It’s clear that data brokers are the new primary target for regulators.

We recently highlighted the California rule which increased the registration fee for data brokers from $400 to $6,600 a year. But, it’s not only states looking at the data broker industry, the CFPB is jumping in with both feet.

It was announced today that the CFPB is releasing a Notice of Proposed Rulemaking “to stop data brokers from enabling scammers, stalkers, and spies, undermining our personal safety and America’s national security.” This sounds great. Who is not against protecting America’s national security?

If only it were that simple.

The CFPB is proposing a rule under the Federal Credit Reporting Act or FCRA. This expansion of the FCRA is attempting to do three things:

1. Curtail the “widespread evasion of longstanding law” where data brokers don’t believe they are subject to FCRA as credit reporting agencies.
2. Ban the misuse of sensitive personal identifiers
3. Preserve legally established pathways for law enforcement

But, the CFPB’s own factsheet says they hope the proposed rule will prevent “predatory marketing and data misuse”.

Hmmmm…..this seems vague. But, I am sure it won’t be used to target lawful businesses that help consumers. Right? Right????

But, let’s make sure we stop terrorists from getting credit reports.

I’m not against preventing terrorists from getting credit reports. I don’t believe that stalkers shouldn’t have access to my personal information. But, FCRA covers this already.

Enforce the law as it is. Or have Congress enact a law that does what you want.

What this really feels like is the CFPB’s attempt to do an end around past Congress’s inability to enact a national privacy law.

So, the CFPB appears to be taking it upon themselves to do it. But, that’s not the world we live in any more. Agency deference is dead. The person appointed by the incoming administration to eliminate government waste has publicly said he wants to “delete” the CFPB. This is not going to end well.

But, look at the big picture here.

The initial takeaway from the public announcements is if you are engaged in collecting, selling, or sharing consumer information, you have to realize that the government doesn’t like your business.

And the government wants to put you out of business.

Period.

But, it’s in the name of national security. At least that’s what they say.