Recently, the CFPB released an outline of proposed measures related to the Bureau’s Dodd-Frank Section 1033 rulemaking efforts that would allow consumers the rights over their personal financial data. The outline discusses proposed regulations that would require covered data providers to make consumer financial data available directly to a consumer and to any third parties authorized by the consumer. Under these proposed regulations, consumers would be able to easily switch financial providers and transfer their account history to a new provider. In a high-level summary of the proposed regulations, the CFPB discusses the regulatory provisions it is considering proposing, including the following:

• Coverage of data provider. Companies that have transaction-level information, which includes “financial institutions” as defined in the CFPB’s Regulation E, and “card issuers” as defined in the CFPB’s Regulation Z.

• Recipients of information. Consumers and authorized third parties.

• The types of information. (i) periodic statement information for settled transactions and deposits; (ii) information regarding prior transactions and deposits that have not yet settled; (iii) other information about prior transactions not typically shown on periodic statements or portals; (iv) online banking transactions that the consumer has set up but that have not yet occurred; and (v) account identity information.

• How and when information would need to be made available. The Bureau is considering ways to define the methods and the circumstances in which a data provider would need to make information available with respect to both direct access and third-party access.

• Third party obligations. The CFPB is considering proposals under which authorized third parties would have to limit their collection, use, and retention of consumer information to what is reasonably necessary to provide the product or service the consumer has requested.

• Record retention obligations. Proposals under consideration would establish requirements for data providers and third parties to demonstrate compliance with their obligations under the rule.

• Implementation period. The Bureau is seeking feedback on time frames to ensure consumers are able to benefit from a final rule, while also considering implementation factors for data providers and third parties.

The CFPB is seeking comments about the new rulemaking, by January 25, 2023.

Putting it Into Practice: While a final rule remains far off, companies would be well-served to consider the CFPB’s outlines and how they can satisfy these standards.