Last Week, This Morning

March 25, 2024

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an “Amicus Brief(ly)¹” comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters – CARLAW®, HouseLaw®, InstallmentLaw™, PrivacyLaw®, and BizFinLaw™ – provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

Utah’s governor recently signed into law Senate Bill 149, which establishes liability for the use of artificial intelligence to interact with a consumer if that use is not properly disclosed to the consumer. Specifically, the new law requires a person who uses, prompts, or otherwise causes AI to interact with a consumer in connection with any act administered and enforced by the Division of Consumer Protection to clearly and conspicuously disclose that the consumer is interacting with AI and not a human. The law also requires a person who provides the services of a regulated occupation to prominently disclose when an individual is interacting with AI in the provision of regulated services. Under the new law, "regulated occupation" means “an occupation regulated by the Department of Commerce that requires a person to obtain a license or state certification to practice the occupation.”

The new law also creates the Office of Artificial Intelligence Policy within the Department of Commerce. The office is responsible for creating and administering the Artificial Intelligence Learning Laboratory Program. The purpose of the program is to: (1) analyze and research the risks, benefits, impacts, and policy implications of AI technologies to inform the state regulatory framework; (2) encourage development of AI technologies in the state; (3) evaluate the effectiveness and viability of current or proposed regulation of AI technologies; and (4) produce findings and recommendations for legislation and regulation of AI. An entity that uses or wants to use AI technology in the state may apply for regulatory mitigation according to criteria and procedures outlined by the office. To receive regulatory mitigation, an applicant must demonstrate that it meets certain eligibility requirements. The office may grant, on a temporary basis, regulatory mitigation to an applicant by entering into a regulatory mitigation agreement that must specify: (1) limitations on the scope of the participant's AI technology, including: (a) the number and types of users; (b) geographic limitations; and (c) other limitations to implementation; (2) safeguards to be implemented; and (3) any regulatory mitigation granted to the participant.

Amicus brief(ly): With the recent advancements in AI, we can expect to see more of this kind of statute coming out of the states, requiring disclosure to consumers about whether they’re talking to a person or a machine. Utah’s new AI Policy office is likely to suggest some form of expansion of the scope of this law over time based on the information it gathers about the use of AI and its impact on the marketplace. It’s early to tell, but the creation of the AI Policy office gives the state a productive and not necessarily intrusive means for studying the uses of AI in connection with consumer interactions.

On March 18, for the first time in 15 years, the Federal Housing Administration announced increases in the loan limits for its Title I Manufactured Home Loan program in order to expand financing options for borrowers seeking to purchase or refinance manufactured homes and the lots on which they sit. The increased loan limit amounts use new indexing methodologies for calculating the program’s limits, which were announced in a final rule – Indexing Methodology for Title I Manufactured Home Loan Limits - published in the Federal Register on February 28, 2024. The final rule establishes indexing methodologies using data from the U.S. Census Bureau to calculate future loan limits for manufactured home loans, manufactured home lot loans, and manufactured home and lot combination loans. The newly increased loan limits will apply to FHA case numbers assigned on or after March 29, 2024. The FHA will review the program’s loan limits on an annual basis and adjust them if needed.

Amicus brief(ly): This overdue change to the Title I Manufactured Home Loan Program thresholds is an important step in providing access to credit for lower-income consumers. It also addresses the potential for further increases in pricing by building in the tried-and-true coupling of pricing with an index that tracks actual housing costs. This is a welcome change for the manufactured housing market.

The Federal Trade Commission announced that it will hold a virtual informal hearing on April 24, 2024, at 10:00 a.m. ET on its proposed Rule on Unfair or Deceptive Fees, which the FTC deems “junk fees.” The hearing will be open to the public and viewable on the FTC’s website. Certain interested organizations will have the opportunity to provide oral statements, which will be limited to 15 minutes each. However, these organizations may also submit written documents to the FTC within 14 days after publication of the notice announcing the hearing in the Federal Register.

On October 11, 2023, the FTC issued its proposed rule, which would prohibit unfair or deceptive practices relating to fees for goods or services, including fees charged in connection with consumer financial products and services. Specifically, the proposed rule would prohibit businesses from misrepresenting the total costs of goods and services by omitting or hiding mandatory fees in advertising prices and misrepresenting the nature and purpose of fees.

A link to the hearing webcast will be posted shortly before the date of the hearing on the FTC’s website.

Amicus brief(ly): This concept in the FTC’s proposed rule, and the subject of the hearing, is pretty consistent with a number of state laws and some federal laws requiring more prominent disclosure of the “fine print” conditions related to product and credit pricing. For example, the Truth in Lending Act requires additional disclosures in credit advertising if an advertisement includes a trigger term, like the number or amount of any payments, and the amount of the finance charge. And a number of state laws require providers to include disclosures about pricing that are sufficient to allow the consumer seeing the advertisement to understand what conditions, if any, there are on the advertised product or credit price (e.g., finance charge rate of 5.9% with 20% downpayment). Many times, those state rules also include a proximity requirement in advertisements or credit disclosures so that the information about those conditions is easy to find. The difference, of course, is the recent pejorative labeling by the government of just about any fee as a “junk fee.” The hearing is an opportunity to provide a focused statement to the Commission about fee disclosures, which can be bolstered with written comments to try and get to a sensible result in the FTC’s final rule on the subject.

Utah’s governor recently signed into law Senate Bill 25, which modifies provisions relating to consumer lender notifications and commercial financing transactions. Specifically, the new law amends the Utah Consumer Credit Code to require consumer lenders to submit to the Commissioner of Financial Institutions evidence of registration through the Nationwide Multistate Licensing System and Registry. The new law also amends the Commercial Financing Registration and Disclosure Act to amend the definition of “broker” and to repeal certain provisions relating to disclosures for commercial financing transactions.

The new definition of "broker" means “a person who: (i) for compensation or the expectation of compensation, obtains a commercial financing product or an offer for a commercial financing product from a third party that, if executed, would bind the third party; and (ii) communicates the offer described [above] to a business located in the state.” "Broker" does not include: “(i) a provider; or (ii) a person whose compensation is not based or dependent on the terms of a specific commercial financing product that the person obtains or offers.”

With respect to disclosures for commercial financing transactions, the new law retains the requirement that, before consummating a commercial financing transaction, a provider must disclose the terms of the commercial financing transaction in accordance with applicable law and rules adopted by the Commissioner of Financial Institutions. But the amended law sensibly removes the requirement that, in addition to the above disclosure requirement, for a commercial open-end credit plan, a provider make the disclosures “after any disbursement of funds that occurs after the parties consummate the commercial financing transaction” and “no later than 15 days after the last day of the calendar month in which the disbursement of funds occurs.”

The new law also removes the requirement that a provider disclose in connection with each commercial financing transaction the amount of funds the provider pays to a broker in connection with the transaction.

Amicus brief(ly): Utah does not play with its UCCC very often. The relatively minor changes requiring UCCC registrants to demonstrate that they are registered with the NMLS is curious because consumer finance providers do not file their notifications in Utah through the NMLS and would only have to be registered with the NMLS for mortgage lending or other business. The changes to the commercial financing law appear to be a little bit of clean-up – especially the repeal of the requirement to make disclosures in connection with every advance under an open-end credit plan that, by its nature, contemplates repeat advances.

The Federal Communications Commission recently created a voluntary cybersecurity labeling program for Internet of Things (“IoT”) consumer products that communicate over wireless networks. According to the FCC’s news release, “qualifying consumer smart products that meet robust cybersecurity standards will bear a label - including a new ‘U.S. Cyber Trust Mark’ - that will help consumers make informed purchasing decisions, differentiate trustworthy products in the marketplace, and create incentives for manufacturers to meet higher cybersecurity standards.” Certain program highlights include:

• “The U.S. Cyber Trust Mark logo will initially appear on wireless consumer IoT products that meet the program’s cybersecurity standards.
• The logo will be accompanied by a QR code that consumers can scan for easy-to-understand details about the security of the product, such as the support period for the product and whether software patches and security updates are automatic.
• The voluntary program will rely on public-private collaboration, with the FCC providing oversight and approved third-party label administrators managing activities such as evaluating product applications, authorizing use of the label, and consumer education.
• Compliance testing will be handled by accredited labs.
• Examples of eligible products may include home security cameras, voice-activated shopping devices, internet-connected appliances, fitness trackers, garage door openers, and baby monitors.”

The FCC also issued a notice of proposed rulemaking seeking public comment on additional potential disclosure requirements by product manufacturers, including whether software or firmware for a product is developed or deployed by a company located in a country that presents national security concerns and whether customer data collected by the product will be sent to servers located in such a country.

Amicus brief(ly): The big question we have coming out of this announcement is how long it will be until the voluntary labeling program becomes a mandatory disclosure requirement. In the short term, the voluntary disclosure program will likely benefit providers whose customer base is informed about cybersecurity issues and who might choose one product over another based on whether that product bears the U.S. Cyber Trust Mark. But concerns about different information privacy and data security standards internationally may lead to a more formal disclosure requirement. We’ll see what the FCC does with this following the comment period.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.