On August 15, 2023, the Consumer Financial Protection Bureau (CFPB) made an important announcement indicating its intention to initiate a comprehensive rulemaking process. The process aims to bring about large changes for entities collecting and selling customer data. Specifically, the rulemaking involves redefining data brokers as consumer reporting agencies, thereby subjecting them to regulations under the Fair Credit Reporting Act (FCRA). This move also aims to clarify how credit header data is perceived and treated as a consumer report.
The announcement derives from the CFPB’s increased focus on overseeing data giants that have historically operated outside of its jurisdiction. Globally, governments and legislative bodies have been moving towards defining and enforcing guidelines to protect consumer data, demonstrating increased scrutiny of companies and organizations that deal with consumer information.
Data brokers, by the new definition, become consumer reporting agencies and hence, fall under the FCRA’s mandate. One significant implication is that these entities will be expected to demonstrate greater transparency about their data collection and processing practices. They would also be mandated to ensure accuracy, follow dispute resolution procedures, and protect against unauthorized access.
Credit header data, which consist of name, address, social security number, and date of birth linked with a consumer’s credit file, also comes under increased regulation. The proposed rulemaking could lead to a legal argument about whether such data is considered a consumer report, further impacting data collection and sales strategies.
This rulemaking signifies a notable shift in the responsibility and regulatory burden faced by organizations handling personal data. The effects of this announcement are vast and far-reaching, potentially impacting every sector that relies on consumer data for operations, including marketing, fintech, and e-commerce sectors among others.