Yesterday, the Consumer Financial Protection Bureau (CFPB or Bureau) filed its decision to withdraw the proposed rule titled “Protecting Americans from Harmful Data Broker Practices (Regulation V)” in the Federal Register. The rescission is scheduled to be published today. This withdrawal marks a significant shift in the Bureau’s approach to regulating data brokers and other updates to Regulation V under the Fair Credit Reporting Act (FCRA).
The proposed rule, initially published on December 13, 2024, aimed to redefine key terms and expand the scope of the FCRA to improperly include data brokers as consumer reporting agencies (CRAs) as well as make other amendments to Regulation V, including with regards to permissible purpose and disputes. However, the Bureau has now determined that rulemaking is not necessary or appropriate at this time.
In our previous blog post, we delved into the CFPB’s ambitious proposal to expand the FCRA’s reach. The proposal included redefining “consumer report” to encompass a broader range of data, potentially complicating the landscape for companies which would need to navigate these new definitions and ensure compliance. Moreover, the rule sought to impose stringent requirements and restrictions on the permissible purposes for obtaining consumer reports as well as imposing new obligations on dispute handling.
The decision to withdraw the rule follows numerous concerns raised by commenters regarding its alignment with the FCRA and the Bureau’s statutory authority. The CFPB acknowledges that these concerns require careful consideration and has decided not to proceed with finalizing the rule. Instead, the Bureau will revisit the need for such a rule in the future, should it become necessary.
While the term data broker is antiquated and long sense lost any real meaning, companies which fall within the various statutory definitions need to remain vigilant.
