In remarks at a White House event on protecting Americans from harmful data broker practices, Consumer Financial Protection Bureau (CFPB) director Rohit Chopra said his agency has decided to launch a rulemaking to ensure that digital data brokers are not misusing or abusing consumers’ sensitive data.

After conducting an inquiry into the practices of data brokers in the surveillance industry, he said, the CFTC decided to launch this rulemaking to better prevent the significant harms the inquiry had revealed – from the identification of victims for financial scams to the facilitation of harassment and fraud.

Request for information

In its latest Request for Information, the CFPB said it wants to understand the full scope of data brokers in this industry sector and their business practices, their impact on the daily lives of consumers, and whether they are all playing by the same rules.

The agency said the request is a chance for the public to share feedback about companies that play a significant role in people’s lives and in the economy, and the feedback will shed light on the current state of an industry that largely operates out of public view, and inform the CFPB’s future work to ensure the companies comply with US law.

“Modern data surveillance practices have allowed companies to hover over our digital lives and monetize our most sensitive data,” said Chopra. “Our inquiry will inform whether rules under the Fair Credit Reporting Act reflect these market realities.”

Data brokers and the FCRA

Data brokers assemble detailed dossiers about consumers and sell the information to those making employment, credit, and other decisions.

People often have little choice about whether to enter into business relationships with these companies or whether they will be tracked, yet the data these companies collect can play a decisive role when a person is buying a home or trying to find a job.

The inquiry into data brokers in the surveillance sector and how they use consumer data in the market today is designed to help the CFPB craft further rulemaking under the FCRA.

Congress passed the Fair Credit Reporting Act (FCRA) in response to concerns about data brokers assembling detailed dossiers about consumers and selling this information to those making employment, credit, and other decisions. The law covers data brokers like credit reporting companies and background screening firms, as well as those who report information to these firms.

The inquiry into data brokers in the surveillance sector and how they use consumer data in the market today is designed to help the CFPB craft further rulemaking under the FCRA.

Recent CFPB guidance

Last July, the CFPB issued a legal interpretation to ensure that companies that use and share credit reports and background reports have a permissible purpose under the FCRA, such as using consumer reports for credit, insurance, housing, or employment decisions.

That opinion made clear that credit reporting companies and users of credit reports have specific obligations to protect the public’s data privacy.

And last November, the agency issued a circular to affirm that consumer reporting companies and information furnishers cannot circumvent dispute investigation requirements. The CFPB had found that consumer reporting companies and some furnishers had failed to conduct reasonable investigations of consumer disputes or spend the time necessary to get to the bottom of inaccuracies.

Federal and state consumer protection

The agency’s circular outlines how federal and state consumer protection enforcers, including regulators and attorneys general, can bring claims against companies that fail to investigate and resolve consumer report disputes.

In April, the CFPB, the Civil Rights Division of the Department of Justice, the Federal Trade Commission, and the US Equal Employment Opportunity Commission jointly outlined their commitment to enforce their laws and regulations to monitor artificial intelligence (AI) and enforce the core principles of fairness, equality and justice in the rollout and use of such AI products and services.

The request for information for digital data brokers will be published in the Federal Register, and the public will have until June 13, 2023 to submit comments.