Protecting Americans From Harmful Data Broker Practices (Regulation V)

CONSUMER FINANCIAL PROTECTION BUREAU <CFR>12 CFR Part 1022</CFR> <DEPDOC>[Docket No. CFPB-2024-0044]</DEPDOC> <RIN>RIN 3170-AB27</RIN> <SUBJECT>Protecting Americans From Harmful Data Broker Practices (Regulation V)</SUBJECT> <HD SOURCE="HED">AGENCY:</HD> Consumer Financial Protection Bureau. <HD SOURCE="HED">ACTION:</HD> Proposed rule; request for public comment. <SUM> <HD SOURCE="HED">SUMMARY:</HD> The Consumer Financial Protection Bureau (CFPB) is issuing a proposed rule for public comment to amend Regulation V, which implements the Fair Credit Reporting Act (FCRA). The proposed rule would implement the FCRA's definitions of consumer report and consumer reporting agency as well as certain of the FCRA's provisions governing when consumer reporting agencies may furnish, and users may obtain, consumer reports. The proposed rule is designed to, among other things, ensure that the FCRA's protections are applied to sensitive consumer information that the statute was enacted to protect, including information sold by data brokers. </SUM> <EFFDATE> <HD SOURCE="HED">DATES:</HD> Comments must be received on or before March 3, 2025. </EFFDATE> <HD SOURCE="HED">ADDRESSES:</HD> You may submit comments, identified by Docket No. CFPB-2024-0044 or RIN 3170-AB27, by any of the following methods: • <E T="03">Federal eRulemaking Portal: https://www.regulations.gov.</E> Follow the instructions for submitting comments. A brief summary of this document will be available at <E T="03">https://www.regulations.gov/docket/CFPB-2024-0044.</E> • <E T="03">Email: 2024-NPRM-CONSUMER-REPORTING@cfpb.gov.</E> Include Docket No. CFPB-2024-0044 or RIN 3170-AB27 in the subject line of the message. • <E T="03">Mail/Hand Delivery/Courier:</E> Comment Intake—Protecting Americans from Harmful Data Broker Practices (Regulation V), c/o Legal Division Docket Manager, Consumer Financial Protection Bureau, 1700 G Street NW, Washington, DC 20552. <E T="03">Instructions:</E> The CFPB encourages the early submission of comments. All submissions should include the agency name and docket number or Regulatory Information Number (RIN) for this rulemaking. Because paper mail is subject to delay, commenters are encouraged to submit comments electronically. In general, all comments received will be posted without change to <E T="03">https://www.regulations.gov.</E> All submissions, including attachments and other supporting materials, will become part of the public record and subject to public disclosure. Proprietary information or sensitive personal information, such as account numbers or Social Security numbers, or names of other individuals, should not be included. Submissions will not be edited to remove any identifying or contact information. <FURINF> <HD SOURCE="HED">FOR FURTHER INFORMATION CONTACT:</HD> George Karithanom, Regulatory Implementation and Guidance Program Analyst, Office of Regulations, at 202-435-7700 or <E T="03">https://reginquiries.consumerfinance.gov/.</E> If you require this document in an alternative electronic format, please contact <E T="03">CFPB_Accessibility@cfpb.gov.</E> </FURINF> <SUPLINF> <HD SOURCE="HED">SUPPLEMENTARY INFORMATION:</HD> Data brokers, including consumer reporting agencies, collect information about, among other things, the credit, criminal, employment, and rental histories of hundreds of millions of Americans. They analyze and package this information into reports used by creditors, insurers, landlords, employers, and others to make decisions about consumers. This collection, assembly, evaluation, dissemination, and use of vast quantities of often highly sensitive personal and financial data about consumers poses a significant threat to consumer privacy. It can also threaten national security and facilitate numerous tangible consumer harms, such as financial scams and the identification of victims for stalking and harassment. Congress enacted the Fair Credit Reporting Act (FCRA)  <SU>1</SU> <FTREF/> in part to protect consumer privacy by regulating the communication of consumer information by consumer reporting agencies. The statute subjects such communications, which are referred to as consumer reports, to certain requirements and limitations, and it affords certain protections to consumers. For example, the FCRA imposes clear bright-line rules permitting people to obtain consumer reports from consumer reporting agencies only for certain specified purposes, known as permissible purposes, and forbidding consumer reporting agencies from furnishing consumer reports to users who lack a permissible purpose. In addition, consumers have various rights under the FCRA, such as the right to dispute the accuracy of information in their file and to be notified when, for example, a creditor, landlord, or employer relies on consumer report information to make a negative decision about the consumer's application for credit, housing, or employment. <FTNT> <SU>1</SU>  15 U.S.C. 1681 <E T="03">et seq.</E> </FTNT> In recent years, the consumer reporting marketplace has evolved in ways that imperil Americans' privacy. There is an emerging consensus that intrusive surveillance and aggregation of sensitive data about consumers can create conditions for harming national security by exposing information that could be exploited by countries of concern. <SU>2</SU> <FTREF/> Stalkers and domestic abusers can also obtain sensitive contact information from data brokers to contact or locate people who do not wish to be contacted or located, such as domestic violence survivors. In addition, vast troves of sensitive data, including, for example, individualized data about a consumer's finances, are bought and sold, without consumers' knowledge or consent, by data brokers who believe that the FCRA does not apply to them or to some of their activities. This data can be leveraged to scam or defraud people. Data brokers evading coverage under the FCRA include traditional consumer reporting agencies and recent market entrants using new business models and technologies to collect and analyze consumer information on an unprecedented scale. The CFPB is proposing this rule to address when a data broker is covered by the FCRA, and to protect Americans from the harms and invasions of privacy created by certain data broker activities that violate the FCRA. <FTNT> <SU>2</SU>   <E T="03">See, e.g.,</E> E.O. No. 14117, 89 FR 15421 (Feb. 28, 2024); Justin Sherman et al., <E T="03">Data Brokers and the Sale of Data on U.S. Military Personnel: Risks to Privacy, Safety, and National Security</E> (Nov. 2023) (hereinafter Duke Report on Data Brokers and Military Personnel Data), <E T="03">https://techpolicy.sanford.duke.edu/wp-content/uploads/sites/4/2023/11/Sherman-et-al-2023-Data-Brokers-and-the-Sale-of-Data-on-US-Military-Personnel.pdf.</E> </FTNT> <HD SOURCE="HD1">I. Summary of the Proposed Rule</HD> The CFPB proposes to implement the FCRA's definitions of consumer report and consumer reporting agency in several respects to ensure that the FCRA's protections apply to all data brokers that transmit the types of consumer information that Congress designed the statute to protect, and to the types of activities that Congress designed the statute to regulate. For example, the proposed rule: • Provides that data brokers that sell information about a consumer's credit history, credit score, debt payments (including on non-credit obligations), or income or financial tier generally are consumer reporting agencies selling consumer reports, regardless of the purpose for which any specific communication of such information is used or expected to be used; • Provides that a communication by a consumer reporting agency of a portion of the consumer report that consists of personal identifiers such as the consumer's name, address, or age, is a consumer report if the information was collected for the purpose of preparing a consumer report about the consumer; • Includes provisions intended to prevent privacy harms associated with the re-identification of de-identified consumer report information; • Provides that a communication by a consumer reporting agency of information about a consumer is a consumer report if the information is used for an FCRA-covered purpose, regardless of whether there is evidence that the consumer reporting agency knew or expected that the information would be used for such a purpose; • Provides that an entity that otherwise meets the definition of consumer reporting agency is a consumer reporting agency if it assembles or evaluates information about consumers, including by collecting, gathering, or retaining; assessing, verifying, or validating; or contributing to or altering the content of such information. The CFPB also proposes to address certain aspects of FCRA section 604(a) regarding permissible purposes to furnish and obtain consumer reports. These proposals are designed to ensure that consumer reports are furnished for permissible purposes under the FCRA, and for no other reasons. For example, the proposed rule: • Provides that a consumer reporting agency furnishes a consumer report to a person when the consumer reporting agency facilitates the person's use of the consumer report for the person's financial gain, even if the consumer reporting agency does not technically transfer the consumer report to the person; • Provides that the FCRA provision that authorizes a consumer reporting agency to furnish a consumer report in accordance with the written instructions of the consumer can be used to obtain a consumer report for any reason specified by a consumer, but only if the consumer signs a separate authorization that is not hidden in fine print and that discloses certain information to the consumer, including the reason for obtaining the report; and • Provides that the FCRA's permissible purpo ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Preview showing 10k of 472k characters. Full document text is stored and available for version comparison. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━