Rohit Chopra, the director of the Consumer Financial Protection Bureau, on Tuesday plans to announce from the White House a new rule that would strictly limit the types of consumer data that can be sold by businesses as part of a federal crackdown on third-party data brokers.
The CFPB plans to propose rules that would require data brokers — or any other company in the surveillance industry — be covered by the Fair Credit Reporting Act. The 1970 law strictly limits the use of credit report data from being sold for any reason other than what Congress has specified as having a "permissible purpose," such as credit underwriting. The law prohibits the sale of data for advertising, training and artificial intelligence.
Many third-party data brokers that collect, aggregate, sell and resell personal information are not currently covered by the FCRA, which mandates that credit reporting agencies and data collectors only collect and report accurate credit information. Individuals would have the right to obtain their data from third-party brokers and dispute inaccuracies.
"The CFPB will be taking steps to ensure that modern-day data brokers in the surveillance industry know that they cannot engage in illegal collection and sharing of our data," Chopra said in prepared remarks. "Reports about monetization of sensitive information — everything from the financial details of members of the U.S. military to lists of specific people experiencing dementia — are particularly worrisome when data is powering 'artificial intelligence' and other automated decision-making about our lives."
In March, the CFPB issued a request for information to better understand data brokers' business practices and to ensure that they are complying with federal law. The bureau plans to issue a proposed rule by first convening a panel of small businesses that will take feedback on proposals.
The CFPB already has reached out to trade groups asking for a wide range of small-business experts to serve on the panel. The small-business panel, required by the Small Business Regulatory Enforcement Fairness Act, is expected to release an outline of proposals under consideration and the CFPB will issue a report by year-end summarizing the feedback. The CFPB may make changes to the proposal in a final rule that is expected to be formally proposed in 2024.
One of the proposals under consideration would designate data brokers as credit reporting companies under the FCRA if they sell certain types of data including a consumer's payment history, income or criminal records. The CFPB is considering whether to outlaw the sale of so-called "credit header data," which is the portion of a credit report that contains an individual's name, birth date, Social Security number, phone numbers and current and past addresses. Data brokers rely on credit header data purchased from the three main credit bureaus to create dossiers on individuals.
For the past five years, credit reporting has been the most complained-about product. Last year, 76% of the complaints submitted to the CFPB were about credit reporting and specifically inaccuracies on credit reports.
Congress passed the FCRA in response to concerns about data brokers assembling detailed dossiers about consumers and selling this information to those making employment, credit and other decisions. The CFPB has said that citizens have little choice about whether to enter into business relationships with data brokers or whether they will be tracked but the data being collected may play a decisive role in significant life decisions such as buying a home or finding a job.
The FCRA provides a range of protections, including accuracy standards, dispute rights and restrictions on how data can be used. Enforcement of the FCRA is split between the CFPB and the Federal Trade Commission.
Reining in data brokers has drawn bipartisan support in Congress. In April, a House Energy and Commerce subcommittee held hearings in which lawmakers heard from several experts that claimed data brokers are threatening the civil rights of individuals by selling private health and other sensitive information without individuals' knowledge or permission. Some advocates claim data brokers sell consumer credit data to predatory marketers and scammers.
"A stunning amount of information and data is being collected on Americans — their physical health, mental health, their location, what they are buying, what they are eating," said Rep. Cathy McMorris Rodgers, R-Wash., during the fifth hearing focused on data brokers this year. The failure of Congress to pass a federal data privacy law that would replace state regulations has bolstered calls for more regulation of data brokers.
The CFPB declined to comment on specific companies that would be swept into a new rule. Senior CFPB officials said on a call with reporters late Monday that the agency "wants to ensure that all companies are held to the same rules and consumers are protected."
