The Consumer Financial Protection Bureau (CFPB) has been at the forefront of discussions surrounding the evolving role of data brokers in today’s digital economy. In particular, Director Rohit Chopra recently announced that the CFPB expects to develop a new rule under the Fair Credit Reporting Act (FCRA) broadening the definition of “Consumer Reporting Agency” to include data brokers. This recent announcement and discussions surrounding it offer a glimpse into the agency’s regulatory direction and its potential ramifications for the data broker industry. More importantly, development of a rule substantially broadening the scope of FCRA will have wide implications for the consumer lending industry.
The backdrop of Director Chopra’s comments
Director Rohit Chopra’s remarks at a White House roundtable on data brokers did not arise in a vacuum. The data broker industry has witnessed exponential growth over the past decade. As lenders increasingly rely on data-driven insights to drive leads, optimize operations, check for identity theft and fraud, and tailor consumer experiences, data brokers have become indispensable partners. And in turn, these companies’ capabilities in aggregating, analyzing, and distributing data have unlocked new avenues for lenders and have arguably increased the availability of credit. However, this rapid expansion has also drawn regulatory scrutiny.
For instance, in March of this year, the CFPB issued an RFI seeking detailed information about the data broker ecosystem. As part of the RFI, the Bureau asked about the type of data that brokers obtain, aggregate, and sell. In particular, the RFI defined “data broker” as “firms that collect, aggregate, sell, resell, license, or otherwise share consumers’ personal information with other parties.” In a press release accompanying the RFI, Director Chopra stressed that “[m]odern data surveillance practices have allowed companies to hover over our digital lives and monetize our most sensitive data . . . . Our inquiry will inform whether rules under the Fair Credit Reporting Act reflect these market realities.”
CFPB’s recent announcements: A closer look
At the White House roundtable, Director Chopra unveiled the CFPB’s intention to introduce a rule under FCRA targeting data brokers. Accompanied by a detailed FAQ, the announcement underscored the growing influence of data in shaping decisions, especially when powered by artificial intelligence and machine learning algorithms.
Delving into the RFI insights
Director Chopra’s highlighted proposals warrant a deeper examination:
(1) Defining data brokers: The potential classification of a “data broker” as a “consumer reporting agency” could have profound implications. This would mean a broader spectrum of data—from payment histories to criminal records—would fall under stricter regulatory oversight. For the industry, this translates to enhanced data verification processes, more robust dispute resolution mechanisms, and a reevaluation of strategies.
In addition, reclassification of certain data brokers as consumer reporting agencies could have a serious effect on lenders, data aggregators, lead generators, and other businesses who deal in or utilize consumers’ personal information. For instance, under FCRA, a consumer reporting agency must ensure that a person who requests a consumer report from the consumer reporting agency has a “permissible purpose.” Broadening the definition of “consumer reporting agency” would subject data brokers to these rules and requirements.
(2) Credit header data: In addition to broadening the definition of “consumer reporting agency,” the CFPB appears to be seeking to define “credit header data” as consumer report information. This would be contrary to court decisions that have concluded that “credit header data” is not consumer report information. According to Director Chopra, much of the credit reporting ecosystem relies on personally identifying information taken from traditional credit reporting agencies such as date of birth and social security numbers, that is, “credit header data.” The Bureau seeks to “clarify the extent to which credit header data constitutes a consumer report, reducing the ability of credit reporting companies to impermissibly disclose sensitive contact information that can be used to identify people who do not wish to be contacted, such as domestic violence survivors.”
What this means to you
The CFPB’s stance signals a shift towards a more regulated data broker landscape. While the rulemaking process is often a slow one, for businesses, this means:
Proactive Compliance: Firms will need to invest in compliance infrastructure, ensuring they are ahead of the curve if new regulations are proposed.
Review of Current Contracts and Practices: Data brokers and lenders that use them could consider proactively reviewing contracts and practices to determine the impact of these proposed changes to FCRA.
Collaborative Engagement: Perhaps most importantly, industry participants and their trade groups should engage with regulatory bodies, industry peers, and other stakeholders to help shape regulations that support innovation while safeguarding consumer interests.
Next month, the Bureau will publish an outline of its proposals and alternatives for the proposed rule. Small businesses will have an opportunity to provide feedback, especially through the Small Business Review Panel under the Small Business Regulatory Enforcement Fairness Act (SBREFA). After this feedback phase, the CFPB will release the proposed rule for public comments. The finalized rule is anticipated in 2024.
Contact us
If you have questions regarding the CFPB’s recent announcement, please contact Christopher Friedman, Marci Kawski, Susan Seaman, Leslie Sowers, David Stauss, Alex McFall, or your Husch Blackwell attorney.