Cybersecurity Policy Report, CFPB report examines carveout provisions in state data privacy laws for financial institutions, (Nov 13, 2024)

By Joe Cox, J.D.

The report, which examines whether consumer financial data is sufficiently protected, condemns the sale of data by financial institutions and encourages more aggressive state oversight in privacy laws.

The Consumer Financial Protection Bureau has released a report discussing state and federal privacy protection for consumer financial data. The report focused on carveout provisions that allow financial institutions to continue to market and sell consumer data, unlike other businesses. Ultimately, the report recommends that states be more vigilant and consider removing or narrowing carveout provisions.

Report findings. The report notes that, as mentioned above, financial institutions are utilizing their access to consumer data to market or sell that data to third parties. This is despite a consensus on the value of consumer privacy rights, and financial institutions have continued to develop and implement new and pervasive measures to obtain consumer financial data.

Meanwhile, eighteen states have created new financial data protections that give consumers new rights in regard to their data. That said, all of these new laws exempt financial institutions and financial data if subject to the Fair Credit Reporting Act or the Graham-Leach-Billey Act. Accordingly, those carveouts give financial institutions greater freedom that other entities, and great gaps in financial data privacy laws.

The report encourages states to consider action to protect its citizens in instances where federal law is ineffective or has protection gaps. States, in such instances, could remove or narrow the carveout exemptions previously rendered to financial institutions or in regard to financial data.

CFPB Director Comments. CFPB Director Rohit Chopra offered his comments in support of the report. "Absent action to beef up federal privacy protections, states will need to take further action to guard against intrusive surveillance and improper monetization of our most sensitive personal financial data," said Chopra.

Chopra also identified multiple related CFPB actions which could buttress consumer rights protections. These included efforts to modernize the regulatory framework, including updating the Fair Credit Reporting Act, particularly as regards data brokers. Chopra further noted the recently enacted Personal Financial Data Right Rule, and stated that the CFPB would continue to work with Congress to enshrine additional protection of personal financial data.

RegulatoryActivity: BankingOperations CyberPrivacyFeed DataPrivacy DataSecurity FairCreditReporting FinancialIntermediaries GCNNews Privacy StateBankingLaws