WASHINGTON — The Consumer Financial Protection Bureau has proposed a rule to “rein in” data brokers that sell Americans' sensitive personal and financial information.
The proposal comes at a time when the number of identity theft crimes is rising dramatically, an issue CUToday.info has extensively covered. The CFPB's latest proposal follows the Bureau's final rule to supervise the largest nonbank companies offering digital funds transfer and payment wallet apps. Both moves are viewed by analysts as benefitting FIs and their account holders.
The proposed rule would limit the sale of personal identifiers like Social Security Numbers and phone numbers collected by certain companies and make sure that people’s financial data, such as income, is only shared for legitimate purposes, like facilitating a mortgage approval, and not sold to scammers targeting those in financial distress, the CFPB said.
Rohit Chopra
The proposal would make clear that when data brokers sell certain sensitive consumer information they are "consumer reporting agencies" under the Fair Credit Reporting Act (FCRA), requiring them to comply with accuracy requirements, provide consumers access to their information, and maintain safeguards against misuse, the Bureau said.
“By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling scamming, stalking, and spying,” said CFPB Director Rohit Chopra. “The CFPB’s proposed rule will curtail these practices that threaten our personal safety and undermine America’s national security.”
“The data broker industry collects and sells detailed information about Americans' personal lives and financial circumstances to anyone willing to pay,” the agency said.
Addresses Critical Threats
The CFPB's proposal would ensure data brokers comply with federal law and address critical threats from current data broker practices, including:
- National security and surveillance risks: “Countries of concern, like China and Russia, can purchase detailed personal information about military service members, veterans, government employees, and other Americans for pennies per person. This enables the creation of detailed dossiers for potential espionage, surveillance, or blackmail operations, allowing relatively small investments to be leveraged into mass surveillance operations,” the CFPB said.
- Criminal exploitation: “Identity thieves and scammers purchase detailed financial profiles to target vulnerable consumers, particularly seniors and financially distressed individuals. These criminals can use this data to execute sophisticated fraud schemes and steal retirement savings, often targeting Americans who can least afford the losses,” the CFPB said.
- Violence, stalking, and personal safety threats to law enforcement personnel and domestic violence survivors: “The availability of sensitive contact information poses risks to those who are targeted for their profession, such as judges, police officers, prosecutors, and other government employees. Domestic violence survivors also face grave dangers when their current addresses and phone numbers are readily available for purchase through data brokers. Several states have already had to take action to protect judges and law enforcement officers after violent incidents, including the 2020 murder of a federal judge's son by an attacker who purchased her home address,” the CFPB said.
To address these risks, the CFPB said the proposed rule would:
- Treat data brokers just like credit bureaus and background check companies: “Companies that sell data about income or financial tier, credit history, credit score, or debt payments would be considered consumer reporting agencies required to comply with the FCRA, regardless of how the information is used,” the CFPB said.
- Protect consumers' personal identifiers from abuse and misuse: “When consumer reporting agencies collect information like names, addresses, or ages for credit reports, any subsequent sale of that information would be covered by the FCRA's protections,” the CFPB said.
- Require clear consumer consent for data sharing: “Under the proposed rule, companies relying on consumers’ consent to obtain or share a consumer’s credit report would need separate, explicit authorization to do so, rather than burying permissions in fine print,” the Bureau said.
J.V. Proesel
“These changes would significantly limit the ability of data brokers to sell sensitive contact information that could be used to target, harass, or dox individuals seeking privacy protection, including domestic violence survivors. The proposed rule would preserve existing pathways created by the FCRA for government agencies to access consumer report information for legitimate law enforcement, counterterrorism, and counterintelligence purposes,” the CFPB said.
FIs Will Like Rule, Data Brokers Will Not
"Data brokers are not going to like adhering to FCRA," said JV Proesel, president of Moebs $ervices. "The FCRA entails a lot more disclosures, reporting and additional consumer consent the data brokers will need to do. The rule will benefit all consumers and indirectly FIs. It is certainly a step in the right direction to help deter identify theft, but by no means will solve the identify theft and financial fraud problem.
"Identify theft is a major crises, which goes beyond data brokers and involves scrapping online data, phishing scams, and creatively preying on victims," reminded Proesel. "As long as the financial opportunity exists, the criminals will persist. This rule will safeguard consumer privacy and gain adherence from the non-criminal element, but financial criminals are savvy and often one step ahead."