The Trump administration seems to be walking straight into a pair of Fair Credit Reporting Act violations by placing immigrants whom it knows to be alive on the Social Security Administration’s Death Master File. The Death Master File is a list compiled by the Social Security Administration of people Social Security believes to be dead (generally based on the filing of death benefit claims with Social Security, so it is not at all a complete list of who is actually dead). Creditors and other users of consumer reports regularly use the Death Master File, either directly or through a consumer reporting agency, as part of credit granting, employment, or insurance decisions—you don't want to be doing business with someone who is dead (and that might indicate that the living person with whom you are dealing isn't who they say they are). So, Death Master File issues end up being consumer reporting issues and fall under the Fair Credit Reporting Act, violations of which can not only create substantial private civil liability, but they can also be enjoined in a suit by a state attorney general.
FCRA Violation 1: Knowingly Furnishing Inaccurate Information
The FCRA prohibits any “person” from furnishing "any information relating to a consumer to a consumer reporting agency if the person knows or has reasonable cause to believe that the information is inaccurate.” Telling consumer reporting agencies that someone is dead when you know they are not falls squarely within that prohibition. The term “person” is defined in the FCRA as including “government or governmental subdivision or agency,” and the Supreme Court recently ruled unanimously that the FCRA applies to the government when it furnishes information to consumer reporting agencies and that the government is not protected by sovereign immunity from FCRA suits.
Knowingly furnishing inaccurate information does not itself produce private civil liability, but it can be enjoined in an action by a state attorney general: the FCRA specifically authorizes this, and even if it didn’t, a state attorney general could probably achieve the same result through the Consumer Financial Protection Act. (A violation of the FCRA is separately a violation of the CFPA, and I cannot immediately see why the FCRA’s remedial limitations would apply to a separate violation of the CFPA, although perhaps there is an issue with inconsistent definitions of "person" between the statutes.)
FCRA Violation 2: Failure to Follow Reasonable Procedures to Assure Maximum Possible Accuracy of Information
The FCRA imposes a duty on “consumer reporting agencies” to “follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” The federal government is, arguably, a consumer reporting agency itself.
SCOTUS has long told us to read statutes literally, and the literal application here is straightforward: the FCRA defines a “consumer reporting agency” as “any person which for monetary fees…regularly engages…in the practice of assembling…consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties”. So we need: (1) a person, (2) regular assembly of credit information on consumers, and (3) provision of the information to third parties for a fee. We’ve already seen that the government is a “person” for FCRA purposes. The government is regularly assembling consumer death information, which is absolutely relevant for credit granting decisions. And the federal government sells the Death Master File to third parties for a fee.
There is some older caselaw saying that the federal government is not a consumer reporting agency, but it's readily distinguishable: it's mainly old (and therefore starts with legislative history, rather than text) and it isn't in the context of the federal government selling data (the only circuit-level decisions relate to FBI files).
Taking the FCRA on its face, then, the federal government is a consumer reporting agency and therefore subject to FCRA’s requirement that it "follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” Knowingly adding living people to the Death Master File is hardly following reasonable procedures for assuring maximum possible accuracy.
Willful failure to have procedures to assure maximum possible accuracy is a FCRA violation that results in private civil liability, including statutory damages. A single violation concerning hundreds of thousands of people could readily result in hundreds of millions of dollars of liability. (I have not been able to find any controlling authority on whether there would be only a single violation or a separate violation each day. If it is anything other than a single violation, this could turn into an astounding amount of liability very, very fast if the administration does not stop.)
The liability issue is secondary, however, as any state attorney general could sue for injunctive relief on the matter and save the federal government a lot of money.
Collateral Damage
There is also some collateral damage to messing with the Death Master File: any consumer reporting agency that relies on it now does so at its own peril. It’s hard to square reliance on the Death Master File with the duty of having procedures to assure maximum possible accuracy when you know that thousands of people who are not in fact dead have deliberately been added to the Death Master File. We’ll find out how risk adverse consumer reporting agencies are, but the Death Master File’s usefulness as a credit screening tool might have been substantially impaired.