On August 15, CFPB Director Rohit Chopra announced plans for new CFPB rules that would strictly limit the types of consumer data that can be sold by businesses and ensure that data brokers comply with the Fair Credit Reporting Act (“FCRA”). The announcement came during a White House roundtable event focused on protecting individuals’ data privacy and as part of a broader federal crackdown on third-party data brokers. Director Chopra highlighted two proposals in particular that the CFPB is considering.
First, the new rules would define a data broker that sells certain types of consumer data as a “consumer reporting agency.” The CFPB is considering a proposal that would generally treat a data broker’s sale of data regarding, for example, a consumer’s payment history, income, and criminal records as a consumer report, because that type of data is typically used for credit, employment, and certain other determinations. This would trigger requirements under the FCRA for ensuring accuracy and handling disputes of inaccurate information, as well as prohibit misuse.
A second proposal would address confusion around whether so-called “credit header data” is a consumer report. Much of the current data broker market runs on personally identifying information taken from traditional credit reports, such as those sold by Equifax, Experian, and TransUnion. This includes key identifiers like name, date of birth, and Social Security number that are contained in consumer reports generated by the credit reporting companies. The CFPB expects to propose to clarify the extent to which credit header data constitutes a consumer report, reducing the ability of credit reporting companies to impermissibly disclose sensitive contact information that can be used to identify people who don’t wish to be contacted, such as domestic violence survivors.
The CFPB is expected to publish an outline of the new proposals and alternative rules under consideration for a proposed rule sometime next month.
Putting it into Practice: The new CFPB rule proposals are set to have a significant impact by making data brokers subject to the FCRA. Any updated rules under the FCRA can be enforced by the CFPB and state law enforcement across sectors of the economy. The Federal Trade Commission, the Department of Transportation, the Department of Agriculture, and other agencies can enforce these rules for specific sectors under their jurisdiction. Accordingly, companies potentially impacted by the new rules should review Director Chopra’s remarks and any formal proposals published in the coming weeks to ensure compliance.
