On March 15, the CFPB issued a Request for Information (RFI) about data broker business practices to inform planned rulemaking under the FCRA and provide the CFPB with insight into the full scope of the data broker industry. In particular, CFPB is seeking information about (i) new business models that sell consumer data and (ii) consumer harm and market abuses.
The RFI applies to first-party data brokers that interact directly with consumers as well as third-party data brokers with no direct relationship with consumers. This includes firms that prepare employment background screening reports and credit reports. The CFPB’s market-level inquiries include what types of data is collected, the sources of the data, methods of data collection, whether people can avoid having their data collected, and what controls are in place to protect peoples’ data and safeguard their privacy. The individual inquiries are related to consumer experience, including data brokering harms and benefits, data accuracy and privacy, and correcting inaccurate data.
According to the CFPB, government agencies, technology and privacy experts, financial institutions, consumer advocates, and others have identified numerous consumer harms and abuses related to the operation of data brokers, including significant privacy and security risks, the facilitation of harassment and fraud, the lack of consumer knowledge and consent, and the spread of inaccurate information.
Comments on the RFI are due by June 13.
Putting It Into Practice: This latest inquiry should come as no surprise given the CFPB’s focus on consumer reporting companies that collect and sell access to consumer data (see our previous blog post regarding this focus here). The CFPB has previously highlighted problems that consumers have reported about the three nationwide reporting companies not adequately responding to consumer complaints about errors. The CFPB also issued an advisory opinion in November 2021 affirming that all consumer reporting companies, including tenant and employment screening companies, have an obligation to use reasonable procedures to assure maximum possible accuracy.
This RFI comes as the CFPB also issued its January 2023 market monitoring orders to data aggregators, which relates to the Section 1033 rulemaking requiring consumer financial services providers to give consumers access to certain financial information. Companies that collect and share consumer data should follow developments related to the CFPB’s Section 1033 rulemaking and this most recent RFI.