The CFPB recently proposed a rule that would restrict the sale of the sensitive personal data of consumers by certain companies, termed “data brokers”. The proposed rule would amend Regulation V to include such data brokers in the definition for “consumer reporting agencies” which would impose on them all of the same accuracy requirements, free provision of their information to the consumer who is the subject of the report and to maintain safeguards against misuse of the information.
The bureau states its goal in proposing the rule is multi-fold, including protecting against national security risks, criminal exploitation of individuals, as well as protection against physical violence, stalking, or other public safety risks such as the targeting of law enforcement personnel by use of their personal financial data. By treating data brokers as consumer reporting agencies, the information those purveyors sell would be subject to the Fair Credit Reporting Act (“FCRA”) and its protections. The proposal would also require separate, explicit authorization from consumers before a data broker would be able to obtain or share their personal information.
In its press release the CFPB stated it is basing its proposal “on extensive market monitoring that revealed widespread evasion of consumer protections.” Examples include use by foreign actors of financial data to target military members for blackmail, and the purchase of a federal judge’s home address that led to the murder of her son when she was targeted for assassination using the purchased information. The CFPB is targeting data brokers because the information they sell is the very same information Congress intended FCRA to protect, yet they are able to argue they are not subject to FCRA’s protections. The proposed rule will make clear that consumers’ sensitive financial information must be protected by these actors the same as other consumer reporting agencies.
The proposed rule would do that by adding an official interpretation for the meaning of “assembling or evaluating” used in the FCRA’s definition of “consumer reporting agency”. The FCRA defines a consumer reporting agency as “any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.” 15 U.S.C. § 1681a(f).
The proposed interpretation would identify specific activities that could be considered “assembling or evaluating”. The proposed rule would also expand the information that is considered a consumer report under FCRA by including the information commonly collected and sold by “data brokers”, which would also include what the industry commonly terms “credit header” data or personally identifying information without including other credit information such as accounts, their status and payment history. This information is commonly used for prescreened credit offers whereby a consumer reporting agency provides credit header data for persons meeting certain credit criteria, such as a specific score range, payment history, etc., without providing the supporting detail. The proposed rule would include the collection of this information and the persons who collect it and sell it as activities which makes those persons a consumer reporting agency under FCRA.
The rule is currently only a proposed rule, with comments requested through March 3, 2025. However, with the upcoming presidential transition and expected changes to executive agencies, including the CFPB, the future for this proposed rule is unclear.
