CFPB Announces Plans to Propose Rules to Regulate “Data Brokers” Under FCRA

On August 15, 2023, the Consumer Financial Protection Bureau (CFPB) – a United States Government agency that enforces the federal Fair Credit Reporting Act (FCRA) that regulates background checks in America – announced plans to propose rules to regulate “data brokers” under the FCRA to protect the public from what the CFPB defines as the “surveillance” industry.

“After conducting an inquiry into the practices of data brokers in the surveillance industry, we have decided to launch a rulemaking to ensure that modern-day digital data brokers are not misusing or abusing our sensitive data,” CFPB Director Rohit Chopra remarked at a White House roundtable on protecting Americans from harmful data broker practices.

“To ensure that modern-day data companies assembling profiles about us are meeting the requirements under the Fair Credit Reporting Act, the CFPB will be developing rules to prevent misuse and abuse by these data brokers,” CFPB Director Chopra stated. “Two of the proposals under consideration are worth highlighting here,” he added before explaining them.

• First, our rules under consideration will define a data broker that sells certain types of consumer data as a “consumer reporting agency” to better reflect today’s market realities. The CFPB is considering a proposal that would generally treat a data broker’s sale of data regarding, for example, a consumer’s payment history, income, and criminal records as a consumer report, because that type of data is typically used for credit, employment, and certain other determinations. This would trigger requirements for ensuring accuracy and handling disputes of inaccurate information, as well as prohibit misuse.
• A second proposal under consideration will address confusion around whether so called “credit header data” is a consumer report. Much of the current data broker market runs on personally identifying information taken from traditional credit reports, such as those sold by the big three credit reporting conglomerates – Equifax, Experian, and TransUnion. This includes key identifiers like name, date of birth, and Social Security number that are contained in consumer reports generated by the credit reporting companies. The CFPB expects to propose to clarify the extent to which credit header data constitutes a consumer report, reducing the ability of credit reporting companies to impermissibly disclose sensitive contact information that can be used to identify people who don’t wish to be contacted, such as domestic violence survivors.

“Next month, the CFPB will publish an outline of proposals and alternatives under consideration for a proposed rule. We plan to propose the rule for public comment in 2024. We look forward to obtaining public input on the proposals under consideration,” CFPB Director Chopra stated. Any updated rules under the Fair Credit Reporting Act can be enforced by the CFPB.

“In 1970, Congress enacted the Fair Credit Reporting Act, which granted people new rights and protections, including safeguards to ensure accurate information, the right to dispute errors, the right to access your own information, and restrictions on how others can use your information,” CFPB Director Chopra explained about the FCRA.

ClearStar is a consumer reporting agency (CRA) as defined by the FCRA and a leading global Human Resources technology company specializing in background checks, drug testing, and occupational health screening. ClearStar offers employers various compliance services that include a full understanding of the FCRA. To learn more about ClearStar, contact us.

© 2023 ClearStar. All rights reserved. – Making copies of or using any part of the ClearStar website for any purpose is prohibited unless written authorization is first obtained from ClearStar. ClearStar does not provide or offer legal services or legal advice of any kind or nature. Any information on this website is for educational purposes only.

Thomas Ahearn - Digital Content Editor

Thomas Ahearn is a Digital Content Editor at ClearStar, a leading Human Resources (HR) technology company specializing in background checks, drug testing, and occupational health screening. He writes about a variety of topics in the background screening industry including Artificial Intelligence (AI), "Ban the Box," class action lawsuits, credit reports, criminal records, drug testing, Equal Employment Opportunity Commission (EEOC), Fair Credit Reporting Act (FCRA), Form I-9, identity theft, privacy, social media screening, and workplace violence.

At ClearStar, we are committed to your success. An important part of your employment screening program involves compliance with various laws and regulations, which is why we are providing information regarding screening requirements in certain countries, region, etc. While we are happy to provide you with this information, it is your responsibility to comply with applicable laws and to understand how such information pertains to your employment screening program. The foregoing information is not offered as legal advice but is instead offered for informational purposes. ClearStar is not a law firm and does not offer legal advice and this communication does not form an attorney client relationship. The foregoing information is therefore not intended as a substitute for the legal advice of a lawyer knowledgeable of the user’s individual circumstances or to provide legal advice. ClearStar makes no assurances regarding the accuracy, completeness, or utility of the information contained in this publication. Legislative, regulatory and case law developments regularly impact on general research and this area is evolving rapidly. ClearStar expressly disclaim any warranties or responsibility or damages associated with or arising out of the information provided herein.