CFPB Director Says New Data Rights Rule Will "Dramatically Improve Privacy and Security"

CFPB Director Rohit Chopra touted the data protections provided by the new Personal Financial Data Rights rule.

The rule, adopted on October 22, 2024, requires financial institutions, including banks, credit unions and other financial service providers, to make consumers' financial data available to the relevant consumer upon request and in a secure, electronic format. (See previous coverage.)

In remarks at Georgetown University's DC Fintech Week, Mr. Chopra said that the CFPB studied how Big Tech and large banks misuse the information by harvesting vast amounts of data—including search history, geolocation and personal financial information—to create detailed consumer profiles. He highlighted that the practice, known as "surveillance pricing," enables companies to manipulate pricing or target consumers based on their behavior. For example, he said, a rideshare company could charge more if it knows the rider just received a larger paycheck.

Mr. Chopra said the rule eliminates practices like screen scraping, reduces data vulnerabilities and prevents companies from misusing consumer data for purposes beyond what was originally intended. He outlined how the new rule will enforce stricter data security standards, minimize data collection and give consumers more control over how their financial data is used. In addition, he said banks and FinTech's will be empowered to block access to third parties that do not meet minimum standards, thereby protecting consumer data falling into the hands of unqualified entities.