Section 201.01 “Definitions,” defines terms used throughout the rule.

Section 201.02 “Registration,” requires that every consumer credit reporting agency that assembles, evaluates, or maintains a consumer credit report on one thousand or more New York consumers within the previous twelve-month period must register with the Superintendent of Financial Services (“Superintendent”). Registrants shall be subject to examination by the Superintendent as necessary.

Section 201.03 “Acting Without a Registration,” prohibits any individual or entity required to be registered from assembling, evaluating, or maintaining a consumer credit report on any consumers located in New York State if they have not registered with the Superintendent. Further prohibits any Department of Financial Services (“DFS”) regulated entity from paying any fee or transmitting any information to any consumer credit reporting agency who fails to register as required.

Section 201.04 “Information Reporting Requirements,” requires annual reporting of information requested by the Superintendent, and such other regular reporting as the Superintendent may require. Additionally, the Superintendent may address an inquiry to a consumer credit reporting agency required to be registered under the Part in relation to it assembly, evaluation, or maintenance of any consumer credit report on any consumers located in New York. The information disclosed by consumer credit reporting agencies is deemed confidential and not subject to disclosure unless its determined necessary for the Superintendent or DFS to carry out their powers and duties conferred by law.

Section 201.05 “Revocation and Suspension of a Registration,” authorizes the Superintendent to refuse to renew, revoke, or suspend the registration of any consumer credit reporting agency if, after notice and hearing, the superintendent determines that the registrant or any member, principal, officer, director, or controlling person of the registrant, has engaged in any of the enumerated improper conduct.

Section 201.06 “Prohibited Practices,” sets forth certain conduct in which a consumer credit reporting agency may not engage.

Section 201.07 “Cybersecurity,” sets forth that consumer credit reporting agencies are deemed covered entities for the purpose of Part 500 of 23 NYCRR. The section further sets forth transition periods specific for consumer credit reporting agencies to come into compliance with Part 500.

Section 201.08 “Authority of the Superintendent Preserved,” states that nothing in this Part can be construed to limit or affect the Superintendent’s lawful authority.

Section 201.09 “Severability,” states that in the event a specific provision of the rule is adjudged invalid, such judgment shall not impair the validity of the remainder of the rule.

A revised Regulatory Impact Statement (“RIS”) is not required for the adoption of new Part 201 to 23 NYCRR because the non-substantive revisions to the regulation do not require a change to the previously published RIS.

A revised Regulatory Flexibility Analysis for Small Businesses and Local Governments (“RFA”) is not required for the adoption of new Part 201 to 23 NYCRR because the non-substantive revisions to the regulation do not require a change to the previously published RFA.

A revised Rural Area Flexibility Analysis (“RAFA”) is not required for the adoption of new Part 201 to 23 NYCRR because the non-substantive revisions to the regulation do not require a change to the previously published RAFA.

A revised Job Impact Statement (“JIS”) is not required for the adoption of new Part 201 to 23 NYCRR because the non-substantive revisions to the regulation do not require a change to the previously published JIS.

As a rule that requires a RFA, RAFA or JIS, this rule will be initially reviewed in the calendar year 2021, which is no later than the 3rd year after the year in which this rule is being adopted.

The Department received a number of comments to the proposed Part 201 of NYCRR 23 concerning the regulation of Credit Reporting Agencies (“CRAs”). The commenters included industry members, trade groups, consumer groups, and individual consumers. Having considered each of these comments, the Department has made a number of changes to the final regulation, none of which, individually or collectively, materially alter the purpose, meaning, or effect of the regulation.

Comments were made with respect to 23 NYCRR Part 201 sections 201.01 (definitions); 201.02 (regarding registration requirements); 201.03 (regarding acting without a registration); and 201.04 (regarding information reporting requirements); 201.05 (regarding revocation and suspension of a registration); 201.06 (regarding prohibited practices); and 201.07 (regarding cybersecurity requirements).

Some commenters raised objections to the legal authority of the Department to promulgate this regulation. These commenters further asserted that the regulation as proposed would violate federal law and thus would be preempted. One commenter also raised various state and federal constitutional objections to the regulation.

The Department has considered the legal arguments raised in these comments and has found them to be without merit, particularly given the clarifications made in the final regulation. Among other powers and responsibilities that provide a firm basis for this regulation, the Superintendent has clear and unquestionable statutory authority to take actions to protect consumers of financial products and services in this State and that is the primary purpose of the regulation. See, e.g., N.Y. Financial Services Law § § 102, 201, 202, 301, 408. The regulation adequately protects any Constitutional rights that a CRA has in relation to the matters in the regulation, and is not violative of any provision of the state or federal constitutions. Further no portion of the regulation is in conflict with, or otherwise preempted, by federal law. To the extent necessary, the Department has made clarifications in the final regulation that make this fact even more clear. The regulation has been promulgated in complete compliance with all statutory requirements and the provisions of the regulation are in accord with all requirements of state law.

The Department addresses each of the comments in full in the complete version of the assessment of public comments, which will be posted on the Department’s website. Where appropriate, the Department made certain non-substantive revisions, as discussed in the complete version of the assessment.