CFPB Personal Financial Data Rights Rule Promotes Competition While Safeguarding Consumer Rights

October 22, 2024 — Press Release

Rule Serves as Model for Consumer Data Privacy

WASHINGTON – Today, the Consumer Financial Protection Bureau (CFPB) issued a comprehensive and protective final Personal Financial Data Rights Rule. Advocates at the National Consumer Law Center (NCLC) strongly support the rule, which implements Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act and gives consumers the right to share their financial account information with third parties while promoting privacy.

The new rule will provide significant benefits by making it easier for consumers to switch banks or other financial services providers. The rule makes existing account data such as direct deposits and regular bills portable. It will also promote new methods of assessing creditworthiness, such as “cash flow underwriting,” that use bank account history instead of traditional credit reports and scores.

“The Personal Financial Data Rights Rule will facilitate competition with the Big Three credit bureaus, which have long operated as an oligopoly that gives consumers no choice,” said Chi Chi Wu, senior attorney at NCLC. “This new rule also gives consumers greater control over what data is used and how. It should serve as a model for all data privacy regimes in the United States. It far exceeds the protection of weaker privacy laws that preceded it, such as the Gramm-Leach-Bliley Act.”

While giving consumers the right to share their data, the rule also provides a number of strong protections to consumers when they grant permission to businesses to access their data, including:

• a limitation that the business only collect data that is reasonably necessary to provide the product or service requested by the consumer;
• a prohibition against the business using the data for other, secondary purposes such as cross-marketing;
• a right to revoke their permission anytime, which then requires the business to delete the data; and
• a limitation that any permission lasts at most for one year and then requires renewal for continued use.

The CFPB’s new rule requires banks and lenders to share information from deposit (e.g., checking and savings) accounts and credit card accounts when consumers request such sharing. NCLC advocates had urged the CFPB to extend the rule to other businesses such as mortgage servicers, payroll processing providers and most critically, providers of Electronic Benefits Transfer (EBT) accounts used to pay public benefits.

“EBT recipients, who are often unbanked, should have the ability and right to share their data as much as other consumers,” said Carla Sanchez-Adams, senior attorney at NCLC. “We urge the CFPB to extend the important right in the Personal Financial Data Rights Rule and its strong protections to low-income Americans who rely on their EBT accounts for their critical financial transactions.”

Related Resources

• Comments to the CFPB’s Proposed Section 1033 Rule, Personal Financial Data Rights, Dec. 28, 2023
• Comments Requesting the Inclusion of Electronic Benefits Transfer (EBT) Accounts to CFPB’s Rulemaking on Personal Financial Data Rights, Dec. 19, 2023
• Letter to the CFPB Requesting Inclusion of EBT Users in Section 1033 Rulemaking, July 27, 2023
• Comments to the CFPB’s Outline of Proposals to Implement Section 1033, Consumer Access to Financial Records, Small Biz Review, Jan. 25, 2023