The Consumer Financial Protection Bureau Announces Sweeping Rulemaking for Companies That Collect and Furnish Personal Data

Speaking from the White House last week, CFPB Director Rohit Chopra announced the CFPB's intent to promulgate a new "data broker rulemaking." In particular, the proposed rulemaking would consider two key changes to existing law. First, the rule would define a "data broker"—that is, any company that sells certain types of consumer data—as a "consumer reporting agency." Such a shift would subject those companies to the FCRA, which imposes a number of regulations and procedures on the credit reporting agencies, including a number of timing and accuracy requirements. Second, the new rule would also "address confusion" regarding whether "credit header data" is considered a consumer report, such that a data broker who deals in such data would also be subject to the FCRA. 

This rule would have far-reaching implications. For one, redefining data brokers as consumer reporting agencies would subject virtually every company with a digital presence and a data collection operation to a host of new regulations under the FCRA. Any company that harvests and sells or discloses consumer data would soon be required to adhere to the same legal regime to which the major credit agencies are subject—even if the company has nothing to do with consumer credit or consumer credit reporting. Indeed, Chopra himself confirmed as much, suggesting that "today's market realities" necessitate broader regulations of data brokers. 

Second, the would-be rulemaking indicates the CFPB is willing to ignore settled law in order to carry out its enforcement priorities. It is well established that credit header data does not constitute a "consumer report" for purposes of the FCRA. Indeed, multiple jurisdictions have held that the accumulation of biographical information cannot constitute such a report where that data has no bearing on an individual's creditworthiness and does not play into the actual credit report. Moreover, a key inquiry under the FCRA is how the data is utilized: For example, there is a distinction between using that data to make creditworthiness determinations and using data to simply focus marketing efforts to prospective customers or to detect fraud. Indeed, only the former is subject to the FCRA under settled law.

But the CFPB has made plain it intends to blast through those distinctions and to subject data brokers that sell for other purposes—including marketing and fraud detection—to the FCRA anyway. Intriguingly, Chopra opened his announcement by invoking the Fourth Amendment's protections against unwarranted search and seizure, and he later touched on the historical basis for the FCRA as being aimed at protecting consumers from increasing data surveillance in the 1970s. These invocations suggest Chopra and the CFPB view data brokers as the new frontier for an individual's privacy and suggest that enforcement in this space could be robust if the CFPB gets its way. 

The CFPB indicated it will publish an outline of proposals in September 2023 and propose the formal rule for public comment in 2024.