FCRA Regulation May Expand to Cover More Data Brokers

The Consumer Financial Protection Bureau (CFPB), the country’s top financial consumer watchdog agency, on Tuesday announced plans to regulate a broader swath of data brokers to beef up the federal government’s privacy protection goals.

Agency officials say the effort would expand the number of companies subject to the Fair Credit Reporting Act (FCRA), which governs the privacy of consumer data provided to lenders. The new proposal would add protections covering the use of data derived from payment histories, personal income, and criminal records. Adopted in 1970, the FCRA has applied to credit bureaus, medical information companies, and tenant screening services.

The agency did not provide a list of companies that would be impacted, but the proposal could have broad implications for an enormous global data and business intelligence industry. According to Transparency Market Research, the global data brokers market reached $240 billion in 2021 and is expected to reach $462 billion by 2031.

Data brokers are spending massive amounts on lobbying efforts. According to a blog post from personal data protection firm Incogni, the data broker industry spent $143 million on lobbying from 2020-2022. The top five spenders included Oracle, Accenture, RELX, Mastercard, and PwC.

The CFPB in a statement said data brokers’ use and collection of sensitive data can be “particularly worrisome” in the age of artificial intelligence, when data can be collected from military personnel, government employees, people with dementia, and other sensitive or vulnerable groups.

“The CFPB will be taking steps to ensure that modern-day data brokers in the surveillance industry know that they cannot engage in illegal collection and sharing of our data,” Rohit Chopra, director of the CFPB, said in a statement.

The three largest consumer credit reporting companies -- Equifax Inc., Experian, and TransUnion, are already covered under FCRA. The CFPB proposal, which would take effect in 2024 after a required small business review panel, will add more companies.

New Potential AI Oversight

CFPB’s proposal addresses how consumers’ sensitive data may be used to train AI models. For example, AI tools that automate decisions about consumers – like whether or not to approve an application – could be covered by the revised FCRA regulation. AI chatbots that can collect personal data while responding to consumer questions, may be covered as well.”

Also added to FCRA protections would be a ban on the sale of “credit-header data” like a person’s name, address, or Social Security number, for the purpose of targeting advertisements. The companies would also be blocked from selling data to potential stalkers or perpetrators of domestic violence.

“We applaud the steps the Consumer Protection Financial Bureau is taking to stop data brokers from unlawfully collecting and selling millions of Americans’ sensitive data,” White House National Economic Council Director Lael Brainard, said in a statement.

The CPFB announcement came ahead of a Tuesday White House roundtable on data brokers including the Federal Trade Commission, the Justice Department, the White House Office of Science and Technology Policy, and the National Economic Council.

What to Read Next:

How to Address AI Data Privacy Concerns

US Data Privacy Relationship Status: It’s Complicated

Tracking Pixels Continue to Cause Data Privacy Issues in Healthcare