The Consumer Financial Protection Bureau (CFPB) has proposed a new rule that would block data brokers from selling personal and financial information on Americans, including their Social Security numbers and phone numbers, under the Fair Credit Reporting Act (FCRA).
Proposal Aims to Rein in Data Brokers
In proposing the new rules, months after President Biden signed an executive order to curb the sale of Americans’ private data, the U.S. consumer protection agency said it aims to "rein in" data brokers who sidestep federal law by claiming that they are not subject to the FCRA’s legal provisions.
CFPB Director Rohit Chopra Weighs In
The CFPB’s director, Rohit Chopra, told reporters on a call Monday that the proposed rule would "curtail the widespread evasion" of the FCRA, which is the federal privacy law that protects personal data collected by consumer reporting agencies, like credit bureaus and tenant screening companies. The rule would also "make it clear that many of these data brokers, like credit bureaus and background check companies, are subject to federal protection under the FCRA."
Closing Regulatory Loopholes
The move to close the regulatory loophole at the federal level comes at a time when data brokers face increasing scrutiny for profiteering from selling access to — and sometimes losing — vast amounts of Americans’ personal information. By acknowledging the "widespread evasion" of the federal privacy law, Chopra said the agency recognized that data brokers have long taken advantage of the law and warned of the "staggering" problem caused by data brokers who are "making this data available to anyone willing to pay a price."
Proposed Rule Explained
According to the CFPB, the proposed rule would treat data brokers the same as credit bureaus and background check companies, or any other company that sells data about income or credit scores, histories, and debt payments, which are already subject to the FCRA. The proposed rule would also limit data brokers from selling information that can identify individuals, such as Social Security numbers and phone numbers, which would be covered under the FCRA going forward.
CFPB’s Goal: Protecting Americans’ Personal Data
The CFPB said it was proposing the new rule to "further Congress’ goal" of protecting Americans’ personal data, as intended when it voted to pass the FCRA in 1970. Since then, the United States has become the only Western democracy to not have passed nationwide data protections into law.
Proposed Rule Timeline
The proposed rule will remain public in the Federal Register until early March 2025. It’s unclear whether the rule will last under the incoming Trump administration, which has promised widespread deregulation across the U.S. government. CFPB officials would not say but told reporters that there was "broad bipartisan recognition that data brokers pose real dangers."
Reactions and Implications
The proposed rule has sparked reactions from various stakeholders. Some have welcomed the move as a step towards protecting Americans’ personal data, while others have expressed concerns about the potential impact on businesses and industries reliant on data sales.
Related Topics
- Consumer Financial Protection Bureau
- Cybersecurity
- Data breach
- Data broker
- Security
- US government
Experts Weigh In
In an interview with TechCrunch, cybersecurity expert Zack Whittaker said: "The proposed rule is a major step forward in protecting Americans’ personal data. It’s long overdue that data brokers are held accountable for their actions."
Whittaker continued: "Data brokers have been exploiting loopholes in the law to profit from selling sensitive information. This proposed rule would put an end to that and ensure that companies like credit bureaus and background check companies are subject to federal protection under the FCRA."
Conclusion
The CFPB’s proposal to block data brokers from selling personal and financial information on Americans is a significant step towards protecting consumers’ rights and holding data brokers accountable for their actions. The proposed rule would treat data brokers the same as credit bureaus and background check companies, limiting the sale of sensitive information.
As the proposed rule remains public in the Federal Register until early March 2025, stakeholders will continue to weigh in on its implications and potential impact. Will the new administration uphold or repeal the proposed rule? Only time will tell.
What’s Next?
The CFPB will accept comments on the proposal for a period of 90 days after publication in the Federal Register. The agency will then review and consider all comments received before making a final decision on the proposed rule.
Stay tuned for updates on this developing story as more information becomes available.
Sources
- Consumer Financial Protection Bureau (CFPB)
- Fair Credit Reporting Act (FCRA)
- President Biden’s executive order
- Zack Whittaker, cybersecurity expert