Federal: Comment Letter to the CFPB on its Small Business Advisory Review Panel for Consumer Reporting Rulemaking

Via Email Submission‍

‍

The Honorable Rohit Chopra
Director
Consumer Financial Protection Bureau
1700 G Street, NW
Washington, DC 20552

Re: Small Business Advisory Review Panel for Consumer Reporting Rulemaking

Dear Director Chopra:

The American Fintech Council (AFC) thanks you for the opportunity to provide comment on the Consumer Financial Protection Bureau’s (CFPB or The Bureau) Consumer Reporting Rulemaking during its Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA) panel. The Fair Credit Reporting Act (FCRA) represents one of the core laws governing the financial services industry. Consumer data has become critically important to many financial products and services, ranging from lending and payments processes to marketing and advertising. When conducted responsibly, the use of consumer data to offer these financial products and services can provide significant benefits to consumers.

AFC’s mission is to promote an innovative, transparent, inclusive, and customer-centric financial system by supporting the responsible growth of lending, fostering innovation in financial technology (Fintech), and encouraging sound public policy. AFC members are at the forefront of fostering competition in consumer finance and pioneering ways to better serve underserved consumer segments and geographies. AFC has publicly supported 36 percent rate caps at state and federal levels, which is a key component of our advocacy and of addressing responsible lending. Our members are also lowering the cost of financial transactions, allowing them to help meet demand for high-quality, affordable products.

AFC supports regulation that will protect consumers and ensure that they can be confident about the use and protections associated with the data found in their consumer reports. However, we recommend that CFPB carefully consider how the proposals under consideration could impact the industry, consumers, and the agency’s shared jurisdictional authority under FCRA.

I. Expanded definitions in the Bureau’s proposals present potential harms

The Bureau’s proposed expansion of the enumerated consumer reporting agency definition to “newer actors and practices in the credit reporting marketplace”, when combined with the broad definition of “data broker”, should avoid any unnecessary application of FCRA requirements to entities that would not be reasonably construed as consumer reporting agencies under the original FCRA definition. FCRA, as established in statute, enumerated specific parameters for determining which entities constitute a “consumer reporting agency”. Specifically, a consumer reporting agency “regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purposes of furnishing consumer reports to third parties”. Further, within the SBREFA Outline, CFPB defines “data broker” as “an umbrella term used to describe firms that collect, aggregate, sell, resell, license, or otherwise share personal information about consumers with other parties”, which “includes first-party data brokers that interact with consumers directly and third-party data brokers with whom the consumer does not have a direct relationship”. This definition of data broker, reasonably construed, would include data brokers and aggregation services, which are the focus of the Bureau’s proposals. However, the definition as written could also include many unintended businesses that fall far outside the intended scope of FCRA, such as marketing agencies, universities, and merchants.

Many of these entities could become subject to FCRA requirements without their knowledge or the requisite infrastructure to manage the numerous statutory requirements. In response these entities would likely limit the movement of data in order to avoid violating FCRA requirements. In turn, this could limit the prudent and functional transfer of data between entities and undercut the use of data for the benefit of consumers.

In addition, the general expansion of FCRA requirements could negatively impact the speed and convenience of innovative, consumer protected financial services. For example, in an effort to expand financial inclusion to historically underserved communities, innovative banks and fintech companies leverage available demographic data. Based on the discussion within the Bureau’s SBREFA Outline, it seems likely that marketing agencies and users of their services will face additional operational and financial costs due to additional disclosures and requirements, such as consumer permissions related to loan offerings, marketing, and advertising information. In practice, this issue could result in less actual extension of credit to those traditionally underserved communities, due to an increase in the burden. Ultimately, this could lead to a situation where the Bureau misaligns the consumer protection aims of the proposed reforms with the actual consumer demand for fast and affordable financial services, causing harm to consumers.

Also, innovative banks and fintech companies use information that would be defined as “credit header data” to comply with various Bank Secrecy Act (BSA) requirements. Verifying customer information to protect against fraud, money laundering, and other activities that harm consumers and the safety of the financial system is crucially important to ensuring a sound, consumer protected financial services industry. As understood in the SBREFA Outline, these BSA activities could face additional challenges stemming from CFPB’s definition of credit header data and the application of the proposed requirements the Bureau is considering in its Consumer Reporting Rulemaking. Therefore, it seems prudent for CFPB to consider exempting BSA activities that leverage consumer data from any proposed FCRA requirements.

While the extent that the Bureau will ultimately expand FCRA requirements remains unclear, AFC recommends that the CFPB carefully consider the impact that proposals to expand the definitions of “consumer reporting agency” and “data broker” will have on the overarching data ecosystem.

II. Consumer data’s regulatory framework and agencies’ concurrent rulemakings necessitate strong interagency coordination

Consumer data, and its regulatory framework, extend beyond the jurisdiction of CFPB. Across the financial services industry, consumer data and specific use cases—such as to prevent money laundering—fall under the jurisdiction of multiple regulators. Further, as noted in our previous comment letter, the Federal Trade Commission (FTC) remains an important part of ensuring consumer data is transferred and maintained properly.

As both the Bureau and FTC are pursuing rulemakings that impact the consumer data ecosystem and entities within it, in addition to the Consumer Reporting Rulemaking, AFC recommends that CFPB critically evaluate all proposals within each related rulemaking to ensure that it does not create duplicative or diverging requirements or create confusion as to the supervisory expectations for data providers, aggregators, and recipients. Specifically, data aggregation services which fall under CFPB’s definition of a “data broker” within the SBREFA Outline, also have been the subject of multiple concurring rulemakings. With the CFPB’s proposals under consideration in this rulemaking, as well as those in its implementation of Section 1033 of the Dodd-Frank Act via its Personal Financial Data Rights Rulemaking, it seems that CFPB could create some duplicative or diverging requirements within the Consumer Reporting Rulemaking that would undercut the competition principle discussed in the Personal Financial Data Rights Rulemaking.

While CFPB is the primary authority on consumer data issues, AFC recommends that agency staff engage in strong interagency coordination with all relevant agencies as the Bureau proceeds in its Consumer Reporting Rulemaking process. Failure to do so could result in contradictory, duplicative, or diverging requirements for entities operating within the data ecosystem.

* * *

AFC appreciates the opportunity to provide comment on the CFPB’s Consumer Reporting Rulemaking. AFC and its members continue to support regulation that will protect consumers and ensure that they can be confident about the use and protections associated with the data found in their consumer reports. It is in this vein that we urge CFPB to carefully consider our recommendations on its Consumer Reporting Rulemaking.

Sincerely,

SVP, Head of Federal and State Policy
American Fintech Council