On August 15, 2023, Consumer Financial Protection Bureau (CFPB) Director Rohit Chopra announced that the CFPB will be moving forward with a rulemaking next month to expand the categories of data subject to the Fair Credit Reporting Act (FCRA). The CFPB’s expected proposal will potentially extend the FCRA’s reach to data and companies that are not currently subject to the law, including but not necessarily limited to “data brokers.” This is significant because the FCRA—which is enforced by multiple actors beyond the CFPB, including the Federal Trade Commission (FTC)—sharply restricts the permissible purposes for which covered “consumer report” data may be used and imposes extensive requirements on companies that provide or use it.
While the CFPB has not yet released its proposal, it has provided some insights into what companies can expect. In particular, the CFPB explained in an FAQ that it is considering scenarios where companies “can be covered under the FCRA [], including [where] they sell certain types of consumer data,” such as “a consumer’s payment history, income, or criminal records.” The CFPB also indicated that it intends to define the extent to which “someone’s name, address, or Social Security number”—which is generally known as “credit header data”—constitutes a consumer report, signaling that it will depart from how that data is treated under current agency guidance.
Below, we provide additional background and context on the CFPB’s forthcoming rulemaking and its potentially wide-ranging implications.
The CFPB’s Actions to Date. In March 2023, the CFPB took the first step in this rulemaking process by releasing a Request for Information regarding Data Brokers and Other Business Practices Involving the Collection and Sale of Consumer Information (RFI). The RFI sought public comment on consumers’ experiences with data brokers and other “entities and types of entities [that] collect, aggregate, sell, resell, license, or otherwise share consumers' personal information with other parties[.]”
On August 15, 2023, Director Chopra announced the forthcoming rulemaking during a White House roundtable that included regulators, administration leaders, and civil society participants to discuss “harmful data broker practices.” His announcement indicated that the CFPB is set to propose enlarging the definition of a “consumer report” and therefore what entities constitute a “consumer reporting agency” under the FCRA.
The CFPB’s Proposals. The FCRA currently restricts the distribution and use of consumer reports to certain purposes (e.g., credit or employment-related purposes), and it applies to consumer data beyond traditional credit reports under certain circumstances. Based on its announcement, the CFPB appears poised to, at a minimum, expand the type of data covered by the FCRA to include “credit header data.” Credit header data consists of personally identifying information, such as name, address, or Social Security number, and is often derived from financial transactions with the consumer. The announcement did not clarify whether other kinds of data may ultimately be included in this rulemaking, but as a general matter, expanding the scope of coverage could effectively apply the FCRA to other types of data and use cases as well.
Additionally, the CFPB indicated that it intends to restrict the ability of companies to use covered data for “targeted advertising, to train AI, [or] to sharpen chatbots or similar AI services.” However, it is not clear how the FCRA could be expanded only to cover those particular use cases. As noted above, the FCRA significantly restricts companies’ use of FCRA-covered data to certain limited purposes, so expanding the scope of FCRA coverage would likely result in far greater restrictions than just use in advertising or AI.
Next Steps. Within the next month, the CFPB plans to publish an outline of proposals and alternatives under consideration for a proposed rule, pursuant to the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA). Once published, the CFPB will convene a Small Business Review Panel, and small entities (as defined by the Small Business Act) or their representatives will be given the opportunity to provide feedback and recommendations on the proposed rule’s potential impacts on small entities. Thereafter, the CFPB would issue a Notice of Proposed Rulemaking, which is likely to happen in 2024.
[View source.]
