CFPB Announces Plans to Extend FCRA to Data Brokers Through Rulemaking

At an August 15, 2023, White House roundtable, Consumer Financial Protection Bureau (CFPB) Director Rohit Chopra announced plans to issue rules that would extend the Fair Credit Reporting Act (FCRA) to certain “data broker practices.”

This announcement and a concurrently issued fact sheet come on the heels of a March 2023 CFPB inquiry in which the bureau made clear it was reviewing and assessing data broker practices to inform a future rulemaking under FCRA.

Less than six months later, the CFPB appears poised to publish an outline of proposals and alternatives under consideration in September. Chopra also suggested that the bureau will publish the actual proposed rule, under FCRA, for public comment sometime in 2024.

Expansion of FCRA through proposed rulemaking

Chopra’s announcement, and the related fact sheet, reflect that the proposed rules under consideration by the bureau would expand FCRA’s reach in at least two ways. First, the proposed rules would define data brokers that sell certain types of consumer information as “consumer reporting agencies” under FCRA. According to the bureau, this would mean that covered data brokers would be required to comply with certain accuracy and dispute handling requirements.

Second, the proposed rules would clarify the extent to which “credit header data” – meaning identifying information such as name, date of birth and Social Security number – constitutes a “consumer report” under FCRA. According to the bureau, the clarification is intended to protect against disclosure of credit header information for, among other things, targeted advertising, to train artificial intelligence or to sharpen chatbots.

Role of AI

A key driver of the CFPB’s FCRA rulemaking proposals appears to be concerns over “artificial intelligence and other predictive decision-making” tools. According to the bureau, the rules under consideration would bring “much-needed accountability” to data brokers who, purportedly, power artificial intelligence and other automated decisioning about consumers’ lives.

Consequently, the CFPB stresses that the proposed rulemaking is part of an “all-of-government effort” to address the risks related to use of AI. This is unsurprising in light of an April 2023 joint statement by federal agencies warning entities that existing laws apply to new technologies, such as artificial intelligence, and the many publications addressing risks associated with the use of artificial intelligence that have been issued by the CFPB over the past year.

The proposal also coincides with efforts, at the state and local level, to enhance privacy laws to more closely regulate automated decision-making. For example, the California Consumer Privacy Act directs the California Privacy Protection Agency to adopt regulations “governing access and opt-out rights with respect to businesses’ use of automated decision-making technology, including profiling and requiring businesses’ response to access requests to include meaningful information about the logic involved in those decision making processes, as well as a description of the likely outcome of the process with respect to the consumer.” New York City’s “automated employment decision tools” rule regulates the use of AI tools in hiring, including requiring employers to notify candidates about the use of AI, allowing candidates to be informed of the data used to train the AI, and an annual audit of the tools to evaluate them for bias. Privacy laws in Colorado, Virginia and Connecticut further provide consumers with the right to opt out of certain profiling with respect to automated decisions.

What to expect

As noted above, the bureau plans to move quickly with respect to its proposed FCRA rulemaking. Entities involved in the sale of data – including, but not limited to, consumer payment history, income and criminal records data, as well as credit header data – should therefore monitor announcements by the bureau, and engage with legal and compliance partners to evaluate, in real time, if and how the impending rules may impact their compliance responsibilities.

This goes for data brokers across industries. During the White House roundtable, Chopra explained that “any updated rules under the [FCRA] can be enforced by the CFPB and state law enforcement across sectors of the economy,” as well as by the “Federal Trade Commission, the Department of Transportation, the Department of Agriculture, and other agencies … for specific sectors under their jurisdiction.” Accordingly, we expect the CFPB to continue to coordinate with federal and state agencies to ensure that a comprehensive cross-sector approach to addressing data broker practices is ultimately implemented.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.