Consumer Financial Protection Bureau Proposes Rule to Regulate Data Brokers Under Fair Credit Reporting Act
The Consumer Financial Protection Bureau (CFPB) today announced a proposed new rule that all data brokers be regulated under the 1970 Fair Credit Reporting Act (FCRA), a federal law that protects the use and privacy of credit data and requires information in consumer reports (informally known as credit reports) to be accurate. The CFPB previously foreshadowed its move in a September 2023 outline.
As proposed, the rule would significantly broaden the scope of the FCRA, which currently applies to credit reporting agencies (CRAs), such as Equifax Inc. and TransUnion, and entities that report credit data to CRAs.
According to the CFPB, it developed the proposed rule based on extensive market monitoring, which the CFPB says shows that data brokers “routinely sidestep” the FCRA by claiming they aren’t subject to its requirements while selling the kind of consumer personal and financial data that the law addresses. The proposal coincides with the FTC’s announcements of its actions to ban certain data brokers from harvesting and selling location data collected from consumers.
The CFPB’s proposal would amend Regulation V, which implements the FCRA, as follows:
- Treat data brokers as CRAs;
- Provide that an entity is a CRA if it assembles or evaluates information about consumers, including by collecting, gathering, or retaining; assessing, verifying, or validating; or contributing to or altering the content of such information;
- Deem “header” data (identifying information like an individual’s name, address, Social Security number, and phone number) to be a consumer report;
- Provide that a communication by a CRA of information about a consumer is a consumer report if the information is used for an FCRA-covered purpose — regardless of whether there is evidence that the consumer reporting agency knew or expected that the information would be used for such a purpose;
- Provide that “legitimate business needs” for the consumer report does not include marketing purposes; and
- Require a new consumer authorization that must be on a separate document that is signed by the subject consumer and includes the specific purpose for the report along with other disclosures.
CFPB officials emphasize that the proposed rule would address various concerns raised by law enforcement and national security officials. Less clear is the extent to which the proposal could chill broader innovation, such as fintech companies that seek to expand the way individuals and businesses can borrow and repay the money they need, including bringing financing options to traditionally underserved populations by facilitating the consideration of information from non-traditional sources to determine creditworthiness. The CFPB has expressly requested comments on the implications of its proposal for technology providers and platforms used by CRAs and others in mortgage lending and other industries.
Questions have been raised about whether the proposal is likely to be finalized. On the one hand, the incoming Trump administration has vowed to decrease regulation and expressed hostility toward certain CFPB agendas and rules. On the other hand, the regulation of data brokers has bi-partisan support in Congress.
The CFPB’s proposed rule will be open for public comment until March 3, 2025.
