AFSA Suggests Changes to Financial Data Rulemaking
Last week, in a letter to the Consumer Financial Protection Bureau, AFSA reiterated support for innovation in the financial services industry but cautioned against overly restrictive use limitations. The CFPB’s proposed rulemaking to implement Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) is the next step in a 7-year process which AFSA has been involved in, submitting comments and suggestions to the CFPB on previous proposals. In this most recent comment letter, AFSA’s proposed changes and clarifying questions are aimed at ensuring consumers’ financial data be protected and that the rule is able to be properly implemented. The suggestions and questions include:
- Proposing three specific language changes that would clarify definitions and intent so the CFPB and AFSA members can work together to navigate the line between providing consumers increased access while ensuring that their sensitive information is protected.
- Requesting more detail about standard-setting bodies to provide covered parties clear rules of the road in this space.
- Asking for increased clarity in this rulemaking that third parties may use consumer data in fraud prevention efforts and for improving internal credit models as not allowing financial institutions to use consumer data for fraud prevention would have the unintended consequence of reducing consumer data security and privacy.
- Ensuring that the rulemaking allows data providers to be able to choose whether consumers need to reauthorize consent each year as smaller companies might find that burdensome.
- Calling for the CFPB to clarify the interplay of the Section 1033 rulemaking with the announced rulemaking to amend Regulation V. Based on the SBREFA outline issued by the CFPB on September 15, 2023 for the upcoming Regulation V rulemaking, a “data aggregator” under the proposed Part 1033 may also be a “data broker” under the Regulation V proposal in some cases. Industry needs clear guidance on when the CFPB intends a party to be covered by both regulations.
Given the breadth of this rulemaking and the need for some clarifying answers, AFSA also requested that the enforcement deadline should be delayed so that financial institutions can properly comply.
January 4th, 2024
