Observing that data brokers, data aggregators, and platforms share a characteristic common with consumer reporting agencies – i.e., they collect and sell personal data – the Consumer Financial Protection Bureau issued a formal Request for Information (“RFI”) on March 15, 2023. Broadly, the CFPB wants to learn (1) about these new business models that sell consumer data, (2) whether they are covered by the Fair Credit Reporting Act (“FCRA”), and (3) whether they result in market abuses and harm to consumers. This is a prelude to rulemaking under FCRA.
The Director of the CFPB views data brokers as “surveillance” companies. He is concerned that the obligations imposed by FCRA on some data brokers (credit bureaus and background screening firms) should also be imposed on other data brokers in the industry (wholesalers, for example). He suggests that the broad definitions given to “consumer report” and “consumer reporting agency” may permit his agency to issue regulations that would enfold these other data brokers into the regulatory scheme imposed on background screening companies and credit bureaus.
He poses 29 questions in his RFI. Of interest to this readership are the following:
- No. 14. What data broker practices provide benefits to people? What are those benefits?
- No. 18. What controls do data brokers implement in order to protect people’s data and safeguard the privacy and security of the public? Are these controls adequate?
- No. 18(1). What controls exist related to who can purchase or obtain information from data brokers? Are these controls adequate?
Possible answers to these questions might include informing the Bureau that some wholesalers impose limitations and restrictions on purchasers of their data, including ~
- Obtaining warranties from the purchaser that it will first ensure the accuracy and completeness of the information before using it in a consumer report;
- Requiring their customers to inform them if a consumer disputes the accuracy of the data supplied;
- Auditing their customers to assure themselves that the customer is using the data as agreed upon in its contract; and
- Deleting consumer data within a relatively short period of time after using it.
The comment period closes June 13, 2023.
Practical Steps:
(1). Monitor comments between now and June 13th. Website: www.regulations.gov. Docket ID: 2023-0020. (Note: the docket is not available as of the publication of this blog.)
(2). Work with your trade association to identify the benefits that flow to consumers and their employers and landlords from the existence of data brokers that are not treated as consumer reporting agencies under FCRA.
(3). Inform your Congressional representatives that adversarial rulemaking from the CFPB will harm consumers, employers, and landlords in their state.
~ Todd
This publication is provided only for educational purposes; it should not be relied upon as legal advice, and it should not be used, in whole or in part, as a basis for establishing practices or policies, nor should it be used for resolving disputes or managing risk. Every reader’s circumstance is unique, and legal advice should be obtained only from a lawyer with whom the reader has established an attorney-client relationship. Copyright 2023 © Higey Law LLC. All material contained within this publication is protected by copyright law and may not be reproduced without the express written consent of Higey Law.