National Public Data Breach Shows Urgent Need for CFPB to Regulate Data Brokers

August 19, 2024 — Press Release

Advocates advise consumers to freeze their credit reports

WASHINGTON – In the wake of the massive data breach of National Public Data (NPD), advocates from the National Consumer Law Center (NCLC) urged the Consumer Financial Protection Bureau (CFPB) to complete its proposed rule to regulate data brokers. NPD is a data broker that sells criminal records and background checks and recently acknowledged that it had been hacked. According to media reports, as many as 2.9 billion pieces of personal information may have been stolen, including names, addresses, email addresses, and Social Security numbers

In September 2023, the CFPB outlined a proposal to regulate data brokers such as NPD by treating them as “consumer reporting agencies” under the Fair Credit Reporting Act (FCRA). Regulating data brokers under the FCRA would require them to follow the Safeguards Rule issued by the Federal Trade Commission (FTC), which would require NPD to establish and maintain an information security program. FCRA coverage would also require NPD to ensure that anyone seeking to obtain records from the company have a “permissible purpose” under the FCRA, such as an application for credit or employment by the consumer, and follow procedures to ensure accuracy of its information (which media reports indicate was spotty at best).

“The massive data breach at National Public Data demonstrates why the CFPB must proceed quickly with regulating data brokers under the FCRA,” said Chi Chi Wu, senior attorney at the National Consumer Law Center. “Data brokers hold massive amounts of personal information for millions of Americans, which can be weaponized against us when stolen.”

“NPD states it sells data to ‘human resources [and] staffing agencies,’” said Ariel Nelson, staff attorney at NCLC. “If NPD is regularly selling background check data to employers, it should already be complying with the FCRA and the Safeguards Rule. The CFPB’s proposal to regulate data brokers will put an end to companies that hedge and dodge coverage under the FCRA. It will ensure a level playing field for background check companies that do follow the law and also promote the security, privacy, and accuracy of our personal information.”

In light of the identity theft risks posed by the NPD breach, NCLC advocates advise consumers to place a “security freeze” on their credit reports at the Big Three credit bureaus, which prevents the credit bureaus from releasing these reports for credit and other applications. “Unless you think you are going to apply for credit or an apartment in the near future, the safest option to prevent identity theft is to lock down your credit report with a freeze,” advised Wu. “In my opinion, a freeze is much more effective than other options, such as a fraud alert or credit monitoring services, in stopping identity theft.”

Related Resources

• CFPB: What does it mean to put a security freeze on my credit report?, September 2020