Federal: Joint Adocacy Letter to the CFPB requesting request an extension of the comment period of the notice of proposed rulemaking on Personal Financial Data Rights

Via Electronic Mail‍

‍

The Honorable Rohit Chopra
Director
Consumer Financial Protection Bureau
1700 G Street, NW
Washington, DC 20552

Re: Docket No. CFPB-2023-0052 – Request for Extension of Comment Period for Notice of Proposed Rulemaking on Personal Financial Data Rights

Dear Director Chopra:

The American Fintech Council (AFC), the American Bankers Association (ABA), the American Financial Services Association (AFSA), the Bank Policy Institute (BPI), the Clearing House Association, the Community Development Bankers Association (CDBA), the Consumer Bankers Association (CBA), the Credit Union National Association (CUNA), the Electronic Transactions Association (ETA), the Independent Community Bankers of America (ICBA), the Innovative Lending Platform Association (ILPA), the National Association of Federally-Insured Credit Unions (NAFCU), the Online Lenders Alliance (OLA), the Professional Background Screening Association (PBSA), and the Securities Industry and Financial Markets Association (SIFMA) respectfully request an extension of the comment period of the notice of proposed rulemaking on Personal Financial Data Rights (NPRM) until 90 days after its publication in the Federal Register. The aforementioned associations represent companies of all sizes seeking to operate responsibly within the modern consumer reporting and banking system(s). These entities and their members will be significantly impacted by the NPRM and therefore require at least 90 days after publication in the Federal Register to properly consider the effects of the specific proposals within the NPRM.

The Consumer Financial Protection Bureau (CFPB) has pursued a deliberate approach to implementation of Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), which has resulted in the agency taking nearly 7 years to propose its formal NPRM on this matter. During this time, CFPB solicited public comment on three separate occasions. Each of these comment periods offered at least 90 days for industry and members of the public to provide their views to the agency. Further, in the intervening time between public comment solicitations, CFPB pursued additional information gathering efforts and provided agency views through multiple speeches, blog posts, and events. At each point, CFPB provided significant time for industry and the broader public to react to how the agency viewed the issue of personal financial and other data rights. Our recounting of the CFPB’s extended process is not intended to be a criticism. In fact, it is quite the contrary. We the undersigned believe that this approach by the agency reflects a common understanding about the substantial effect that the Section 1033 regulations will have on consumers and industry participants, and the underlying complexity of the issue.

As noted above, CFPB has provided at least 90 days for notice and comment at previous points in their 1033 rulemaking process. Pursuing a notice and comment period that is less than 90 days creates a concerning divergence from CFPB’s established practices on the 1033 rulemaking. Further, the unique role of the NPRM within the agency rulemaking process necessitates due consideration to the time allotted to the public to provide comment on the agency’s formal plan to accomplish its goals on a specific regulatory topic beyond that provided during other points in the rulemaking process. Unlike other aspects of the rulemaking process, the NPRM is the primary opportunity for industry and members of the public to convey their views on the specific proposals put forth by the agency for full consideration by the agency in the finalization of the rulemaking. As evidenced by the information contained in the CFPB's 299-page NPRM, the agency is seeking responses on technical and non-technical issues beyond the level of specificity requested in the previous public comment periods associated with the implementation of Section 1033. This specificity creates a unique need for additional time to ensure proper evaluation of the proposed requirements and their impacts on relevant business processes.

As noted above, this NPRM represents the agency’s plan to implement regulations on the inherently complex issue of personal financial and other data rights to an extent that has not been previously pursued in federal U.S. law. The CFPB has tacitly recognized this complexity based on the number of public comment requests, information gathering efforts, and public statements on the topic. This recognition of the complexity associated with the implementation of Section 1033 of the Dodd-Frank Act is best exemplified by the fact that CFPB required over 180 days to develop its NPRM from the issuance of its Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA) report on March 30, 2023. To provide only 70 days to comment, especially with a comment period and deadline during a time typically unavailable for those observing various November and December holidays - further reducing the work time period, reflects a lack of reciprocity between the implementing agency and affected entities to engage in the discourse needed within this complex issue and rulemaking. Thus, it seems prudent for the CFPB to offer a proportionate time for consideration by affected entities in industry or the broader public as the agency took to develop the NPRM.

Specifically, insufficient time for small entities to fully consider the myriad issues discussed in the rulemaking and their impacts on the institutions could pose a risk to the CFPB’s ultimate goals of fostering increased competition through the implementation of Section 1033. While we recognize that CFPB convened a SBREFA panel, as required by statute, many of the small business entities that would be affected by this rulemaking lack the resources necessary to respond to the NPRM during the current time frame, due to the consistently competing interests of serving their consumers most effectively. Therefore, small business entities impacted by this rulemaking would again be disadvantaged in the process. Without the duly considered responses by these small entities, the final rulemaking could adopt requirements that would ultimately disadvantage the entities and undercut the CFPB’s desire to create competition through the implementation of Section 1033. Thus, we believe that this provides a unique rationale for the CFPB to extend its comment period to provide crucial considerations for these small business entities to ensure that these entities have adequate time to provide comments with their limited available resources and vast array of competing commitments.

It is also important to extend the comment period so industry can evaluate the implications the CFPB’s forthcoming consumer reporting rulemaking will have on the Section 1033 proposed rule. On September 15, 2023, the CFPB released its Small Business Advisory Review Panel for Consumer Reporting Rulemaking Outline of Proposals and Alternatives under Consideration, and the Bureau’s revised definition of a consumer reporting agency (and the undefined term “data broker”) may encompass what would be considered data providers, data recipients, and data aggregators under the Section 1033 rule. The CFPB’s 1033 NPRM likewise acknowledges that data aggregators in certain circumstances will be “regulated as a consumer reporting agency under the [Fair Credit Reporting Act].” Industry requires further time to understand how these two rulemaking efforts intersect with one another, and specifically how the consumer reporting rulemaking will impact the rights and obligations of entities like data aggregators.

Further, a rush to finalize this 1033 rulemaking, especially after the CFPB has pursued such a deliberate process up to this point, would invite scrutiny and potential future revisions, ultimately creating confusion for consumers and businesses, as well as additional compliance costs. We, the undersigned associations, seek to avoid any confusion or unnecessary future revisions by requesting that the CFPB allow for the necessary time for entities of all sizes to provide duly considered and fully reasoned comments on the NPRM.

It is for the reasons stated above that we, the undersigned associations, respectfully request the comment period be standard to other proposed rulemaking timelines of this scope and magnitude. The comment period should be 90 days after publication in the Federal Register on this NPRM to allow industry and the broader public the necessary time to provide detailed and duly considered comments. Ultimately, extending the comment period is for the benefit of ensuring proper finalization of the CFPB’s position on personal data rights implementing Section 1033 of the Dodd-Frank Act. Simply put, the implementation of Dodd-Frank Section 1033 is far too important to financial institutions, fintechs, companies, and consumers to rush this rulemaking process at this crucial juncture. We look forward to continuing our work with the CFPB on this rulemaking and thank you for considering our request.

Sincerely,

The American Fintech Council (AFC)

The American Bankers Association (ABA)

The American Financial Services Association (AFSA)

The Bank Policy Institute (BPI)

The Clearing House Association

The Community Development Bankers Association (CDBA)

The Consumer Bankers Association (CBA)

Credit Union National Association (CUNA)

Electronic Transactions Association (ETA)

The Independent Community Bankers of America (ICBA)

Innovative Lending Platform Association (ILPA)

The National Association of Federally-Insured Credit Unions (“NAFCU”)

The Online Lenders Alliance (OLA)

The Professional Background Screening Association (PBSA)

The Securities Industry and Financial Markets Association (SIFMA)