On October 19, 2023, the Shopper Monetary Safety Bureau (CFPB) issued a notice of proposed rulemaking to implement Section 1033 of the Dodd-Frank Act. Part 1033 of Dodd-Frank requires coated individuals to make info regarding a monetary services or products {that a} shopper has obtained from such individual accessible to the patron, topic to guidelines carried out by the bureau.
The proposed rule would require that sure monetary establishments, card issuers and different cost facilitation suppliers make shopper knowledge – together with transaction knowledge – extra available to customers and licensed third events. It additionally would place shopper safety obligations on these entities, in addition to on third events licensed to gather and use that knowledge.
Who can be required to offer knowledge below the rule?
The proposed rule would apply to “knowledge suppliers” – usually, monetary establishments that supply shopper deposit accounts topic to the Digital Funds Switch Act (EFTA), bank card issuers topic to the Reality in Lending Act (TILA) and entities that supply associated cost facilitation services. In consequence, most banks can be coated, as would digital pockets suppliers and neobanks. Entities with out consumer-facing digital banking interfaces, as of the rule’s compliance date, can be excluded from protection.
What knowledge can be coated by the rule?
Below the proposal, knowledge suppliers can be answerable for offering shopper and licensed third-party entry to “coated knowledge,” which would come with 24 months of transaction knowledge, sure account info (e.g., account stability, upcoming payments, fundamental account verification), info to provoke cost to and from accounts, and the phrases and circumstances below which the account or card was supplied (e.g., APR, reward program phrases, and many others.).
Confidential business info, info collected solely to stop fraud, cash laundering, and different illegal conduct, info required by regulation to be stored confidential, and data that can not be retrieved within the unusual course of enterprise wouldn’t be topic to the rule’s necessities.
How would knowledge suppliers be obligated to make coated knowledge accessible?
The proposal would require that knowledge suppliers preserve shopper interfaces and set up and preserve developer interfaces to permit shopper and third-party entry to knowledge.
The proposed rule would prohibit knowledge suppliers from imposing any charges or prices on customers or licensed third events for establishing and sustaining – or making knowledge accessible via – the interfaces. It additionally would require suppliers to publicly disclose (e.g., on an internet site) developer interface and make contact with info to facilitate entry and supply a technique to deal with questions.
Importantly, with respect to their developer interfaces, the proposed rule additionally would require that knowledge suppliers:
- Not depend on display screen scraping – a know-how that leverages shopper credentials to log into accounts to retrieve knowledge, which means such interfaces would probably take the type of software program interfaces (APIs).
- Make coated knowledge accessible in a standardized format based mostly on “certified business requirements,” or in a format “broadly utilized by the developer interfaces of different equally located knowledge suppliers with respect to comparable knowledge and [that] is quickly usable by licensed third events.”
- Make knowledge accessible, via such interfaces, after acquiring info adequate to authenticate the third occasion and shopper, confirming that the third occasion has obtained shopper authorization and verifying the scope of the info request.
- Not unreasonably prohibit the frequency with which they settle for and reply to knowledge requests.
- Guarantee their developer interfaces carry out at a “commercially affordable” degree – together with that such interfaces have an information entry request response price, calculated per the rule, of no less than 99.5%.
- Apply an info safety program to the interface that complies with the Gramm-Leach-Bliley Act (GLBA) or, if not topic to the GLBA, the knowledge safety program necessities of the Federal Commerce Fee’s (FTC) Safeguards Rule.
What obligations can be imposed on third events licensed to entry and gather customers’ knowledge?
The proposed rule would require licensed third events to implement safeguards across the assortment, use and retention of such knowledge. In an effort to entry customers’ coated knowledge, the proposed rule would, for instance, require licensed third events to:
- Present the patron with a complete authorization disclosure.
- Certify to the patron – inside the authorization disclosure – that the third occasion agrees to restrict the gathering, use and retention of coated knowledge, and apply to that assortment, use and retention a GLBA-compliant info safety program or, if not topic to the GLBA, the knowledge safety necessities of the FTC Safeguards Rule.
- Acquire the patron’s “specific knowledgeable consent” to key phrases of entry via a signed authorization disclosure, both electronically or in writing.
- Present the patron with a signed copy or in any other case agreed to repeat of the authorization disclosure and the third occasion’s contact info in case of any questions.
As mirrored by the certification requirement recognized above, the proposed rule would solely allow third events to gather, use and retain knowledge as “fairly mandatory” to offer the patron with the requested services or products. Third events would subsequently be prohibited from utilizing knowledge for many different functions, together with for focused promoting, cross-selling services or products, or sale to knowledge brokers.
Further limitations on licensed third events embody a requirement to acquire reauthorization from customers to proceed to gather knowledge after one yr. Third events that fail to acquire reauthorization can be required to delete beforehand collected knowledge until that knowledge within reason mandatory to offer the services or products requested by the patron.
What position do knowledge aggregators play – and what obligations have they got – with respect to the gathering of coated knowledge?
The proposed rule additionally would enable third events to make use of “knowledge aggregators” – usually fintechs –to entry coated knowledge, topic to disclosure and certification necessities. The authorization disclosure introduced by a 3rd occasion to the patron would wish to determine any aggregators utilized by the third occasion.
Like licensed third events, knowledge aggregators additionally would wish to certify to the patron – both as a part of the licensed third occasion’s disclosure or individually – that they comply with adjust to the rule’s knowledge entry circumstances and restrictions. The licensed third occasion, nonetheless, would finally be answerable for compliance with the proposed rule’s authorization procedures.
Wanting forward
CFPB Director Rohit Chopra stated that the proposed rule is supposed to “speed up much-needed competitors and decentralization in banking and shopper finance” whereas on the identical time offering “sturdy knowledge protections to stop misuse and abuse of non-public monetary knowledge.” This commentary, and the rule itself, align with the continued CFPB chorus to business concerning the shopper advantages of accelerating competitors inside the banking markets whereas making certain strong controls in defending shopper knowledge. This consists of commitments from the CFPB to pursue insufficient data protection or security as a violation of the Shopper Monetary Safety Act’s prohibition on unfair, misleading or abusive acts and practices. Certainly, the press release accompanying the proposed rule adopts the identical aggressive tone the business has come to count on from the CFPB, with references to eliminating “knowledge hoarding” and empowering customers to entry info absent junk charges.
The rule additionally establishes clear report necessities designed to facilitate supervision and enforcement of compliance with the rule not simply by the CFPB, but in addition by “Federal and State banking regulators, State attorneys basic, and different authorities businesses that supervise knowledge suppliers.”
Entities that come inside the scope of the proposed rule ought to take be aware and start to guage the way it would possibly affect their processes. For instance, entities that the rule would deal with as licensed third events could wish to think about the potential implications of needing to align their info safety practices to the FTC’s Safeguards Rule if not topic to the GLBA.
These entities at the moment outdoors the scope of the proposed rule also needs to listen. As highlighted within the press launch, that is simply the primary proposal to implement Part 1033. The “CFPB intends to cowl extra services in future rulemaking.” To that finish, the CFPB is searching for touch upon whether or not digital profit switch (EBT) playing cards, in any other case exempt from EFTA protection, must be included within the scope of the proposed rule and likewise whether or not historic info must be made accessible for extra classes of coated knowledge.
By way of subsequent steps, feedback on the proposed rule are due on or earlier than December 29, 2023. The bureau said that it’ll search to finalize the rule by fall 2024.
Please be part of us for a webinar to debate the most recent updates regarding the CFPB’s proposed open banking rule. Register here.
