Federal: Comment Letter to the FTC on its Advance Notice of Proposed Rulemaking on Commercial Surveillance and Data Security Practices

Federal Trade Commission
Office of the Secretary
600 Pennsylvania Avenue NW
Suite CC-5610 (Annex B)
Washington, DC 20580

Re: American Fintech Council Comment on the Advance Notice of Proposed Rulemaking on Commercial Surveillance and Data Security Practices

To Whom it May Concern:

On behalf of the American Fintech Council and its members, we thank the Federal Trade Commission (FTC) for the opportunity to comment on this advance notice of proposed rulemaking (ANPR) regarding commercial surveillance and data security.

AFC’s mission is to promote an innovative, transparent, inclusive, and customer-centric financial system by supporting the responsible growth of lending, fostering innovation in financial technology (Fintech), and encouraging sound public policy. AFC members are at the forefront of fostering competition in consumer finance and pioneering ways to better serve underserved consumer segments and geographies. For instance, AFC has publicly supported 36 percent rate caps at state and federal levels, which is a key component of addressing responsible lending. Our members are also lowering the cost of financial transactions, allowing them to help meet demand for high-quality, affordable products. We welcome the opportunity to address consumer data privacy and security as this is an important issue for our members.

AFC supports regulation that will protect consumers and ensure that they can be confident about the privacy of their data. We also encourage the FTC to consider its shared jurisdictional authority on several topics addressed by the ANPR, maintain consistency and partnership with the Consumer Financial Protection Bureau (CFPB or Bureau), and other financial regulators where these issues pertain to the financial services industry. The FTC should continue to balance regulation and consumer protection in a manner that does not inadvertently hurt responsible businesses, especially Fintech platforms that are providing products that help consumers and should avoid proposing duplicative or extra-jurisdictional regulatory requirements. We also support the FTC working with existing disparate impact frameworks established by the Equal Credit Opportunity Act (ECOA).

I. AFC urges the FTC to continue to work with the Consumer Financial Protection Bureau to create consistent interagency rulemaking and guidance to streamline the compliance process.

While we acknowledge and support the FTC’s jurisdiction over the topic of data security via section 5 of the Federal Trade Commission Act and other statutes, we note that the CFPB holds primary jurisdiction over several topics addressed in this ANPR. In particular, Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act currently codifies consumers’ financial data and privacy rights. The CFPB has been active on this issue as evidenced by a recent speech given by the CFPB Director and with the Bureau releasing its Small Business Advisory Review Panel for Required Rulemaking on personal financial data rights outline. We caution the FTC on rulemaking that may not be consistent with 1033 or other future Bureau rulemaking on these topics. It may be prudent for the FTC to refrain from final rulemaking until it receives guidance or directive on where the Bureau will lead in the 1033 and other rulemakings addressing consumer data.

To this end, we recommend that as FTC works through any proposed rulemaking process on the topic of commercial surveillance and data security, it coordinates with the CFPB and other relevant agencies to ensure that rules and requirements established on data security properly fit within the FTC’s jurisdictional authority and are not duplicative or contradictory to the work conducted by the CFPB. Clear and congruent rules and/or guidance from regulators will help augment existing frameworks for how consumer financial information can be protected, accessed, and shared in responsible ways to benefit consumers. This will also allow for industries to be compliant with one set of federal standards that will allow them to follow the law and better serve their customers. Finally, we believe addressing these issues in coordination with the CFPB will avoid potential regulatory arbitrage between regulators and market participants across financial services and other industries.

II. Artificial Intelligence and Machine Learning

Banks and fintech platforms have utilized technology and other innovations to greatly expand access to lending to consumers and small business owners, especially those from underserved communities and communities of color. In a recent report, the United States Treasury notes that nonbanks and Fintechs are helping to foster greater competition and are reaching consumers in more communities. AFC members are leaders in the industry in financial inclusion and equity.

Our members work with civil rights and advocacy organizations in strengthening the framework in preventing discrimination in artificial intelligence and machine learning (AI/ML). We encourage the FTC to work with existing frameworks, particularly those established under ECOA, that focus on outcomes-based approaches in addressing discrimination, as it proceeds with this rulemaking.

The questions posed by this ANPR regarding AI and financial institutions are important to this discussion. Regulators of financial institutions must help ensure that America’s consumers can realize the benefits from AI lending in a well-regulated and supervised context. In particular, we urge that the agencies, through coordinated action, work to revise, clarify, and update their existing model risk management, fair lending, and third-party oversight guidance so that banks and their service providers can understand and comply with expectations for the use of AI/ML in consumer lending.

Discrimination and Disparate Impact

AFC has led the fintech industry to support regulation to prevent discrimination in lending in all forms, including in the use of AI/ML. Discrimination has no place in American society, whether it be the result of AI and ML or traditional approaches to lending.

The questions of the ANPR addressing discrimination in AI speak to the concern that consumer data that companies collect or algorithms that analyze data could include proxies for protected classes or treat protected class members disadvantageously, likely without the humans designing those algorithms intending or even realizing it. We agree this is a concern, which is best addressed through the disparate impact framework. AFC’s predecessor organization, the Marketplace Lending Association, defended disparate impact anti-discrimination protection at a time when the framework was under consideration for being rolled back. Since then, AFC members have partnered with consumer advocacy groups in support of an approach to anti-discrimination regulation that has the support of both consumer advocacy groups and forward-thinking Fintechs. For instance, AFC members worked with the National Community Reinvestment Coalition on statements and letters urging stronger guidance and an interpretive rule to strengthen the disparate impact framework under ECOA. We urge the FTC to adopt this outcomes-based approach to discrimination regulation, rather than an inputs-based or process-based approach that could be less protective for consumers and restrict innovations in AI/ML process and data that can improve financial inclusion. We again also urge the FTC to remain consistent with the CFPB to avoid establishing different, overlapping requirements that would complicate an issue already addressed by an existing regulatory framework.

The disparate impact framework under ECOA and other laws addresses concerns of algorithmic discrimination by requiring lenders to address discriminatory outcomes in their lending practices, regardless of whether those outcomes are the result of new algorithms, traditional credit models, or other reasons. Whatever the cause, and regardless of whether there was any discriminatory intent, the outcomes-based disparate impact framework requires lenders to identify and prevent discriminatory outcomes. Because of ECOA’s disparate impact framework, consumers and small businesses have legal protection from algorithmic discrimination in financial services that they do not enjoy in other sectors of the economy. We propose that the FTC adopt an analogous framework to address the concerns raised in its ANPR questions on this matter.

The disparate impact framework can address potential unintended or algorithmic discrimination while also being able to accommodate innovations in alternative data, ML, and AI. It can protect borrowers and allow technology innovations to create powerful credit models that can deliver the lowest prices and greater financial inclusion.

The National Community Reinvestment Coalition explains its support for this approach, in the joint statement with several AFC members referenced above:

“We appreciate disparate impact’s statistical, outcomes-based approach to identifying discrimination. By assessing outcomes, rather than inputs, disparate impact addresses discrimination that can arise when decisions are the result of algorithms or data, rather than human intent. We also believe this outcomes-based approach establishes disparate impact as a pro-innovation framework for preventing discrimination. This is because it can accommodate advances in credit modeling, artificial intelligence, machine learning, and alternative data, which have the potential to increase financial inclusion, while at the same time holding these technologies accountable for addressing potential discriminatory impact. This combination of innovation and outcomes-based accountability will produce the most fair, inclusive, consumer friendly financial services ecosystem, and allow innovation to help address the “financial services deserts” by bringing the benefits of the financial system to those who are currently underserved.”

We view disparate impact as a potential model for pro-innovation regulation because of this outcomes-based approach. Now that consumer data is widely available and measurable, regulation based on measuring whether companies accomplish defined outcomes could become a compelling approach to pro-consumer, pro-innovation regulation. Defined, measurable outcomes can bring greater certainty to principles-based regulations that are sometimes seen as unclear for industry, resulting in criticism of regulation through enforcement. Outcomes-based regulation is also an alternative to rules-based regulation which may inhibit the innovations that could produce better outcomes for consumers, but do not conform to the defined rules.

AFC and its membership firmly believe that access to fair, affordable credit is critical for economic mobility and will continue to work with regulators, industries, and customers to ensure no one is unfairly excluded. Because of the importance of disparate impact principles to both underserved communities and to innovation, we encourage the FTC to adopt the disparate impact framework—or a similarly outcomes-focused framework—for measuring and preventing algorithmic discrimination arising from the use of AI/ML and consumer data. This approach would also help maintain consistency with efforts to prevent algorithmic discrimination by the CFPB.

III. AFC Encourages the FTC to seek an appropriate balance of oversight to keep consumers and their information safe without inadvertently hurting compliant innovative practices.

Well-regulated financial systems, including technology companies like AFC’s members, are critically important today for the financial health of consumers and the banking system. More and more consumers are seeking credit and applying for loans from their mobile devices and/or home computers, resulting in the collection of relevant data required to address consumer need and potential risks.

We appreciate the need for balancing consumer permissions and consent as it relates to their data privacy with the legitimate business need for the use of data. We urge the FTC to consider current exemptions under the Gramm-Leach-Bliley Act (GLBA) which account for bona fide business needs regarding consumer data and privacy. Access to customer data has been crucial to the development of online platforms and lending for our members to better serve their customers. Today, fintech platforms are making sure that consumers and businesses can readily access the capital they need to thrive and grow. Platforms are reaching borrowers with more cost effective, convenient, and transparent credit options, made possible in part by the ability of customers to securely share their financial information with online platforms without fear of abuse of their data.

We firmly believe in the balance of consumer choice and legitimate business needs. AFC also believes that although the protection and security of consumer financial information is of the utmost importance, unnecessary and burdensome restrictions should not be placed on entire industries to address the bad actors. Developing new systems and operational practices to comply with overly complicated or prescriptive rules will be time consuming and expensive and may divert capital and resources that would otherwise contribute to the expansion of capital to the benefit of consumers through new and improved products. Some of our members are concerned that the complexity of this ANPR may have a chilling effect on financial institutions that want to participate in the market. Practically speaking, the additional costs and burdens of complying with an overly burdensome rulemaking may result in less, not more, access to credit as a whole.

Rulemaking that reasonably guarantees customers’ access to and protection of their own data will help drive the financial innovation that will be crucial to economic growth. Traditional financial institutions, financial technology firms, and regulators should all work collaboratively to make sure that financial services customers can find the tools and products that will enable them to borrow, save, and invest in the manner that best meets their financial needs and does not hurt their informational privacy.

Specifically, as it relates to the application of the Unfair or Deceptive Acts or Practices (UDAP) provisions of Section 5 of the FTC Act, we recommend that the FTC carefully consider the demonstrable countervailing benefits to consumers that collection, retention, and use of certain data variables have over theoretical or unactualized harms discussed in some academic literature. As codified for nearly 30 years, the modern unfairness doctrine requires that for an act or practice to be deemed unfair, the resulting injury caused must be (1) substantial, (2) without offsetting benefits, and (3) one that consumers cannot reasonably avoid. The FTC’s Unfairness Policy Statement further establishes that the FTC must apply its “substantial injury test” to determine whether there has been a substantial consumer injury due to the act or practice. The substantial injury test identifies that the harm can be economic in nature or a threat to a person’s health and safety. However, the FTC’s own policy statement notes that emotional distress is ordinarily insufficient.

In the context of modern data collection and usage practices, customers are offered significant benefits, such as the ability to access affordable loans and other banking services not previously available to them. Innovative fintech companies are able to offer these products responsibly to consumers by leveraging the consumer-provided data collected on the fintech company’s platform. As evidenced in multiple government, industry, and academic reports these activities have provided significant consumer benefits to consumers, particularly those in traditionally underserved areas, such as low- and moderate-income communities. AFC is cognizant that some consumers may feel uncomfortable with the fact that companies collect, retain, and use their data to provide innovative products and services. However, it would be contrary to the FTC’s established policy to engage in any investigatory or enforcement activities based on the perception of harm or emotional distress stemming from companies' data practices. Further and most importantly, actual consumer and competitive harm, such as the inability to offer innovative credit products in a responsible manner, would result from the FTC’s pursuit of investigations and enforcement actions based on the emotional distress of a vocal minority of consumers. Thus, in the context of companies’ data practices, we encourage the FTC to carefully consider the agency’s long-standing precedents discussed above before pursuing any UDAP related activity against data practices.

Conclusion‍

AFC urges the FTC to continue its interagency work with the CFPB and other regulators as it moves forward with rulemaking on this very important topic. It is important not only that the financial services industry receives consistent regulation to streamline compliance, but also that other industries have a similar standard. In addition, we urge the FTC to work with existing legal and regulatory frameworks as it relates to discrimination and disparate impact. Finally, the FTC’s rulemaking must strike a fair, feasible balance between privacy rights and legitimate business interests in data usage. Consumer data protection and the ability to provide financial services to our customers is of the utmost importance to our members. We thank the FTC again for this opportunity to comment.