On October 19, 2023, the CFPB proposed a rule that would accelerate a shift toward open banking, where consumers would have control over data about their financial lives and would gain new protections against companies misusing their data. According to the CFPB, the proposed rule would jumpstart competition by forbidding financial institutions from hoarding a person’s data and by requiring companies to share data at the person’s direction with other companies offering better products.
Known as the Personal Financial Data Rights rule, it revives a dormant law that Congress passed more than a decade ago. Under the proposed rule, people would have the power to share data about their use of checking and prepaid accounts, credit cards, and digital wallets. It would also allow consumers to leave banks that provide poor service and companies would be forbidden from misusing or monetizing sensitive personal data.
According to the CFPB’s press release, the proposed Personal Financial Data Rights rule would protect the interests of both consumers and financial firms through:
Robust protections to prevent unchecked surveillance and misuse of data. Companies that people authorize to access data on their behalf would have to agree to certain important conditions and third parties could not collect, use, or retain data to advance their own commercial interests such as targeted or behavioral advertising.
Meaningful consumer control. The proposal would also give people the right to revoke access to their data. Access can be maintained for no more than one year, absent the individual consumer’s reauthorization.
A move away from risky data collection practices. The proposal seeks to move the market away from risky data collection practices such as screen scraping, which often requires people to share their usernames and passwords with third parties.
Fair industry standard-setting. Instead of providing detailed technical standards, the rule contains several requirements to ensure industry standards are fair, open, and inclusive.
The CFPB also added that the requirements would be implemented in phases, with larger providers being subject to them much sooner than smaller ones. Community banks and credit unions that have no digital interface at all with their customers would be exempt from the rule’s requirements.
Read the CFPB’s press release here.
The proposed rule can be found here.