On April 2, at an event at the White House on Data Protection and National Security, CFPB Director Rohit Chopra’s articulated potential changes to the data security regulation landscape and noted that the Bureau is considering rules to amend the Fair Credit Report Acting, tightening the regulation of data brokers that trade in sensitive consumer data. His remarks follow an Executive Order signed by President Biden five weeks ago aimed at protecting American’s sensitive personal data from “countries of concern.” 

While the CFPB has traditionally focused on protecting consumers from the misuse of personal data by third parties, Chopra noted a growing consensus that unchecked surveillance and data aggregation may be undermining national security as well as individual liberties. He stated that major data breaches since 2015 have highlighted the inherent risks of large-scale data collection as these breaches, often linked to foreign entities, have led to significant losses through identity theft and misuse of account information.

Data brokers, who aggregate and sell consumer data without the knowledge of the subject, have come under increasing scrutiny. The President’s Executive Order specifically addresses these entities, stating that the sale of Americans’ data to foreign entities presents significant risks, including privacy invasion, counterintelligence, blackmail and other national security threats.

In an effort to curb these harmful practices, the CFPB aims to propose rules to bring the data brokers within the purview FCRA. The potential rule changes would define data brokers that sell certain types of consumer data as “consumer reporting agencies.” This would subject the data brokers to FCRA requirements for ensuring data accuracy, handling disputes, and prohibiting misuse.

Putting it into Practice: This announcement marks a continuation in the recent trend of federal and state regulators tightening the screws on brokers of consumer data by stepping up rulemaking enforcement (discussed previously here, here and here). As to the Fair Credit Reporting Act, the Bureau has promised new regulations in the “coming months,” and they should have wide-ranging impacts on the consumer lending industry as a whole. We will keep monitoring this space for new developments.