Background

Long gone are the days when a bank or finance company relies simply on a traditional credit score or report to decide whether to make a loan. For some time now, banks and consumer finance companies have sourced data from a variety of providers to prevent consumer fraud and ID theft, among other reasons. Accordingly, consumer lenders have become increasingly reliant on data brokers (and the data such brokers gather through the use of artificial intelligence (AI)) to generate business, improve their practices, and ascertain the creditworthiness of consumer credit applicants.

On August 15, as part of the White House roundtable on protecting Americans from harmful data broker practices, Rohit Chopra, the Director of the Consumer Financial Protection Bureau (CFPB), announced that the CFPB intends to publish new rules under the Fair Credit Reporting Act (FCRA) that will impact data broker practices. In discussing data aggregators and providers and the need for such rules, Director Chopra stated:

"While these firms go by many labels, many of them work to harvest data from multiple sources and then monetize individual data points or profiles about us, sometimes without our knowledge. … To ensure that modern-day data companies assembling profiles about us are meeting the requirements under the Fair Credit Reporting Act, the CFPB will be developing rules to prevent misuse and abuse by these data brokers."

As described by Director Chopra, the new rules will broaden the definition of "consumer reporting agency" to include data brokers, and expand the definition of "consumer report" to include credit header data and data sold by data brokers.

The Proposed Rules

(1) Definition of Data Brokers. Director Chopra announced that the proposed rules "will define a data broker that sells certain types of consumer data as a 'consumer reporting agency.'" As such, a broad spectrum of data, including payment histories and criminal records, will be subject to regulatory oversight. In addition, these changes will trigger numerous regulatory requirements for those who deal in, utilize or handle consumer data. For example, under the FCRA, a consumer reporting agency must ensure that a person who requests a consumer report from the consumer reporting agency has a "permissible purpose." Thus, a data broker will be unable to share a consumer report with a lender unless and until it ascertains whether the lender has a "permissible purpose" under the FCRA.

(2) Expanded Definition of "Consumer Report." Director Chopra also announced that the proposed rules will clarify that certain "credit header data" constitutes a consumer report and treat customer data purchased from data brokers as a "consumer report." This shift will also trigger numerous regulatory requirements for those who use consumer data purchased from data brokers (including nontraditional metrics gathered through the use of AI and provided by such brokers) in their business decisions. For example, under the FCRA, a lender must provide an adverse action notice to a consumer if the lender declines to approve a consumer's application for credit based upon information contained in a consumer report. Thus, if a lender uses consumer data from data brokers to ascertain whether it should transact with a consumer, and declines to approve the consumer's credit application based upon such data, the lender generally must issue an adverse action notice.

What's Next?

This month, the CFPB will publish an outline of its proposals and alternatives under consideration in connection with the proposed rule. Small businesses will have an opportunity to provide feedback through the Small Business Review Panel under the Small Business Review Act. After these small businesses submit feedback, the CFPB will release its proposed rule for public comment. Director Chopra indicated that the proposed rules will be available for public comment by 2024. Generally, agencies allow 60 days for public comment (though the period may be longer or shorter). After the period for public comment closes, the CFPB will take the submitted comments into consideration and decide whether to proceed with the proposed rule, issue a new or revised rule or withdraw the proposed rule in its entirety.

Key Takeaways

Director Chopra's announcement with respect to the anticipated rules offer a glimpse into the regulatory direction of the CFPB – toward the increased regulation of data brokers that gather myriad types of data about consumers, including data developed with the use of AI. While these rules have yet to be published, consumer finance companies and other institutions that utilize data from data brokers, and the data brokers themselves, should begin to thoughtfully consider any impact the new rules may have. Specifically, data brokers and users of data brokers' products and services should:

• assess data sources to better understand potential coverage once the proposed rules are issued;
• review contracts, policies and practices (including decision-making practices) to comply with all current and future CFPB rules and regulations; and
• consider any necessary compliance requirements to ensure adherence with final regulations (when issued).