Consumer watchdog proposes crackdown on personal data sales

The Consumer Financial Protection Bureau (CFPB) on Tuesday rolled out a new proposal aimed at cracking down on data brokers selling Americans' sensitive information.

Under the proposed rule, the agency said it seeks to ensure data brokers comply with existing privacy law by treating "them as “consumer reporting agencies."

“Companies like the nationwide consumer reporting agencies (Equifax, TransUnion, and Experian) and others are data brokers that are currently covered under the [Fair Credit Reporting Act (FCRA)], the CFPB said, adding the new proposal “would address the circumstances under which data brokers and their activities” are covered by the law.

In a press call discussing the proposal, CFPB Director Rohit Chopra said the pitched rule would make "it clear that many of these data brokers, like credit bureaus and background check companies, are subject to federal protections under the FCRA."

“This means they could no longer dodge their obligations and would need to follow the same consumer protections as major credit bureaus, including accuracy requirements and providing consumers with access to their own information.”

CFPB said the rule would clarify what comprises a consumer report. Under the proposal, the agency said data brokers that sell information like a consumer’s credit history or income would be considered “selling a consumer report.”

“Second, the rule proposes that when a data broker communicates consumer information for any reason, if a person receiving the information then uses the information for an FCRA purpose, the communication would be a consumer report,” the CFPB said.

The proposed rule also seeks to limit how some personal identifiers, like a consumer's name or Social Security number, are shared. As part of the proposal, the agency said communications from consumer reporting agencies of such information collected to prepare a consumer report "generally would be consumer reports."

“This would mean that consumer reporting agencies could only sell such information—so-called ‘credit header’ data—if the user had a permissible purpose under the FCRA,” the CFPB said, while describing certain purposes like “evaluating a consumer’s eligibility for credit, insurance” and employment.

Chopra said the proposal also seeks to ensure "that lenders and other companies could still use this data to stop identity theft and fraud," the measure "would preserve legally established pathways for law enforcement counter terrorism and counter intelligence purposes."

“The need for reform has united a remarkable coalition of voices. National security officials warn about risk to military and intelligence personnel, while veterans organizations highlight threats to service members transitioning to civilian life.”