CFPB to Issue Outline of Rule Governing Data Brokers

Agency plans regulations surrounding collection and sale of consumer information.

The CFPB next month will issue an outline and possible components of a rule governing data brokers that sell consumers’ personal financial information to other sources, bureau director Rohit Chopra announced Tuesday.

“It’s critical that there’s some accountability when it comes to misuse or abuse of our private information and activities,” Chopra said at a White House event that focused on the issue.

“The CFPB is considering a proposal that would generally treat a data broker’s sale of data regarding, for example, a consumer’s payment history, income, and criminal records as a consumer report, because that type of data is typically used for credit, employment, and certain other determinations,” he added.

Backstory and Context

Earlier this year, the CFPB issued a request for information on data brokers, which garnered more than 7,000 responses.

National credit union trade groups submitted comments on the issue and warned the bureau not to restrict the availability of consumer information in ways that might impact the types of services financial institutions can offer consumers.

In his White House remarks, Chopra said his agency did an initial inquiry into the practices of data brokers in the surveillance industry. As a result, CFPB officials decided to launch a rulemaking to ensure that brokers are not misusing the data they obtain.

“During our formal inquiry, the CFPB learned more about the significant harms—from the identification of victims for financial scams to the facilitation of harassment and fraud,” he said.

What Will the Rule Cover?

Chopra explained that in its rule under consideration, the CFPB will define a data broker that sells certain types of consumer data as a “consumer reporting agency.”

“The CFPB is considering a proposal that would generally treat a data broker’s sale of data regarding, for example, a consumer’s payment history, income, and criminal records as a consumer report, because that type of data is typically used for credit, employment, and certain other determinations,” he said.

That, he added, would trigger requirements for accuracy and handling disputes, as well as misuse of the data.

A second proposal would address confusion about whether so-called “credit header data” qualifies as a consumer report.

Much of the data used by the brokers include identifiers like name, date of birth and Social Security number that are contained in consumer reports generated by the credit reporting companies, Chopra noted.

When Would It Go Into Effect?

The agency expects to issue an outline of its proposals next month and bureau officials will meet with small business representatives—a requirement under federal law.

Chopra said the CFPB plans to solicit comment on a proposed rule next year.

Credit Union Groups Call For Caution

Whatever the agency issues should not inhibit the ability of credit unions to offer services to members, Madison Rose, CUNA’s director of advocacy and counsel for payments and technology, told the CFPB in a comment last month.

She also asked that the definition of “data broker” exclude financial institutions as defined in federal law.

“Financial institutions’ use of consumers’ personal information is strictly governed by federal laws and regulations,” she wrote.

Rose added that “Information gained from third-party relationships is critical for credit unions preventing money laundering, the financing of terrorism, and carrying out bank secrecy act compliance including customer identification and beneficial ownership requirements.”

In responding to the request for information, Andrew Morris, NAFCU’s senior counsel for research and policy, said that credit unions rely on data brokers to obtain information about members or prospective members.

“Often access to consumer data is necessary to better understand discrete market segments and provide competitive financial products and services,” he wrote.

The information provided by data brokers also enables credit unions to assess the credit risk of consumers who do not have a traditional credit score, Morris added, noting that, “For NAFCU members that use non-traditional data, most use it in tandem with traditional credit reports when determining creditworthiness.”

Support From Consumer Group

However, in its response, the National Consumer Law Center urged the CFPB to aggressively police the data broker industry.

“The data broker industry is vast, growing, opaque, and intrusive. It can cause significant harm to consumers, which is hard to detect and fix because of lack of transparency,” the NCLC wrote.