Jump to Content
close
close
ABA: The American Bankers Association
Comment Letter

Letter to the CFPB on the Proposed Rule re: Protecting Americans from Harmful Data Broker Practices

  • From Hallee Morgan
  • Published April 2, 2025

RE: Proposed Rule re Protecting Americans from Harmful Data Broker Practices (Regulation V); Docket No. CFPB-2024-0044
Download

Dear Acting Director Vought,

The American Bankers Association (ABA) appreciates the opportunity to comment on the Consumer Financial Protection Bureau's (CFPB) Notice of Proposed Rulemaking (NPRM) entitled "Protecting Americans from Harmful Data Broker Practices." The proposed rule would amend Regulation V, which implements the Fair Credit Reporting Act (FCRA). The proposed rule would modify and re-interpret the definitions of consumer report and consumer reporting agency under the FCRA as well as certain of the FCRA's provisions governing when consumer reporting agencies may furnish, and users may obtain, consumer reports. The proposed rule's stated purpose is to, among other things, ensure that the FCRA's protections are applied to sensitive consumer information sold by data brokers. While we support the objective of protecting consumers from potential misuse of personal information by data brokers and others, the FCRA is not the right tool to accomplish this goal. The CFPB's proposal to use the FCRA for this purpose exceeds the agency's statutory authority and would have harmful, unintended consequences. ABA urges the CFPB to withdraw the proposal.

I. Summary of the Comment

The proposed rule exceeds the CFPB's statutory authority. Banks already adhere to stringent data privacy laws, such as the Gramm-Leach-Bliley Act, ensuring proper handling of sensitive consumer information. The FCRA is not a comprehensive data privacy regime but a specialized statute regulating certain information related to credit, employment, and insurance decisions. The proposed rule would expand the FCRA by regulatory fiat. Elected members of Congress, not the CFPB, have authority to make the complex policy decisions required to establish a comprehensive data privacy regime.

The proposed rule is likely to cause harmful, unintended consequences. Banks use personal identifiers such as name, date of birth, social security number, and address to verify customer identities and combat fraud. The CFPB’s proposal would treat personal identifiers as consumer reports, which would force banks to send adverse action notices to fraudsters, revealing detection methods.

Additionally, the proposed restrictions on consumer written instructions to use consumer reports could negatively impact identity and credit-monitoring services that consumers use to protect themselves from harm. The proposal would reduce long-term use of these services and hinder competition among bank service providers and consumer reporting agencies (CRAs). Furthermore, the proposal's functional prohibition on using de-identified personal information would prevent banks from using this data for model testing and validation, which is essential for risk management. And the prohibition of using de-identified data for marketing would reduce competition and consumer awareness of financial options.

While ABA supports safeguarding consumer information, the CFPB's proposed rule oversteps its authority and could harm banks' ability to protect and serve consumers effectively. ABA urges the CFPB to withdraw the proposed rule.

Download the comment letter to read the full text.

In Depth

Related Products

Our Experts

Hallee Morgan

Hallee Morgan

Vice President & Senior Counsel, Regulatory Compliance and Policy

Contact Hallee

Related to This