Full Report
Jonathan McKernan spoke positively about Rohit Chopra’s rule-making targeting data brokers during a Senate Banking Committee nomination hearing. The post CFPB nominee signals openness to continuing data-broker work appeared first on CyberScoop.
Analysis Summary
# Regulation/Compliance: Proposed CFPB Data Broker Regulation under FCRA
## Overview
This summary focuses on the potential continuation and focus of data protection and accountability measures initiated by the Consumer Financial Protection Bureau (CFPB), particularly regarding data brokers and data aggregators, following statements made during a nomination hearing. The proposed rules aim to curb the selling of Americans’ personal and financial information by data brokers by classifying them as Consumer Reporting Agencies (CRAs) under the Fair Credit Reporting Act (FCRA).
## Key Details
- Issuing Authority: Consumer Financial Protection Bureau (CFPB)
- Effective Date: Varies; the underlying proposal stems from the previous administration's initiatives, with future actions pending confirmation and implementation timing.
- Jurisdiction: Federal (United States) consumer financial protection and data privacy space.
- Status: Regulatory proposals are under review, with confirmation of leadership influencing the path forward.
## Requirements
### Mandatory Requirements
1. **Classification Conformity:** Data brokers that collect and sell sensitive identifiers (SSNs, phone numbers, etc.) may be classified as Consumer Reporting Agencies (CRAs) under the **Fair Credit Reporting Act (FCRA)**.
2. **Accountability Standards:** Entities classified as CRAs must adhere to existing **FCRA accuracy and compliance standards**.
3. **Internal Data Security:** The CFPB itself, under potential new leadership, is committed to implementing policies to protect the security of confidential information obtained from the public and supervised companies (internal risk focus).
### Recommended Practices
1. **Risk Assessment:** Focus regulation and enforcement on real risks to consumers.
2. **Adversarial Risk Mitigation:** Carefully review external data transfers, especially concerning bulk sensitive information sent to adversarial foreign entities (e.g., China).
3. **Data Minimization:** Take a close look at sensitive information held on CFPB servers and retain only what is strictly necessary.
## Affected Organizations
- Industries: Financial services, Data Brokers, Data Aggregators.
- Organization Size: All entities meeting the functional criteria for data brokerage and information selling, regardless of size.
- Geographic Scope: United States, applied to entities collecting and selling data related to U.S. consumers.
## Compliance Timeline
- **Pre-Nomination/Previous Administration:** Development and proposal of rules targeting data brokers.
- **Nomination Hearing (Current Context):** New nominee indicates intent to continue focusing on data broker policy and internal CFPB data security review.
- **Final deadline:** Specific compliance deadlines for data brokers would be established upon finalization of any subsequent rule-making or enforcement actions related to the FCRA classification.
## Implementation Guidance
### Assessment Phase
- **Data Inventory:** Organizations categorized as data brokers should assess what personal and financial identifiers (SSNs, phone numbers) they collect, aggregate, and sell.
- **Legal Classification Review:** Determine if current operational scope subjects them to CRA requirements under existing or proposed FCRA amendments.
### Implementation Phase
- **FCRA Compliance Readiness:** If classified as a CRA, establish formal procedures to meet FCRA mandates related to data sourcing, accuracy, and consumer access rights.
- **Security Upgrades:** Implement enhanced security measures to protect sensitive data both in transit and at rest, particularly concerning bulk data sets.
### Validation Phase
- **Internal Audits:** Regularly audit data disposal and retention policies, especially those related to necessary data retention (data minimization principle).
- **External Review:** Prepare for potential CFPB scrutiny regarding data accuracy and compliance adherence comparable to standard CRA oversight.
## Technical Requirements
*Not explicitly detailed in the context, but implied technical requirements based on FCRA mandate:*
1. **Data Accuracy Mechanisms:** Implementation of processes to ensure data quality and accuracy before transfer or sale.
2. **Access Control:** Robust controls over who within the organization (and externally) can access confidential consumer data.
3. **Secure Data Handling:** Strict protocols for handling and transmitting bulk sensitive information, particularly concerning foreign entities.
## Penalties & Enforcement
- Fines: Penalties would likely follow those stipulated under the Fair Credit Reporting Act (FCRA) for non-compliance (e.g., willful non-compliance can lead to substantial statutory damages).
- Other Consequences: Increased regulatory scrutiny, potential lawsuits from consumers, and reputational damage, especially if data handling is tied to national security concerns.
- Enforcement: Enforcement actions would be handled by the CFPB, potentially in coordination with other agencies alerted to national security risks.
## Related Standards
- **Fair Credit Reporting Act (FCRA):** The primary legal standard that data brokers may be held to if designated as CRAs.
- **NIST Cybersecurity Framework/ISO 27001:** While not explicitly mentioned, adherence to rigorous data security standards would be necessary to meet the implied internal data security and national security risk objectives.
## Resources
- Official Documentation: Relevant provisions of the Fair Credit Reporting Act (FCRA).
- Guidance Documents: Previous CFPB guidance or public statements issued by Director Chopra regarding data broker regulation.
- Tools: Compliance management software capable of tracking FCRA adherence and data lineage.
## Practical Recommendations
1. **Prepare for CRA Status:** Data brokers must immediately assume a preparedness posture for operating under full FCRA oversight, focusing heavily on data accuracy mandates.
2. **Enhance Internal Governance:** Review all internal data retention policies to align with the "data minimization" principle suggested by the confirmed nominee.
3. **Monitor Regulatory Activity:** Pay close attention to internal CFPB reviews and any new rulemaking, as enforcement focus is explicitly shifting toward data security and national security risks associated with data accessibility.