Banking and Finance Law Daily Wrap Up, PRIVACY—Banking industry responds favorably to changes to CFPB personal data rule, (Aug 22, 2025)

By Thomas Thompson

Banking trade groups announce support for prospective revisions to current personal data sharing rules that the CFPB’s leaders think may overstep the law.

On Friday, August 22, the Consumer Financial Protection Bureau published an advance notice of proposed rulemaking (ANPR) in the Federal Register in which it says that the bureau is reviewing the Personal Financial Data Rights final rule (PFDR Rule) which it adopted on November 18, 2024 in accordance with section 1033 of the Dodd-Frank Act.

A national bank policy group, a state banking trade association and a local Kentucky bank sued the bureau in federal court in Kentucky asserting, among other things, that the bureau had exceeded its authority with the PFDR Rule. Subsequently, the bureau informed the court that its leadership had determined that the PFDR Rule should be set aside. In a later statement the bureau told the court that it would reconsider its rule.

The CFPB’s proposal requests answers to 36 questions as the bureau considers four issues: the proper understanding of who can serve as a “representative,” how best to assess fees to defray costs, the threat and cost-benefit pictures for data security, and the threat picture for data privacy associated with section 1033 compliance. The ANPR does not provide guidance on how the bureau may changes the current PFDR Rule.

Industry response. Already on August 21, major banking trade associations presented themselves ready to address the ANPR.

In response to the agency’s announcement, the original litigants in the Kentucky court case, the Bank Policy Institute, Kentucky Bankers Association and Forcht Bank, said in an Institute press release, “This rulemaking presents an opportunity for the CFPB to right the problems of the Biden-era rule by sticking to its statutory authority and putting consumers’ security first. Banks are advocating for a solution that both protects consumers and preserves marketplace innovation already underway, and we look forward to working with the Administration on its efforts to revise the problematic 2024 rule.”

In a press release welcoming revisions to the PFDR Rule the Consumer Bankers Association (CBA) expressed its view that that current PFDR Rule “created real risks of fraud, breaches and consumer harm.” The group also noted that is ready to partner with the bureau “on a revised framework that balances consumer access with strong safeguards …” The CBA is a national association that focuses exclusively on retail banking.

In their own statement the American Bankers Association welcomed the ANPR “as the beginning of a process that will substantially revise the rule and put consumer safety and control back at the center of the conversation.” The bankers also said, “We look forward to working constructively with the Bureau towards a 1033 rule that truly empowers and protects consumers while delivering the responsible innovation they want and need.”

The Independent Community Bankers of America said in its press release that community bankers will “continue to work with the CFPB to minimize the impact of its rule on consumer privacy, regulatory compliance burden, data security, and the legal complications presented by permissioned third-party access to consumer bank accounts—in line with ICBA’s “Repair, Reform, and Thrive” plan for the 119th Congress and Trump administration.”

Companies: American Bankers Association; Consumer Bankers Association; Independent Community Bankers of America

RegulatoryActivity: BankingOperations CFPB CreditDebitGiftCards CyberPrivacyFeed DataPrivacy DataSecurity DoddFrankAct FinancialStability Privacy