Data Security

Subscribe to Data Security via RSS

A newly launched academic institute is seeking to influence the future direction of consumer financial services regulation by promoting a policy framework centered on consumer choice, market competition, empirical research, and innovation. In the podcast we are releasing today on Consumer Finance Monitor, our host Alan Kaplinsky (founder, former chair for 25 years and now senior counsel) interviewed Professors Todd Zywicki of George Mason University Antonin Scalia Law School and Tom Miller of Mississippi State University about their newly created Institute for Consumer Financial Choice (ICFC), its mission, and its ambitious agenda.… Continue Reading

On June 1, 2026, Chief Judge Virginia Kendall of the U.S. District Court for the Northern District of Illinois issued a major follow-up opinion in Illinois Bankers Association v. Raoul that substantially alters the court’s February 2026 summary judgment decision regarding the Illinois Interchange Fee Prohibition Act (“IFPA”).

The new opinion was issued after the Seventh Circuit vacated the district court’s February ruling and remanded the case for reconsideration in light of the Office of the Comptroller of the Currency’s April 2026 Interim Final Rule and Interim Final Order addressing the IFPA.… Continue Reading

The House Financial Services Committee recently advanced legislation to modernize the Gramm-Leach-Bliley Act (GLBA), reflecting a continued shift toward more prescriptive data governance obligations for financial institutions. The proposal, titled the GUARD Financial Data Act, is paired with the SECURE Data Act and is intended to establish a national framework for consumer data privacy while updating GLBA’s longstanding notice-and-opt-out regime.… Continue Reading

In last week’s podcast episode, we were joined by Alex Johnson, Founder of Fintech Takes, and Paige Paridon, Senior Vice President, Senior Associate General Counsel & Co-Head of Regulatory Affairs at Bank Policy Institute, to take a deep dive into the new Consumer Financial Protection Bureau Open Banking Rule.

The CFPB has issued a groundbreaking final rule implementing Section 1033 of the Dodd-Frank Act, significantly expanding consumer access to their financial data.… Continue Reading

On December 3, 2024, the Consumer Financial Protection Bureau (CFPB) published its long-anticipated proposed rule aimed at regulating data brokers under the Fair Credit Reporting Act (FCRA).  Although the CFPB’s future is uncertain under the upcoming administration, if implemented, the rule would significantly expand the reach of the FCRA. 

In the accompanying press release, the CFPB stated that its “proposal would ensure data brokers comply with federal law and address critical threats from current data broker practices, including” national security and surveillance risks; criminal exploitation; and violence, stalking, and personal safety threats to law enforcement personnel and domestic violence survivors. … Continue Reading

In Mortgagee Letter 2024-10, FHA announced a requirement for FHA approved lenders to notify the U.S. Department of Housing and Urban Development (HUD) of Significant Cybersecurity Incidents. The Mortgagee Letter, which is dated May 23, 2024, provides that the requirement is effective immediately.

For purposes of the reporting requirement, a Significant Cybersecurity Incident (Cyber Incident) is “an event that actually or potentially jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system; or constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies and has the potential to directly or indirectly impact the FHA-approved mortgagee’s ability to meet its obligations under applicable FHA program requirements.”… Continue Reading

On October 27, the Federal Trade Commission (“FTC”) unanimously voted to amend the Safeguards Rule to require non-banking financial institutions, such as mortgage brokers, motor vehicle dealers, and payday lenders, to report data breaches and security events to the Agency. This amendment will become effective 180 days after its publication in the Federal Register.… Continue Reading

California continues to be at vanguard of data privacy rights.  The latest effort by California legislators to protect consumer privacy rights focuses on data brokers, who under the proposed California Senate Bill 362, aka the “Delete Act,” would be required to recognize and honor opt-out signals from Californians.  The law seeks to expand on the deletion and opt-out rights provided under the CCPA, which currently requires a Californians to submit their deletion and opt-out requests on a company-by-company basis.… Continue Reading

On April 24, the Governor of Kansas signed into law Kansas Senate Bill 44, which enacts the Financial Institutions Information Security Act (the “Act”). The Act requires credit services organizations, mortgage companies, supervised lenders, money transmitters, trust companies, and technology-enabled fiduciary financial institutions to comply with the requirements of the GLBA’s Safeguards Rule, as in effect on July 1, 2023.… Continue Reading

On January 12, 2023, the Consumer Financial Protection Bureau (“CFPB”) issued a report highlighting an increase in reported incidents of identity theft by servicemembers.  The report, titled “Servicemember reports about identity theft are increasing,” cited to data from the Federal Trade Commission (“FTC”) that showed nearly 50,000 cases of identity theft involving military consumers (including servicemembers, veterans, and their family members) in 2021. … Continue Reading