CFPB Seeking Feedback On Revisions To Personal Financial Data Rights Rule

The Consumer Financial Protection Bureau (CFPB) is seeking feedback as it considers proposing a new rule to revise the Biden-era Section 1033 rule on personal financial data rights (PFDR).

© Shutterstock

The revisions would focus on four main areas:

• The scope of who may make a request on behalf of a “consumer”;
• How costs for effectuating the rights under the PFDR Rule can be defrayed through things like the imposition of fees;
• The information security implications of the PFDR Rule; and
• The data privacy implications of the PFDR Rule.

“The Bureau’s decision to reopen this rulemaking process is a welcome step toward restoring accountability, consumer protection, and the rule of law. The prior Administration’s rule stretched far beyond what Congress intended in Section 1033, mandating broad data sharing that created real risks of fraud, breaches, and consumer harm,” Consumer Bankers Association (CBA) President and CEO Lindsey Johnson said. “America’s leading Main Street banks stand ready to partner with the CFPB on a revised framework that balances consumer access with strong safeguards and market-driven solutions—ensuring security, trust, and choice remain at the core of our financial system.”

The CFPB is seeking comments within 60 days on a variety of topics related to the personal data privacy proposal, including the following: the definitions of “consumer” and “representative,” the cost of providing data access, the cost of accessing data, market developments since the last proposal, the Bureau’s legal authority under the Dodd-Frank Act to write the rule, data security obligations, and liability for data breaches.

The CFPB will use the information it gathers from the comments to determine whether to formally propose a new rule.

“This rulemaking presents an opportunity for the CFPB to right the problems of the Biden-era rule by sticking to its statutory authority and putting consumers’ security first,” the Bank Policy Institute (BPI), Kentucky Bankers Association, and Forcht Bank said in a joint statement. “Banks are advocating for a solution that both protects consumers and preserves marketplace innovation already underway, and we look forward to working with the Administration on its efforts to revise the problematic 2024 rule.”

BPI, Kentucky Bankers, and Forcht Bank have consistently emphasized through litigation and prior rulemakings that any rule governing permissioned data sharing must focus on consumer data sharing. It should not illegally require consumer data to be shared with third-party middlemen, which puts consumers at risk, they said.

The CFPB also announced that it will be issuing a notice of proposed rulemaking to extend the forthcoming compliance dates for the PFDR rule.