This is a comment from fifty-two (52) consumer, economic justice, privacy, and advocacy groups to the Consumer Financial Protection Bureau’s (CFPB) Advance Notices of Proposed Rulemaking reconsidering its final Personal Financial Data Rights rule implementing section 1033 of the Dodd-Frank Act. The comment strongly supports the current 1033 Rule as issued in October 2024 and urges the CFPB to retain its provisions, including its strong consumer protections, which are among the best-in-class for data privacy safeguards in the United States.
In particular, the comment urges that
- Any third party that a consumer knowingly and explicitly authorizes to access their own data, including but not limited to data aggregators, should be considered an agent or representative, given that the strong consumer protections of the rule ensure the third party is acting in the consumer’s interest.
- The CFPB should retain 1033 Rule’s ban on fees and urge the CFPB to retain it.
- While data security could be improved, that is not a reason to narrow the scope of the 1033 Rule given that it subjects third parties accessing consumer-authorized data to the data security requirements of the Federal Trade Commission (FTC) Safeguards Rule, which is as strong as or even stronger than the security standards that banks and other depository institutions are subject to.
- The consumer protections in the 1033 Rule are best-in-class and should be retained, including prohibitions on secondary use, requirements for data minimization, a one-year limit for authorizations, clear segregated disclosures for authorization, and a requirement to delete data once there is no longer authorization. These protections not only safeguard consumers, they benefit data providers by limiting the amount, usage, and retention of the data. If the Rule does not cover third parties when they access consumer-authorized data, including when screen scraping, both consumers and data providers will be left vulnerable.
See all resources related to: Credit Reporting & Data Fairness