Banking and Finance Law Daily Wrap Up, DODD-FRANK ACT—Kentucky bank, trade groups sue CFPB, Chopra over personal financial data rights rule, (Oct 23, 2024)

By E. Darius Sturmer, J.D.

The plaintiffs allege that the Bureau and its director violated the APA by promulgating, through arbitrary and capricious process, a final rule with provisions that exceed the agency’s authority.

Kentucky-based Forcht Bank N.A., bank trade group Kentucky Bankers Association (KBA), and research/advocacy group Bank Policy Institute (BPI) have initiated a lawsuit challenging the Consumer Financial Protection Bureau’s newly finalized personal financial data rights rule. The bank and trade groups’ complaint, filed in the federal district court in Lexington, Kentucky, asserts that the CFPB overstepped its statutory authority and finalized a rule that “jeopardizes consumers’ privacy, financial data, and account security.” (Forcht Bank, N.A. v. Consumer Financial Protection Bureau, No. 5:24-cv-00304-DCR (E.D. Ky. Oct. 22, 2024)).

The rule, promulgated to carry out the personal financial data rights established by Section 1033 of the Dodd-Frank Reform and Consumer Protection Act, imposes data availability and protection requirements upon banks, credit unions, and other financial service providers and promotes “fair, open, and inclusive” industry standards. It will become effective 60 days after its upcoming formal publication in the Federal Register, and it will be implemented for financial institutions in several phases that begin in 2026 and continue into 2030 (see Banking and Finance Law Daily, Oct. 22, 2024).

According to BPI’s President/CEO Greg Baer, however, “the CFPB delivered a rule that treats sensitive financial data with as little care as a consumer’s web browsing history. If left unchallenged, technology companies subject to little to no oversight will have access to very sensitive information, like how much is in your account and where you spend your money.” Baer added that “[b]anks have a responsibility to protect customers and their data, and this rule compromises these responsibilities, putting bank customers at risk.”

KBA President/CEO Ballard W. Cassady, Jr., likewise expressed concern that the rulemaking “jeopardizes the safety and soundness of our banking system and fails to protect consumer data.”

The complaint raises numerous specific concerns with the CFPB rule. The first problem, in the plaintiffs’ view, is that the rule requires no oversight of third parties using bank customer data, leaving the whole responsibility of protecting consumers to the banks. Next, they say, it increases the likelihood of fraud and scams by failing to address weak safeguarding practices. Third, it allows screen scraping and other unsafe practices relied on by data aggregators to persist, allowing them to collect more information than is needed to offer a core product or service. Fourth, the plaintiffs contend that the rule fails to hold third parties—whose use and protection of sensitive consumer data is outside of banks’ control—accountable when that data is breached. They allege, too, that it allows third parties to profit, at no cost, from systems built and maintained by banks. And finally, the plaintiffs protest, the rule imposes an “unreasonable implementation timeline,” as the new compliance deadline is not tied to the promulgation of any consensus standards destined to become the industry’s default standard for compliance under the rule.

Claims. The plaintiffs’ seven-count complaint accuses the CFPB and its Director, Rohit Chopra, of six different violations of the Administrative Procedure Act (APA).

First, they claim the Bureau’s promulgation of the Rule exceeded its statutory authority through its unlawfully broad interpretation of the Dodd-Frank Act’s definition of consumer.

Second, they aver that the Bureau’s promulgation of the rule was arbitrary and capricious in that it reflected a failure to engage in reasoned decision-making by placing consumer data at risk.

Third, they say the rule exceeds the Bureau’s statutory authority by mandating banks’ provision of payment-initiation information.

Fourth, the complaining bank and trade groups charge that the creation of the rule exceeded statutory authority because it unlawfully delegates regulatory authority to private standard setters.

Fifth, they assert that the defendants’ “failure to engage in reasoned decision-making with respect to compliance deadlines” was arbitrary and capricious.

And sixth, they contend that the Bureau lacked the authority “to prohibit banks from charging reasonable fees to third parties or data aggregators to access banks’ [application programming interfaces],” software-based protocols that allow two different applications to communicate with each other.

Prayer for relief. The suit seeks declaratory judgments that the Rule is in excess of the Bureau’s statutory authority within the meaning of the APA; that it is arbitrary, capricious, or otherwise contrary to law within the meaning of the APA; that its compliance deadlines are also arbitrary, capricious, or otherwise contrary to law within the meaning of the APA; and that the Rule’s prohibition on access fees both exceeds the CFPB’s authority and is arbitrary, capricious, or otherwise contrary to law within the meaning of the APA.

The plaintiffs additionally ask for an order setting aside the Rule in its entirety pursuant to the APA, an order permanently enjoining the CFPB and Rohit Chopra from enforcing the Rule against them or their members, and an order delaying the effective date and implementation of the Rule and the Standard-Setter Rule pending the conclusion of the instant case. Lastly, they request an award covering the attorney fees and costs they incurred in bringing the litigation.

Companies: Bank Policy Institute; Forcht Bank N.A.; Kentucky Bankers Association

LitigationEnforcement: BankingOperations CFPB CreditDebitGiftCards CyberPrivacyFeed DataPrivacy DataSecurity DoddFrankAct FinancialStability GCNNews KentuckyNews Privacy