CFPB Signals New FCRA Rules Targeting Data Brokers Are Ahead

On April 2, 2024, CFPB Director Rohit Chopra delivered prepared remarks at a gathering hosted by the White House Office of Science and Technology Policy. Director Chopra’s remarks centered on the evolving landscape of data brokerage and its implications for individual privacy and national security and the CFPB’s plans to protect the public “from harmful data broker practices” by proposing new rules under the FCRA.

Chopra discussed a recent Executive Order signed by President Biden and highlighted its significance in addressing the risks associated with unauthorized data collection and resale by commercial entities. Quoting the Executive Order, Director Chopra outlined the Biden administration’s concerns surrounding the misuse of Americans’ sensitive personal data, noting that such data could be exploited for “intrusive surveillance, scams, blackmail, and other violations of privacy.”

Director Chopra then noted that the CFPB aims to address these concerns by proposing new rules this year, referencing proposals the agency is considering that would expand the FCRA’s reach to expressly encompass data brokers involved in the sale and aggregation of certain consumer data. As Director Chopra highlighted in earlier statements, a crucial element of the proposals under consideration is the recategorization of data brokers selling certain types of consumer data as “consumer reporting agencies” under the FCRA.

Takeaways

Director Chopra’s remarks serve as a reminder that the CFPB is set to expand the FCRA’s reach to expressly encompass data brokers, potentially reshaping the data brokerage industry by imposing new and significant compliance obligations.

Data brokers should carefully consider these and prior statements from the CFPB and explore how their business models may be impacted if data brokers are characterized as “consumer reporting agencies.”