On March 15, 2023, the Consumer Financial Protection Bureau
(CFPB) launched an inquiry into the business
practices of companies that "collect, aggregate, sell, resell,
license, or otherwise share consumers' personal information
with other parties" – collectively called "data
brokers." Noting the significant expansion of the data broker
industry since enactment of the Fair Credit Reporting Act (FCRA),
the CFPB intends to assess whether – and likely how –
entities using new business models and technologies to collect and
sell consumer data may be covered by FCRA.
Comments on the CFPB's request for information (RFI), due by June 13,
2023, will inform the CFPB's "planned rulemaking"
under FCRA, which was identified in the CFPB's fall 2022 regulatory agenda.
Overview of the RFI
The RFI seeks information regarding the data broker market and
consumers' experiences – both positive and negative
– in light of the explosion of the market.
On the market side, the CFPB is looking for information on the
sources from which data brokers collect information, the type of
information collected and shared, the method of collection, whether
people can avoid having their information collected, controls
implemented by data brokers to ensure the quality and accuracy of
data collected, and the potential harms and benefits data broker
practices bring to consumers. From a consumer risk perspective, the
CFPB is seeking information about data accuracy and privacy, as
well as issues accessing, viewing, correcting and removing data
collected by such brokers.
What to expect
The CFPB has devoted substantial attention to so-called financial surveillance companies and the potential for consumer harm stemming from their collection and dissemination of consumer information. It therefore comes as no surprise that the RFI focuses on consumer concerns over being "tracked and surveilled" by data brokers.
The CFPB's inquiry comes on the heels of an advance notice of proposed rulemaking by the Federal Trade Commission (FTC) seeking public comment on commercial surveillance and data security practices. We expect the CFPB and FTC to take a collaborative approach to the protection of consumer data and the scrutiny of companies that collect and share consumer information going forward.
The RFI also coincides with the CFPB's January 2023 issuance of market monitoring orders to data aggregators in connection with its ongoing Section 1033 rulemaking pertaining to consumer access to financial records. Entities that engage in the collection and sharing of consumer data should monitor developments related to the CFPB's Section 1033 rulemaking, which could also be informed by responses to the RFI.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.