: 

Skit.ai is the ARM industry’s leading Conversational Voice AI company, enabling collection agencies to streamline and accelerate revenue recovery. Skit.ai’s Compliant, Configurable, and Easy-to-deploy solution enable enterprises to automate nearly one million weekly consumer conversations. Skit.ai has been awarded several awards & recognitions, including Disruptive Technology of the Year 2022 by CCW, Stevie Bronze Winner 2022 by The International Business Awards, and Gold Globee CEO Awards 2022. Skit.ai is headquartered in New York City, NY.  https://Skit.ai

Empire and Skit logo for 6-22

Empire Credit and Collections Inc Partners with Skit.ai to Accelerate its Revenue Recovery and Ease its Customers’ Debt Resolution

http://www.insidearm.com/news/00049205-empire-credit-and-collections-inc-partner/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance