Cybersecurity Policy Report, Fintech group urges changes to proposed California automation and privacy rule, (Feb 20, 2025)

By Steven Melendez

The American Fintech Council called on California's privacy regulator to tweak a proposed rule governing privacy and automated decision-making.

The American Fintech Council (AFC) urged the California Privacy Protection Agency (CPPA) to make changes to a proposed rule that would govern consumer privacy in relation to automated decision-making technology (ADMT).

The rule, proposed under the California Consumer Privacy Act (CCPA), contains ambiguities that could limit Californians' access to innovative financial tools if it is enacted as initially proposed, the group warned.

"The CPPA’s proposed rule represents an important step in ensuring consumer protections in the digital economy, but it must also consider the practical realities of responsible financial innovation," said Phil Goldfeder, CEO of the American Fintech Council. "Regulations should promote transparency and accountability while allowing responsible fintech companies to continue delivering safe, efficient, and inclusive financial products. We encourage the CPPA to refine its approach to ADMT and privacy requirements to ensure that well-intended provisions do not inadvertently restrict access to essential financial services."

In a Feb. 19, 2025, comment letter submitted to the CPPA, the AFC applauded some aspects of the proposed rule, including a provision consolidating notice requirements "to help streamline the user experience," exemptions from requirements to provide consumers explanations of automated security and anti-fraud measures, and a provision exempting businesses from having to conduct new cybersecurity audits if they've already conducted one meeting the rule's requirements.

But the fintech group expressed concern about a provision requiring businesses to identify the "approximate number of consumers whose personal information the business seeks to process," which the AFC called ambiguous. Accurately identifying the number of consumer potentially affected could be difficult when entering into new markets or offering new products and services, the group said. The AFC called on regulators to loosen the requirement or provide guidance in such situations.

The AFC additionally warned that a provision requiring disclosure by businesses offering automated decision-making technology to other businesses could also be ambiguous. Exactly what information needs to be disclosed is unclear under the proposed rule, the group said, calling for better guidance. Similarly, the AFC suggested an exemption from consumer disclosure requirements for proprietary information and trade secrets.

Additionally, the AFC warned a “prohibition against processing if risks to consumers’ privacy outweigh benefits” is also ambiguous. Trying to comply might lead to businesses being more risk averse than they need to be, meaning California consumers might not have access to some products and services, the group warned. The AFC called on the CPPA to specify how such a cost-benefit analysis should be conducted.

The group also asked that the CPPA consider exempting training of decision-making technology from data uses that consumers can opt out of. Letting consumers opt out would lead to significant costs and could make it harder for lenders to train models in a way that mitigates risk and potential bias, the group argued.

Companies: American Fintech Council

RegulatoryActivity: CaliforniaNews CyberPrivacyFeed DataPrivacy DataSecurity FinTech Privacy StateBankingLaws