Required Rulemaking on Personal Financial Data Rights; Industry Standard-Setting

<RULE> CONSUMER FINANCIAL PROTECTION BUREAU <SUBAGY>12 CFR Part 1033</SUBAGY> <DEPDOC>[Docket No. CFPB-2023-0052]</DEPDOC> <RIN>RIN 3170-AA78</RIN> <SUBJECT>Required Rulemaking on Personal Financial Data Rights; Industry Standard-Setting</SUBJECT> <HD SOURCE="HED">AGENCY:</HD> Consumer Financial Protection Bureau. <HD SOURCE="HED">ACTION:</HD> Final rule. <SUM> <HD SOURCE="HED">SUMMARY:</HD> The Consumer Financial Protection Bureau (CFPB) is finalizing in part its proposed rule on consumer data rights under section 1033 of the Consumer Financial Protection Act. This final rule establishes minimum attributes a standard-setting body must possess to receive CFPB recognition and to issue consensus standards when the full rule is finalized. The CFPB is also releasing its process for how standard setters apply for CFPB recognition. </SUM> <EFFDATE> <HD SOURCE="HED">DATES:</HD> This final rule is effective July 11, 2024. </EFFDATE> <FURINF> <HD SOURCE="HED">FOR FURTHER INFORMATION CONTACT:</HD> George Karithanom, Regulatory Implementation and Guidance Program Analyst, Office of Regulations, at 202-435-7700 or <E T="03">https://reginquiries.consumerfinance.gov/.</E> If you require this document in an alternative electronic format, please contact <E T="03">CFPB_Accessibility@cfpb.gov.</E> </FURINF> <SUPLINF> <HD SOURCE="HED">SUPPLEMENTARY INFORMATION:</HD> <HD SOURCE="HD1">I. Summary</HD> The CFPB is finalizing certain provisions of its Required Rulemaking on Personal Financial Data Rights (Personal Financial Data Rights rule), <SU>1</SU> <FTREF/> which, among other proposed provisions in the rule, sought to promote fair, open, and inclusive industry standard-setting. The CFPB proposed that standards adopted by CFPB-recognized standard setters might be used to facilitate implementation of a final Personal Financial Data Rights rule. Today's rule revises and finalizes part of proposed § 1033.131 (definitions) and all of proposed § 1033.141 (attributes a standard-setting body must demonstrate in order to be recognized by the CFPB). Included with this rule is a step-by-step guide for how standard setters apply for recognition and how the CFPB will evaluate applications. <FTNT> <SU>1</SU>  88 FR 74796 (Oct. 31, 2023). </FTNT> <HD SOURCE="HD1">II. Background</HD> <HD SOURCE="HD2">A. Introduction</HD> Consumer electronic access to personal financial data, including and especially open banking, <SU>2</SU> <FTREF/> holds the potential to intensify consumer-friendly competition and innovation. Fair, open, and inclusive industry standard-setting play a critical role in ensuring the open banking system reaches its full potential to benefit consumers and competition. <FTNT> <SU>2</SU>  This <E T="04">Federal Register</E> document generally uses the term “open banking” to refer to the network of entities sharing personal financial data with consumer authorization. Some stakeholders use the term “open finance” because of the role of nondepositories as important data sources. The CFPB views the two terms as interchangeable, but generally uses “open banking” because that term is more commonly used in the United States. </FTNT> By including section 1033 in the Consumer Financial Protection Act of 2010 (CFPA), <SU>3</SU> <FTREF/> Congress explicitly recognized the importance of personal financial data rights, and section 1033(d) recognizes the importance of standardized formats, especially with regard to data formats. In 2023, the CFPB issued a proposed rule to begin implementing section 1033, with the goal of accelerating the shift to a more open and decentralized system of consumer data access. <FTNT> <SU>3</SU>  The CFPA is title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act, Public Law 111-203, 124 Stat. 1376, 2008 (2010). </FTNT> The proposed rule reflected the CFPB's preliminary determination that conformance with industry standards would constitute certain evidence of compliance with various substantive provisions of the proposed rule (or, in the case of data formats, would be sufficient for a data provider to be deemed compliant), provided that such standards were issued by a body recognized by the CFPB as possessing certain attributes. The proposed rule set forth the CFPB's view that industry standard setters that operate in a fair, open, and inclusive manner have a critical role to play in ensuring a safe, secure, reliable, and competitive data access framework. In the proposed rule, the CFPB noted that Federal regulations with very granular technical requirements could rapidly become obsolete, while industry-led standard-setting would be better able to keep pace with changes in the market and technology, as long as that standard-setting was fair, open, and inclusive. U.S. government agencies have been historically involved in the development and use of standards to meet agency missions and priorities. Office of Management and Budget (OMB) Circular A-119  <SU>4</SU> <FTREF/> reflects the U.S. government's commitment to a U.S. industry-led, voluntary consensus standards system. Broad use of such standards enhances the safety and security of products, reduces consumer costs, and expands consumers' options in the marketplace. Additionally, voluntary consensus standards ensure that no faction of industry can use its market power to impose its preferences on the entire market. Further, the use of consensus standards significantly reduces costs to agencies that would otherwise be incurred if agencies had to develop and maintain agency-unique standards. <FTNT> <SU>4</SU>  OMB Circular A-119 was originally published in 1996; <E T="03">see https://www.govinfo.gov/content/pkg/FR-1996-12-27/html/96-32917.htm.</E> The current Circular, effective January 27, 2016, is available at <E T="03">https://www.whitehouse.gov/wp-content/uploads/2020/07/revised_circular_a-119_as_of_1_22.pdf.</E> </FTNT> <HD SOURCE="HD2">B. Summary of the Rulemaking Process</HD> <HD SOURCE="HD3">Outreach and Engagement</HD> The CFPB published its proposed rule on October 31, 2023. <SU>5</SU> <FTREF/> The public comment period on the proposed rule closed on December 29, 2023, and the CFPB received comments from individuals and entities representing various diverse interests. In addition, the CFPB also considered comments received after the comment period closed via ex parte submissions and meetings. <SU>6</SU> <FTREF/> Materials on the record, including all ex parte submissions and summaries of ex parte meetings, are available on the public docket for this rulemaking. <SU>7</SU> <FTREF/> <FTNT> <SU>5</SU>  88 FR 74796 (Oct. 31, 2023). A description of the CFPB's outreach and engagement before issuing the proposed rule, including the CFPB's convening of a small business advisory review panel pursuant to the Small Business Regulatory Enforcement Fairness Act of 1996, is included in the proposal at 74801-02. </FTNT> <FTNT> <SU>6</SU>  CFPB, Policy on Ex Parte Presentations in Rulemaking Proceedings, 82 FR 18687 (Apr. 21, 2017). </FTNT> <FTNT> <SU>7</SU>   <E T="03">See</E> <E T="03">https://www.</E> <E T="03">https://www.regulations.gov/docket/CFPB-2023-0052/comments.</E> </FTNT> This final rule discusses those substantive comments relevant to the attributes of standard-setting bodies or the process by which the CFPB will recognize standard-setting bodies. For the most part, commenters that addressed the issues discussed in this final rule and in the appended application procedures supported the CFPB's plan to recognize standard setters that are fair, open, and inclusive, and generally agreed with the attributes the CFPB proposed to use to determine whether a standard-setting body was fair, open, and inclusive. Some commenters requested that the CFPB alter, clarify, or remove specific provisions of the proposed attributes, or made suggestions for how the CFPB should make its determination as to whether to recognize a given standard-setting body. Other commenters argued that the CFPB does not have legal authority to recognize standard-setting bodies, or critiqued how the proposed rule described a potential recognition process. The CFPB has considered these comments in adopting this final rule. The CFPB will discuss and address all other substantive comments when it finalizes the remainder of the Personal Financial Data Rights rule, including the many comments received concerning the role that adherence to a consensus standard should or should not play in evaluating compliance with the particular underlying provisions of the final rule. <SU>8</SU> <FTREF/> Comments focused on the application procedures described in the appendix are discussed in section IV.C. <FTNT> <SU>8</SU>  Accordingly, the CFPB does not expect its finalization of the remainder of the Personal Financial Data Rights rule to affect the content of this rule. If in finalizing the remainder of the rule the CFPB concludes that this rule should be amended, the CFPB would do so. </FTNT> Prior to issuing this final rule, in accordance with CFPA sections 1033(e) and 1022(b)(2)(B), the CFPB consulted on several occasions with staff from the prudential regulators  <SU>9</SU> <FTREF/> and the Federal Trade Commission to discuss various aspects of the proposed rule, including criteria for and processes with respect to standard-setting bodies. <FTNT> <SU>9</SU>  Prudential regulators refer to the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, National Credit Union Association, and Office of the Comptroller of the Currency. </FTNT> <HD SOURCE="HD1">III. Legal Authority</HD> The CFPB is issuing this final rule pursuant to its authority under the CFPA. As set forth in section 1021 of the CFPA, Congress established the CFPB to ensure that “all consumers ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Preview showing 10k of 61k characters. Full document text is stored and available for version comparison. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━