The Consumer Financial Protection Bureau is proposing a rule aimed at curbing the activities of data brokers who sell Americans’ sensitive personal and financial information.
The initiative seeks to enhance consumer privacy and security by imposing stricter regulations on the sale of personal identifiers such as Social Security numbers and phone numbers.
The proposed rule requires that financial data, like income details, be shared only for legitimate purposes, such as mortgage approvals, and not sold to scammers preying on financially vulnerable individuals.
“By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling scamming, stalking, and spying,” said CFPB Director Rohit Chopra.
The proposed regulation aims to mitigate these risks that threaten personal safety and national security.
Potential threats
The bureau says the data broker industry, which trades in detailed personal and financial information, poses several threats. First, it allows foreign adversaries, such as China and Russia, to purchase detailed personal data on military personnel and government employees, potentially facilitating espionage and surveillance activities.
It also allows identity thieves to exploit the data to target seniors and financially distressed individuals, executing fraud schemes that can devastate retirement savings.
The proposed rule would classify data brokers as "consumer reporting agencies" under the Fair Credit Reporting Act (FCRA), aligning them with credit bureaus and background check companies. This classification would require data brokers to adhere to FCRA's accuracy standards, provide consumers access to their information, and implement safeguards against misuse.
Key Provisions
Key provisions of the rule include:
Consumer Reporting Agency Designation**: Data brokers selling financial data would be treated as consumer reporting agencies, subject to FCRA compliance.
Protection of Personal Identifiers**: The rule would extend FCRA protections to the sale of personal identifiers, ensuring that information like names and addresses is not misused.
Consumer Consent Requirement**: Companies would need explicit consumer consent to share data, preventing permissions from being hidden in fine print.
The proposed rule aims to restrict data brokers' ability to sell information that could be used for harassment or targeting individuals seeking privacy protection, including domestic violence survivors.
The rule also preserves pathways for government agencies to access consumer report information for legitimate purposes, such as law enforcement and counterterrorism.