The Consumer Financial Protection Bureau proposes a rule to restrict the sale of US personal, social, and financial data
The U.S. consumer protection agency stated that its objective is to “rein in” data brokers, who circumvent federal law by asserting that they are not subject to the FCRA’s legal provisions, in proposing the new rules, months after President Biden signed an executive order to restrict the sale of Americans’ private data.
The proposed rule would “curtail the widespread evasion” of the FCRA, the federal privacy law that safeguards personal data collected by consumer reporting agencies, such as credit bureaus and tenant screening companies, according to the CFPB’s director, Rohit Chopra, during a call with reporters on Monday.
The rule would also “emphasize that numerous data brokers, including credit bureaus and background check companies, are subject to federal protection under the FCRA.”
At a time when data brokers are under increasing scrutiny for profiteering from selling access to — and sometimes losing — enormous amounts of Americans’ personal information, the decision to close the regulatory loophole at the federal level is timely.
Chopra stated that the agency acknowledged the “widespread evasion” of the federal privacy law, which recognized that data brokers have long exploited the law. She also warned of the “staggering” issue caused by data brokers who are “making this data available to anyone willing to pay a price.”
The proposed rule would regard data brokers in the same manner as credit bureaus, background check companies, or any other company that sells data about income or credit scores, histories, and debt payments, which are already subject to the FCRA, according to the CFPB.
The proposed rule would also restrict data brokers from selling information that can identify individuals, such as Social Security numbers and phone numbers, which would be subject to the FCRA in the future.
Chopra stated, “Today’s proposed rule is a significant advancement in the effort to guarantee that organizations that traffic in the most sensitive information of Americans are held accountable for their violations of long-standing laws and for endangering the safety of both individuals and our nation.”
The CFPB stated that it was proposing the new rule to “further Congress’ goal” of protecting Americans’ personal data, as it had intended when it voted to pass the FCRA in 1970. Since that time, the United States has been the sole Western democracy to not have enacted nationwide data protections into law.
The Federal Register will publish the proposed rule until early March 2025.
It is uncertain whether the rule will endure under the forthcoming Trump administration, which has pledged to implement extensive deregulation throughout the U.S. government.
The CFPB officials declined to provide a response, but they did inform reporters that there was a “widespread bipartisan acknowledgement” that data brokers presented significant risks.