On March 15, 2023, the Consumer Financial Protection Bureau (CFPB) launched an inquiry into the business practices of companies that “collect, aggregate, sell, resell, license, or otherwise share consumers’ personal information with other parties” – collectively called “data brokers.” Noting the significant expansion of the data broker industry since enactment of the Fair Credit Reporting Act (FCRA), the CFPB intends to assess whether – and likely how – entities using new business models and technologies to collect and sell consumer data may be covered by FCRA.

Comments on the CFPB’s request for information (RFI), due by June 13, 2023, will inform the CFPB’s “planned rulemaking” under FCRA, which was identified in the CFPB’s fall 2022 regulatory agenda. 

Overview of the RFI

The RFI seeks information regarding the data broker market and consumers’ experiences – both positive and negative – in light of the explosion of the market.

On the market side, the CFPB is looking for information on the sources from which data brokers collect information, the type of information collected and shared, the method of collection, whether people can avoid having their information collected, controls implemented by data brokers to ensure the quality and accuracy of data collected, and the potential harms and benefits data broker practices bring to consumers. From a consumer risk perspective, the CFPB is seeking information about data accuracy and privacy, as well as issues accessing, viewing, correcting and removing data collected by such brokers.

What to expect

The CFPB has devoted substantial attention to so-called financial surveillance companies and the potential for consumer harm stemming from their collection and dissemination of consumer information. It therefore comes as no surprise that the RFI focuses on consumer concerns over being “tracked and surveilled” by data brokers. 

The CFPB’s inquiry comes on the heels of an advance notice of proposed rulemaking by the Federal Trade Commission (FTC) seeking public comment on commercial surveillance and data security practices. We expect the CFPB and FTC to take a collaborative approach to the protection of consumer data and the scrutiny of companies that collect and share consumer information going forward.

The RFI also coincides with the CFPB’s January 2023 issuance of market monitoring orders to data aggregators in connection with its ongoing Section 1033 rulemaking pertaining to consumer access to financial records. Entities that engage in the collection and sharing of consumer data should monitor developments related to the CFPB’s Section 1033 rulemaking, which could also be informed by responses to the RFI. 

[View source.]