CFPB Offers Proposals for a Rulemaking on Personal Financial Data Rights
Commentary by Michael A. Kleinman
The CFPB outlined various proposals and alternatives under consideration for a rulemaking on personal financial data rights. (See also, previous coverage.)
In the outline, the CFPB said that it is considering proposals to (i) empower consumers to transfer assets from one service provider to another if their current provider does not provide a satisfactory level of service, (ii) allow customers more freedom over how their data is used and (iii) prevent third parties from reselling authorized data for alternative use.
In an accompanying "High Level Summary and Discussion Guide," the CFPB stated that the proposals address: (i) coverage of data providers who would be subject to the proposals under consideration; (ii) recipients of information, including consumers and authorized third parties; (iii) the types of information that would need to be made available; (iv) how and when information would need to be made available, including when information is made available to consumers directly and to third parties authorized to access information on their behalf; (iv) third party obligations; (v) record retention obligations; and (vi) an implementation period.
The outline is to be considered by a panel to include, among others, the Small Business Administration's Chief Counsel for Advocacy and the Office of Information and Regulatory Affairs in the Office of Management and Budget, whichl will subsequently publish a report on its findings. CFPB Director Rohit Chopra said that he expects the report to be made public in early 2023.
Commentary
The proposal comes at a time when financial institutions are grappling with increased cyber-attacks and enforcement actions related to retaining too much data for too long and failing to implement appropriate identity theft prevention programs. Although the proposal contains its own limitations on data collection, use, and retention, the broad data portability and consumer request rights contemplated threaten to increase the attack surface for financial institutions, complicate retention policies and programs, and will lead to increased compliance and technology resources for financial institutions.
Related Articles
-
CFPB Director Rohit Chopra intends to "activate a dormant authority" under the Consumer Financial Protection Act to give consumers control over the financial data they maintain with banks, and allow them to transfer their information to another financial institution.
