The CFPB has issued a request for information about business models that collect and sell consumer data, such as data brokers, data aggregators, and platforms. The RFI is intended to provide the CFPB with insight into the full scope of the data broker industry about which, according to the CFPB, “there is still relatively limited public understanding of their operations and other impacts.” More specifically, the CFPB plans to use the information obtained through the RFI to assess whether the companies using these business models are covered by the Fair Credit Reporting Act or other statutory authorities and to learn about consumer harm and any market abuses (which according to the CFPB has been identified by financial institutions, consumer advocates, and others to include “significant privacy and security risks, the facilitation of harassment and fraud, the lack of consumer knowledge and consent, and the spread of inaccurate information.”) Comments on the RFI must be received by the CFPB by June 13, 2023.
In the RFI, the CFPB uses the umbrella term “data brokers” to describe businesses that “collect, aggregate, sell, resell, license, or otherwise share consumers’ personal information with other parties.” The term encompasses companies that act as first-party data brokers and interact directly with consumers as well as third-party data brokers with whom consumers do not have a direct relationship. It also includes firms that specialize in preparing employment background screening reports and credit reports. In describing the activities of data brokers, the CFPB states that they “collect information from public and private sources for purposes including marketing and advertising, building and refining proprietary algorithms, credit and insurance underwriting, consumer-authorized data porting, fraud detection, criminal background checks, identity verification, and people search databases.”
The RFI is divided into two sections. One section is titled “Market-level inquiries” that asks questions about the overall data broker market. The other second is titled “Individual inquiries” that asks questions about consumers’ direct experiences with data brokers.
Curiously, the RFI does not mention the Advance Notice of Proposed Rulemaking issued by the Bureau in October 2020 in connection with its rulemaking to implement Section 1033 of the Dodd-Frank Act. Section 1033 requires consumer financial services providers to give consumers access to certain financial information and data aggregation services are a major focus of the ANPR. The Bureau issued a SBREFA outline in October 2022 and in its Fall 2022 rulemaking agenda, estimated that it would issue a SBREFA report in February 2023.
In August 2022, eight national trade groups filed a petition with the CFPB urging it to engage in rulemaking to define larger participants in the market for data aggregation services. In their petition, the trade groups asserted that the CFPB “should ensure that data aggregators and data users that are larger participants in the aggregation services market—not just banks and credit unions—are examined for compliance with applicable federal consumer financial law, especially the requirements of the forthcoming 1033 rulemaking, including the substantive prohibitions on the release of confidential commercial information.”