CFPB Seeks Information on Data Brokers and Related Business Practices | Practical Law

CFPB Seeks Information on Data Brokers and Related Business Practices | Practical Law

The Consumer Financial Protection Bureau (CFPB) is requesting information regarding data brokers and other business practices involving the collection and sale of consumer information.

CFPB Seeks Information on Data Brokers and Related Business Practices

Practical Law Legal Update w-038-8766 (Approx. 4 pages)

CFPB Seeks Information on Data Brokers and Related Business Practices

by Practical Law Finance
Published on 21 Mar 2023 • USA (National/Federal)
The Consumer Financial Protection Bureau (CFPB) is requesting information regarding data brokers and other business practices involving the collection and sale of consumer information.
On March 15, 2023, the Consumer Financial Protection Bureau (CFPB) issued a request for information regarding data brokers and other business practices involving the collection and sale of consumer information. In a press release announcing the inquiry, CFPB Director Rohit Chopra stated, "Modern data surveillance practices have allowed companies to hover over our digital lives and monetize our most sensitive data. Our inquiry will inform whether rules under the Fair Credit Reporting Act reflect these market realities." The Consumer Financial Protection Act of 2010 (CFPA) (12 U.S.C. § 5531) authorizes the CFPB to address unfair acts or practices related to consumer data and to make rules for and enforce the provisions of the Fair Credit Reporting Act (FCRA) (15 U.S.C. §§ 1681 to 1681x).
The request for information notes as background that:
  • "Data brokers" is an umbrella term to describe firms that collect, aggregate, sell, resell, license, or otherwise share consumers' personal information with other parties.
  • Data brokers collect information from public and private sources for purposes including marketing and advertising, building and refining proprietary algorithms, credit and insurance underwriting, consumer-authorized data porting, fraud detection, criminal background checks, identity verification, and people search databases.
  • The data broker industry is growing and expanding its reach into new spheres of consumers' personal lives, as more sophisticated computerization has increased the power of these companies to track and predict consumer behavior.
  • Data brokers collect or share a vast range of information, often building profiles of individuals by delving into the details of consumers' everyday interactions, including credit card purchases and web browsing activity. They also collect other types of sensitive and intimate personal information such as genetic and health information, religious affiliation, financial records, and geolocation data.
Numerous consumer harms and abuses related to data brokers' operations have been identified, including:
  • Significant privacy and security risks.
  • Facilitation of harassment and fraud.
  • Lack of consumer knowledge and consent.
  • Spread of inaccurate information.
The CFPB is requesting that stakeholders and individuals who have interacted with or been affected by data broker business practices submit responses to a number of market-level and individual questions, including:
  • What types of data do data brokers collect, aggregate, sell, resell, license, derive marketable insights from, or otherwise share?
  • What sources do data brokers rely on to collect information?
  • What specific types of information do data brokers receive from financial institutions?
  • What specific entities and types of entities have relationships with data brokers?
  • How do companies collect consumer data to create, build, or refine proprietary algorithms?
  • Can people avoid having their data collected?
  • Can people reasonably avoid adverse consequences resulting from data collection across different contexts?
  • Which specific entities and types of entities purchase data from data brokers, and how do these entities use the purchased data?
  • What data broker practices cause harms to people?
  • What actions can people take to gain knowledge or control over data, or correct data that is collected, aggregated, sold, resold, licensed, or otherwise shared about them?
  • What information do State-level data broker registries provide?
  • What controls do data brokers implement to protect people's data and safeguard the privacy and security of the public?
  • What controls do data brokers implement to ensure the quality and accuracy of data they have collected?
On June 13, 2023, the CFPB extended the public comment deadline on this request for information from June 13, 2023 to July 15, 2023.