Will consumers gain better-defined insights into their own financial records? Yes, says the Consumer Financial Protection Bureau (CFPB or Bureau), which issued an advance notice of proposed rulemaking (ANPR) concerning consumer access to financial records, thus beginning the process of developing regulations to implement rulemaking in this area. We explain the significance below.
What Happened
Financial institutions that provide consumer financial products accumulate a wide variety of information concerning the consumers who use those products and services. And data aggregators often use the same data as well as develop their own. While there are numerous statutory and regulatory frameworks that require such companies to disclose certain types of this information, there is no comprehensive federal rulemaking on the subject.
Congress was aware of the issue when it enacted the Dodd-Frank Act in 2010. Section 1033(a) of Dodd-Frank, codified at 12 U.S.C. Section 5533(a), provides as follows:
Subject to rules prescribed by the Bureau, a covered person shall make available to a consumer, upon request, information in the control or possession of such person concerning the consumer financial product or service that the consumer obtained from such covered person, including information related to any transaction, or series of transactions, to the account including costs, charges, and usage data. The information shall be made available in an electronic form usable by consumers.
There are exceptions. For example, the same law exempts the production of algorithms used to derive credit scores and certain antifraud information, among other enumerated categories. Further, the law does not (standing alone) require that all such records be maintained or for a specific duration.
Critically, Congress likewise required the Bureau to consult with the relevant federal banking agencies and the Federal Trade Commission to ensure that the rules are promulgated in a fair manner, as described in more detail within Section 1033(e) of Dodd-Frank.
The director of the Bureau, Kathy Kraninger, expressed renewed interest in Section 1033. Indeed, the ANPR follows a symposium on consumer access to financial records and Section 1033 that the Bureau held on February 26, 2020.
The Bureau’s primary focus in the ANPR is consumer-authorized data access, which is defined as third-party access to consumer financial data pursuant to the relevant consumer’s authorization. The ANPR suggests that requiring consumer financial institutions to make information about consumer accounts available to third parties when authorized could have many positive effects for consumers. This access could lead to improved and innovative products and services, enhanced consumer control, and increased competition. The ANPR offers the examples of a lender using deposit account transaction history to underwrite consumers who might otherwise face more costly credit terms and of an automated personalized financial advice service that consolidates consumer data from multiple providers.
The ANPR also recognizes that allowing third parties to have consumer-authorized data access is not without consumer protection risks. While consumers would certainly have more authority over their data, they could quickly lose control of that data after multiple authorizations. Data security and privacy risks abound, and potential regulations would need to provide guidance on liability for errors in the provided information. In addition, if a data holder is ever allowed to refuse consumer-authorized access—for possible fraud or deficient security practices, for instance—then the regulations must constrain and define that authority.
Why It Matters
The direction that the Bureau decides to go with these regulations could have enormous ramifications for the consumer financial services industry. We encourage our clients to consider how these regulations may affect their businesses and their industry and to participate in this process. Comments must be received within 90 days of the ANPR’s publication in the Federal Register. We are ready to assist as needed.