How Data Sharing is Set to Transform Under the CFPB's Proposed Rules

The need for standardized data sharing practices in the financial services sector has been a long-standing concern. Currently, consumers face varying conditions for accessing their financial data, posing challenges when they want to switch banks or utilize financial technology services. The CFPB's proposed rule seeks to address these issues by establishing a regulatory framework that aligns with the vision of "open banking." Open banking, already implemented in Europe, Britain, and other countries, allows consumers to share their financial data securely with third-party providers of their choice, enabling the development of innovative products and services.

Key Provisions of the Proposed Rule

The Personal Financial, Data Rights Rule, encompasses several essential provisions that empower consumers and promote competition. Let's explore some of the key elements:

1. Enhanced Consumer Access to Financial Data

Under the proposed rule, consumers would have the right to request various types of information related to their accounts, including transaction histories, balances, and third-party bill payments. Additionally, they could access information concerning the terms and conditions of financial products and services, such as fee schedules, APRs, and rewards program terms. This access right would exclude confidential business information and certain types of loans, such as mortgages, auto, and student loans. Financial institutions would be required to provide this data in a readily usable electronic format free of charge.

"The proposed rule will help accelerate the shift to a more decentralized financial market structure while guarding consumers' personal data against abuse and misuse." - Rohit Chopra, CFPB Director

2. Facilitating Switching of Service Providers

One of the primary aims of the proposed rule is to make it easier for consumers to switch banks or financial service providers. Currently, the lack of standardized data sharing practices creates barriers for customers who wish to transfer their financial transaction history to a new institution. The proposed rule aims to foster competition based on service quality and pricing by enabling seamless data transfer. Financial institutions would be prohibited from "hoarding" a consumer's data, ensuring that customers have the power to walk away from bad service and choose the best products and prices.

3. Prohibition of Unauthorized Data Use

To protect consumer privacy, the proposed rule prohibits companies from using consumer account data for purposes other than providing the requested services and products. This means that financial institutions cannot utilize the shared data for targeted advertising, marketing, or selling to data brokers. Furthermore, upon termination of the customer relationship, financial institutions would be required to delete the consumer's data, subject to applicable law and retention requirements. These provisions aim to safeguard consumer data and prevent its misuse.

4. Regulation of Screen Scraping

Screen scraping, a method of data collection that requires the use of login credentials, has been a subject of concern in the industry. The proposed rule addresses this issue by prohibiting screen scraping practices, aiming to ensure more secure and controlled data sharing methods. By doing so, the rule seeks to protect consumers from potential data breaches and unauthorized access to their financial information.

Benefits and Implications of the Proposed Rule

The Personal Financial Data Rights Rule has the potential to bring about significant benefits for consumers, financial institutions, and fintech firms. Let's explore some of the anticipated advantages and potential implications:

1. Empowering Consumers

By granting consumers greater control over their financial data, the proposed rule empowers them to make informed decisions and choose the financial products and services that best meet their needs. With easier access to their own data, consumers can more effectively compare offerings from different institutions, fostering a more competitive marketplace.

2. Fostering Competition and Innovation

The proposed rule is expected to foster competition among financial institutions and fintech firms. Smaller players and startups, in particular, stand to benefit from the ease of transferring consumer transaction history, reducing administrative costs associated with onboarding new customers. This increased competition may incentivize companies to provide better customer service and develop innovative products and services.

3. Ensuring Data Privacy and Security

With the prohibition of unauthorized data use and the requirement for financial institutions to delete customer data upon termination of the relationship, the proposed rule strengthens data privacy and security measures. By setting standards for data sharing practices, the rule aims to protect consumer's personal information from abuse and mitigate the risk of data breaches.

4. Challenges and Implementation Costs

While the proposed rule has garnered support from consumer advocacy groups, fintech firms, and some financial institutions, challenges, and implementation costs remain a concern. Financial institutions have raised questions about the scope of the rule, potential liability issues, and the need for robust data privacy and security standards for all stakeholders. Balancing the interests of various industry participants will be crucial in finalizing the rule.

Reactions and Next Steps

The proposed rule has generated mixed reactions from industry stakeholders. The American Bankers Association has applauded the goal of enhancing consumer access to their financial data while expressing concerns about certain aspects of the rule, such as liability and implementation costs. The Consumer Bankers Association has emphasized the importance of developing a final rule that provides uniform protection of consumer data across banks and non-banks. The Bank Policy Institute has called for prioritizing data security and requiring fintech firms to adhere to the same privacy and security standards as banks.

Comments on the proposed rule are due by December 29, 2023. The CFPB intends to finalize the rule by the fall of 2024, with compliance dates varying depending on the asset size and type of financial institution.

The CFPB's proposed Personal Financial Data Rights Rule represents a significant step towards standardized data sharing practices in the financial services industry. By granting consumers greater access and control over their financial information, the rule aims to foster competition, empower consumers, and protect their privacy. While challenges and implementation costs remain, the proposed rule has the potential to transform the way data is shared in the industry, promoting innovation and benefiting consumers and industry participants alike.