CFPB Announces Rulemaking on Consumer Access to Financial Records

Manatt, Phelps & Phillips, LLP

Will consumers gain better-defined insights into their own financial records? Yes, says the Consumer Financial Protection Bureau (CFPB or Bureau), which issued an advance notice of proposed rulemaking (ANPR) concerning consumer access to financial records, thus beginning the process of developing regulations to implement rulemaking in this area. We explain the significance below.

What Happened

Financial institutions that provide consumer financial products accumulate a wide variety of information concerning the consumers who use those products and services. And data aggregators often use the same data as well as develop their own. While there are numerous statutory and regulatory frameworks that require such companies to disclose certain types of this information, there is no comprehensive federal rulemaking on the subject.

Congress was aware of the issue when it enacted the Dodd-Frank Act in 2010. Section 1033(a) of Dodd-Frank, codified at 12 U.S.C. Section 5533(a), provides as follows:

Subject to rules prescribed by the Bureau, a covered person shall make available to a consumer, upon request, information in the control or possession of such person concerning the consumer financial product or service that the consumer obtained from such covered person, including information related to any transaction, or series of transactions, to the account including costs, charges, and usage data. The information shall be made available in an electronic form usable by consumers.

There are exceptions. For example, the same law exempts the production of algorithms used to derive credit scores and certain antifraud information, among other enumerated categories. Further, the law does not (standing alone) require that all such records be maintained or for a specific duration.

Critically, Congress likewise required the Bureau to consult with the relevant federal banking agencies and the Federal Trade Commission to ensure that the rules are promulgated in a fair manner, as described in more detail within Section 1033(e) of Dodd-Frank.

The director of the Bureau, Kathy Kraninger, expressed renewed interest in Section 1033. Indeed, the ANPR follows a symposium on consumer access to financial records and Section 1033 that the Bureau held on February 26, 2020.

The Bureau’s primary focus in the ANPR is consumer-authorized data access, which is defined as third-party access to consumer financial data pursuant to the relevant consumer’s authorization. The ANPR suggests that requiring consumer financial institutions to make information about consumer accounts available to third parties when authorized could have many positive effects for consumers. This access could lead to improved and innovative products and services, enhanced consumer control, and increased competition. The ANPR offers the examples of a lender using deposit account transaction history to underwrite consumers who might otherwise face more costly credit terms and of an automated personalized financial advice service that consolidates consumer data from multiple providers.

The ANPR also recognizes that allowing third parties to have consumer-authorized data access is not without consumer protection risks. While consumers would certainly have more authority over their data, they could quickly lose control of that data after multiple authorizations. Data security and privacy risks abound, and potential regulations would need to provide guidance on liability for errors in the provided information. In addition, if a data holder is ever allowed to refuse consumer-authorized access—for possible fraud or deficient security practices, for instance—then the regulations must constrain and define that authority.

Why It Matters

The direction that the Bureau decides to go with these regulations could have enormous ramifications for the consumer financial services industry. We encourage our clients to consider how these regulations may affect their businesses and their industry and to participate in this process. Comments must be received within 90 days of the ANPR’s publication in the Federal Register. We are ready to assist as needed.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Manatt, Phelps & Phillips, LLP | Attorney Advertising

Written by:

Manatt, Phelps & Phillips, LLP
Contact
more
less

Manatt, Phelps & Phillips, LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.