[Federal Register Volume 88, Number 209 (Tuesday, October 31, 2023)]
[Proposed Rules]
[Pages 74796-74875]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-23576]
[[Page 74795]]
Vol. 88
Tuesday,
No. 209
October 31, 2023
Part IV
Consumer Financial Protection Bureau
-----------------------------------------------------------------------
12 CFR Parts 1001 and 1033
Required Rulemaking on Personal Financial Data Rights; Proposed Rule
Federal Register / Vol. 88 , No. 209 / Tuesday, October 31, 2023 /
Proposed Rules
[[Page 74796]]
-----------------------------------------------------------------------
CONSUMER FINANCIAL PROTECTION BUREAU
12 CFR Parts 1001 and 1033
[Docket No. CFPB-2023-0052]
RIN 3170-AA78
Required Rulemaking on Personal Financial Data Rights
AGENCY: Consumer Financial Protection Bureau.
ACTION: Proposed rule; request for public comment.
-----------------------------------------------------------------------
SUMMARY: The Consumer Financial Protection Bureau (CFPB) is proposing a
rule to implement personal financial data rights under the Consumer
Financial Protection Act of 2010 (CFPA). The proposed rule would
require depository and nondepository entities to make available to
consumers and authorized third parties certain data relating to
consumers' transactions and accounts; establish obligations for third
parties accessing a consumer's data, including important privacy
protections for that data; provide basic standards for data access; and
promote fair, open, and inclusive industry standards.
DATES: Comments must be received on or before December 29, 2023.
ADDRESSES: You may submit comments, identified by Docket No. CFPB-2023-
0052 or RIN 3170-AA78, by any of the following methods:
Federal eRulemaking Portal: https://www.regulations.gov.
Follow the instructions for submitting comments. A brief summary of
this document will be available at https://www.regulations.gov/docket/CFPB-2023-0052.
Email: [email protected]. Include Docket No.
CFPB-2023-0052 or RIN 3170-AA78 in the subject line of the message.
Mail/Hand Delivery/Courier: Comment Intake--FINANCIAL DATA
RIGHTS, c/o Legal Division Docket Manager, Consumer Financial
Protection Bureau, 1700 G Street NW, Washington, DC 20552.
Instructions: The CFPB encourages the early submission of comments.
All submissions should include the agency name and docket number or
Regulatory Information Number (RIN) for this rulemaking. Commenters are
encouraged to submit comments electronically. In general, all comments
received will be posted without change to https://www.regulations.gov.
All submissions, including attachments and other supporting
materials, will become part of the public record and subject to public
disclosure. Proprietary information or sensitive personal information,
such as account numbers or Social Security numbers, or names of other
individuals, should not be included. Submissions will not be edited to
remove any identifying or contact information.
FOR FURTHER INFORMATION CONTACT: Dave Gettler, Paralegal Specialist;
Anna Boadwee or Vince Mancini, Attorney-Advisors; Briana McLeod,
Counsel; Joseph Baressi, Sarita Frattaroli, David Jacobs, Mark Morelli,
Kristen Phinnessee, Michael Scherzer, Yaritza Velez or Priscilla
Walton-Fein, Senior Counsels, Office of Regulations, at 202-435-7700 or
https://reginquiries.consumerfinance.gov/. If you require this document
in an alternative electronic format, please contact
[email protected].
SUPPLEMENTARY INFORMATION:
Table of Contents
Abbreviations and Acronyms
I. Background
A. Introduction
B. Electronic Access to Personal Financial Data
C. Challenges in the Open Banking System
D. Overview of Rulemaking Objectives
E. Applicability of Other Laws
II. Legal and Procedural Background
A. Small Business Advisory Review Panel
B. Other Stakeholder Outreach
III. Legal Authority
A. CFPA Section 1033
B. CFPA Sections 1022(b) and 1024(b)(7)
C. CFPA Section 1032
D. CFPA Section 1002
IV. Discussion of the Proposed Rule
12 CFR part 1033
A. Subpart A--General
B. Subpart B--Obligation to Make Covered Data Available
C. Subpart C--Establishing and Maintaining Access
D. Subpart D--Authorized Third Parties
12 CFR part 1001
V. Proposed Effective Date
VI. CFPA Section 1022(b) Analysis
A. Statement of Need
B. Data and Evidence
C. Coverage of the Proposed Rule
D. Baseline for Consideration of Costs and Benefits
E. Potential Benefits and Costs to Consumers and Covered Persons
F. Potential Impacts on Depository Institutions and Credit
Unions With $10 Billion or Less in Total Assets, as Described in
Section 1026
G. Potential Impacts on Consumers in Rural Areas, as Described
in Section 1026
VII. Regulatory Flexibility Act Analysis
A. Small Business Review Panel
B. Initial Regulatory Flexibility Analysis
VIII. Paperwork Reduction Act
IX. Severability
Abbreviations and Acronyms
The following abbreviations and acronyms are used in this
proposed rule:
ACH = Automated Clearing House
ANPR = Advance Notice of Proposed Rulemaking
API = Application programming interface
APR = Annual percent rate
ATO = Account takeover
BLS = Bureau of Labor Statistics
EBT = Electronic benefit transfer
FDIC = Federal Deposit Insurance Corporation
FFIEC = Federal Financial Institutions Examination Council
FRFA = Final regulatory flexibility analysis
FTC = Federal Trade Commission
HHS = Department of Health and Human Services
IRFA = Initial regulatory flexibility analysis
LEI = Legal entity identifier
MSA = Metropolitan statistical area
NAICS = North American Industry Classification System
NCUA = National Credit Union Administration
NPRM = Notice of Proposed Rulemaking
OCC = Office of the Comptroller of the Currency
OMB = Office of Management and Budget
SBA = Small Business Administration
SSN = Social Security number
TAN = Tokenized account number
URL = Uniform resource locator
I. Background
A. Introduction
Digitization and decentralization in consumer finance create new
possibilities for more seamless consumer switching and greater
competitive intensity. For example, when consumers are able to share
their personal financial data, they can share details about their
income and expenses that may give lenders more confidence when
extending credit. When a consumer can switch with less friction, this
will create incentives for superior customer service and more favorable
terms. At the same time, sharing personal financial data can also lead
to misuse and abuse, given its commercial value.
In 2010, Congress explicitly recognized the importance of personal
financial data rights in section 1033 of the Consumer Financial
Protection Act of 2010 (CFPA).\1\ However, to date, the CFPB has not
issued a rule to implement this provision of law.
---------------------------------------------------------------------------
\1\ The CFPA is title X of the Dodd-Frank Wall Street Reform and
Consumer Protection Act, Public Law 111-203, 124 Stat. 1376, 2008
(2010).
---------------------------------------------------------------------------
Many market participants have already sought to develop
technologies and standards to facilitate consumer access to personal
financial data. The CFPB intends to accelerate the shift to a more open
and decentralized system through the issuance of a final rule.
[[Page 74797]]
B. Electronic Access to Personal Financial Data
Development of Electronic Data Access
By 1999, 20 percent of national banks offered online banking,
including all national banks with over $10 billion in assets, and
accounting for over 80 percent of all small deposit accounts held by
national banks.\2\ Adoption grew from 14 million consumers in 2000 to
37 million in 2002, and to 53 million in 2004.\3\ Around this time, the
first wave of online-only financial services providers emerged. In the
late 2000s, smartphones made digital banking still more available.
---------------------------------------------------------------------------
\2\ Alyssa Bentz, First in Online Banking, Wells Fargo Corp.
Archives (Mar. 14, 2019), https://www.wellsfargohistory.com/first-in-online-banking/; Karen Furst et al., internet Banking:
Developments and Prospects, Off. of the Comptroller of the Currency
(2000), https://www.occ.treas.gov/publications-and-resources/publications/economics/working-papers-archived/pub-econ-working-paper-2000-9.pdf.
\3\ Susannah Fox, Online Banking 2002, Pew Rsch. Ctr. (Nov. 17,
2002), https://www.pewresearch.org/internet/2002/11/17/online-banking-2002/; Susannah Fox, Online Banking 2005, Pew Rsch. Ctr.
(Feb. 9, 2005), https://www.pewresearch.org/internet/2005/02/09/online-banking-2005/.
---------------------------------------------------------------------------
Today, most consumers with a bank account are enrolled in digital
banking through online banking or mobile applications, and more than
two-thirds use it as their primary method of account access.\4\
Consumer interfaces generally provide free access to information such
as balances, transactions, and at least some terms of service. These
consumer interfaces may provide additional functionality, such as
allowing consumers to move money, manage their accounts, and download
financial data.
---------------------------------------------------------------------------
\4\ Fed. Deposit Ins. Corp., National Survey of Unbanked and
Underbanked Households (2021), https://www.fdic.gov/analysis/household-survey/2021report.pdf.
---------------------------------------------------------------------------
Development of Open Banking
Building on these developments, open banking \5\ emerged in the
early 2000s, along with interfaces designed for developers of products
or services to request consumer information, and related industry
standard-setting activity.\6\ These developer interfaces facilitated
consumer-authorized data access that was necessary for many new
products and services. Third parties often outsourced establishing and
maintaining connections with data providers to data aggregators. These
intermediaries largely relied on ``screen scraping,'' which uses
consumer credentials to log in to consumer accounts to retrieve
data.\7\ Widespread screen scraping allowed open banking to grow
quickly in the United States.
---------------------------------------------------------------------------
\5\ This Federal Register notice generally uses the term ``open
banking'' to refer to the network of entities sharing personal
financial data with consumer authorization. Some stakeholders use
the term ``open finance'' because of the role of nondepositories as
important data sources. The CFPB views the two terms as
interchangeable, but generally uses ``open banking'' because that
term is more commonly used in the United States.
\6\ Maria Trombly, Citibank's Aggregation Portal a Big Draw,
Computerworld (Sept. 18, 2000), https://www.computerworld.com/article/2597099/citibank-s-aggregation-portal-a-big-draw.html; Off.
of the Comptroller of the Currency, Bank-Provided Account
Aggregation Services: Guidance to Banks (2001), https://www.occ.treas.gov/news-issuances/bulletins/2001/bulletin-2001-12.html; CNET, Net earnings: E-commerce in 1997 (Dec. 24, 1997),
https://www.cnet.com/tech/tech-industry/net-earnings-e-commerce-in-1997/; Microsoft, OFX Consortium Expands with Bank of America,
Citigroup, Corillian, E*TRADE and TD Waterhouse (Oct. 2, 2001),
https://news.microsoft.com/2001/10/02/ofx-consortium-expands-with-bank-of-america-citigroup-corillian-etrade-and-td-waterhouse/.
\7\ Unless otherwise stated, the term ``screen scraping'' in
this document refers to credential-based screen scraping, which is
prevalent in the market today.
---------------------------------------------------------------------------
Screen scraping became a significant point of contention between
third parties and data providers, in part due to its inherent risks,
such as the proliferation of shared consumer credentials and
overcollection of data. Aggregators often declined to seek permission
from financial institutions they ``scraped,'' and some methods
aggregators used to solicit credential sharing led to litigation.\8\ In
late 2015, several large retail banks took actions that disrupted
screen scraping, albeit temporarily.\9\
---------------------------------------------------------------------------
\8\ See, e.g., Plaid, Inc., In re Plaid, Inc. Privacy
Litigation--Frequently Asked Questions, https://www.plaidsettlement.com/frequently-asked-questions.php (last visited
Sept. 18, 2023); TD Bank, TD Bank Files Trademark Counterfeiting and
Infringement Lawsuit Against Plaid in the U.S. (Oct. 14, 2020),
https://stories.td.com/us/en/article/td-bank-files-trademark-counterfeiting-and-infringement-lawsuit-against-plaid-in-the-u-s;
Penny Crosman, PNC sues Plaid for trademark infringement, Am. Banker
(Dec. 23, 2020), https://www.americanbanker.com/news/pnc-sues-plaid-for-trademark-infringement.
\9\ Robin Sidel, Big Banks Lock Horns with Personal-Finance Web
Portals, Wall St. J. (Nov. 4, 2015), https://www.wsj.com/articles/big-banks-lock-horns-with-personal-finance-web-portals-1446683450;
Peter Rudegeair, J.P. Morgan Warns It Could Unplug Quicken and
Quickbooks Users, Wall St. J. (Nov. 24, 2015), https://www.wsj.com/articles/j-p-morgan-may-unplug-some-customers-access-to-account-data-1448375950; Daniel Huang & Peter Rudegeair, Bank of America Cut
Off Finance Sites From Its Data, Wall St. J. (Nov. 9, 2015), https://www.wsj.com/articles/bank-of-america-cut-off-finance-sites-from-its-data-1447115089.
---------------------------------------------------------------------------
Around that same time, efforts accelerated to establish agreements
for third parties to access data via a provider's developer
interface.\10\ While the progress of access agreements has been uneven,
the open banking system has nevertheless grown as consumer reliance on
products and services powered by consumer-authorized data access
expanded. This growth led to further disputes and litigation between
system participants,\11\ and concerns over privacy and harmful uses of
consumer-authorized data increased.\12\
---------------------------------------------------------------------------
\10\ See, e.g., Penny Crosman, Wells Fargo strikes data-sharing
agreement with Plaid, Am. Banker (Sept. 19, 2019), https://www.americanbanker.com/news/wells-fargo-strikes-data-sharing-agreement-with-plaid; Finicity, Enhancing the Data-sharing
Experience at USAA (July 2, 2018), https://www.finicity.com/blog/data-sharing-usaa-direct-api/; Mary Wisniewski, JPMorgan Chase and
Finicity ink data-sharing agreement, Am. Banker (July 11, 2017),
https://www.americanbanker.com/news/jpmorgan-chase-and-finicity-ink-data-sharing-agreement.
\11\ Nathan DiCamillo, In data dispute with Capital One, Plaid
stands alone, Am. Banker (July 17, 2018), https://www.americanbanker.com/news/in-data-dispute-with-capital-one-plaid-stands-alone; Yuka Hayashi, Venmo Glitch Opens Window on War Between
Banks, Fintech Firms, Wall St. J. (Dec. 14, 2019), https://www.wsj.com/articles/venmo-glitch-opens-window-on-war-between-banks-fintech-firms-11576319402; Penny Crosman, PNC sues Plaid for
trademark infringement, Am. Banker (Dec. 23, 2020), https://www.americanbanker.com/news/pnc-sues-plaid-for-trademark-infringement; TD Bank, TD Bank Files Trademark Counterfeiting and
Infringement Lawsuit Against Plaid in the U.S. (Oct. 14, 2020),
https://stories.td.com/us/en/article/td-bank-files-trademark-counterfeiting-and-infringement-lawsuit-against-plaid-in-the-u-s.
\12\ See, e.g., Maeve Allsup, App Users Say Plaid Collects Bank
Logins Without Consent, Bloomberg L. (May 5, 2020), https://news.bloomberglaw.com/class-action/app-users-say-plaid-collects-bank-logins-without-consent; Ron Wyden, Wyden, Brown, Eshoo Urge FTC
to Investigate Firm Collecting and Selling Americans' Financial Data
(Jan. 17, 2020), https://www.wyden.senate.gov/news/press-releases/wyden-brown-eshoo-urge-ftc-to-investigate-firm-collecting-and-selling-americans-financial-data.
---------------------------------------------------------------------------
Despite these challenges, financial institutions have begun to
dedicate more resources to develop open banking infrastructure. This
includes multilateral efforts, some of which have been
controversial.\13\ Other incumbents, most notably large payment
networks, have sought to acquire aggregators.\14\
[[Page 74798]]
Most recently, large payments-focused nondepositories have looked to
enter the aggregation space by developing internal business units,
sometimes partnering with incumbent aggregators.\15\ These efforts
indicate the potential for incumbents to mitigate or neutralize
competitive threats from open banking, demonstrating the need for
strong rules to protect the openness of the system.
---------------------------------------------------------------------------
\13\ E.g., OpenID Found., Announcing the Financial API (FAPI)
Working Group (May 23, 2016), https://openid.net/announcing-the-financial-api-fapi-working-group/; Fin. Data Exch., Financial
Industry Unites to Enhance Data Security, Innovation and Consumer
Control (Oct. 18, 2018), https://www.financialdataexchange.org/FDX/FDX/News/Press-Releases/Financial_Industry_Unites_Data_Security.aspx; E.g., Penny Crosman,
Fidelity data-sharing hub aims to end screen scraping, Am. Banker
(June 11, 2019), https://www.americanbanker.com/news/fidelity-data-sharing-hub-aims-to-end-screen-scraping; PR Newswire, S&P Global
enhances KY3P[supreg] risk management capabilities with acquisition
of TruSight Solutions LLC (Jan. 9, 2023), https://www.prnewswire.com/news-releases/sp-global-enhances-ky3p-risk-management-capabilities-with-acquisition-of-trusight-solutions-llc-301715878.html; Penny Crosman, Fidelity's data-sharing unit Akoya to
be jointly owned with The Clearing House, 11 banks(Feb. 20, 2020),
Am. Banker, https://www.americanbanker.com/news/fidelitys-data-sharing-unit-akoya-to-be-jointly-owned-with-the-clearing-house-11-banks.
\14\ See, e.g., Visa, Visa to Acquire Plaid (Jan. 13, 2020),
https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.16856.html; Visa, Visa Completes Acquisition of
Tink (Mar. 10, 2022), https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.18881.html; Mastercard, Mastercard to
Acquire Finicity to Advance Open Banking Strategy (June 23, 2020),
https://www.finicity.com/in-the-news/mastercard-to-acquire-finicity-to-advance-open-banking-strategy/.
\15\ See, e.g., John Adams, Stripe adds tech for Plaid-like
account aggregation, Am. Banker (May 4, 2022), https://www.americanbanker.com/payments/news/stripe-adds-tech-for-plaid-like-account-aggregation; Klarna, Klarna launches `Klarna Kosma'
sub-brand and business unit to harness rapid growth of Open Banking
platform (Mar. 31, 2022), https://www.klarna.com/international/press/klarna-launches-klarna-kosma-sub-brand-and-business-unit-to-harness-rapid-growth-of-open-banking-platform/.
---------------------------------------------------------------------------
State of the Open Banking System
The CFPB estimates that at least 100 million consumers have
authorized a third party to access their account data. In 2022, the
number of individual instances in which third parties accessed or
attempted to access consumer financial accounts exceeded 50 billion and
may have been as high as 100 billion, figures that vastly exceed the
comparable public figures from some other jurisdictions' open banking
systems, even on a per-capita basis.\16\
---------------------------------------------------------------------------
\16\ See Competition & Mkts. Auth., UK reaches 7 million Open
Banking users milestone (Feb. 20, 2023), https://www.openbanking.org.uk/news/uk-reaches-7-million-open-banking-users-milestone/, and Bnamericas, Open Finance completes two years with
17.3 million customer consents (Feb. 2, 2023), https://www.bnamericas.com/en/news/brazil-open-finance-completes-two-years-with-173-million-customer-consents.
---------------------------------------------------------------------------
The open banking system also engages a large number of entities.
While loans and deposits in the United States are concentrated among
the largest depositories, there are more than nine thousand banks and
credit unions across the country,\17\ most of which serve as data
providers, as do numerous nondepository financial institutions.\18\ The
number of third parties may total as many as ten thousand, driven by a
large financial technology sector.\19\ A growing number of entities now
serve as both data providers and third parties. For example, many
depositories now offer personal financial management tools, while some
so-called neobank accounts and digital wallets serve as important
transaction accounts for consumers. Most third party access is
effectuated via a small number of aggregators, although some third
parties elect to access at least some data directly.
---------------------------------------------------------------------------
\17\ Fed. Deposit Ins. Corp., Statistics at a Glance--Industry
Trends (Mar. 31, 2023), https://www.fdic.gov/analysis/quarterly-banking-profile/statistics-at-a-glance/2023mar/industry.pdf; Nat'l
Credit Union Admin., Quarterly Credit Union Data Summary--2022 Q4
(Mar. 8, 2023), https://ncua.gov/files/publications/analysis/quarterly-data-summary-2022-Q4.pdf.
\18\ Some aggregators report even more data providers. See,
e.g., https://plaid.com/ (over 12,000 as of Sept. 16, 2023); https://www.mx.com/(over 13,000 as of Sept. 16, 2023); https://docs.finicity.com/search-institutions/(over 16,000 as Sept. 16,
2023); https://www.yodlee.com/data-aggregation (over 17,000 as of
Sept. 16, 2023).
\19\ In 2022, Plaid indicated that they alone have over 6,000
customers. Plaid, Ushering in Fintech's Next Phase (May 19, 2022),
https://plaid.com/blog/ushering-in-fintechs-next-phase/.
---------------------------------------------------------------------------
Third party data access is generally enabled by one of two methods.
In screen scraping, consumers usually share their consumer interface
credentials with a third party or their service provider. That entity
uses (and may store) those credentials to access the consumer's account
to retrieve data for use in the third party's products and services.
The second method is through developer interfaces maintained by data
providers or their service providers. These often take the form of APIs
that can be accessed without consumer credentials, for example, by
using secure tokens. Such interfaces enable the direct transmission of
structured machine-readable data, promote standardization, and reduce
risks of inaccuracies and security breaches, among other benefits. Data
providers also have offered APIs accessed using consumer interface
credentials or deployed tokenized access to their consumer interface,
but most stakeholders agree that such measures are best viewed as a
stopgap, and that credential-free access to developer interfaces is
preferable.
Based on feedback received through public comments and stakeholder
outreach, there is nearly universal consensus that developer interfaces
should supplant screen scraping.\20\ Stakeholders responding to the
SBREFA Outline, including small entity representatives, several data
aggregators, data providers, and a trade association representing third
party data recipients and aggregators, supported a general transition
towards the use of developer interfaces.\21\ However, such a transition
requires certain conditions. First, data providers must commit
resources to develop and maintain developer interfaces. While large
depository and nondepository institutions might have sufficient
information technology budgets to do this themselves, small
institutions tend to rely on a few core service providers, and
frequently report problems with the services that ``cores'' offer.
Second, connecting to a developer interface generally requires a third
party to agree to a data provider's terms of access, a process that has
been impeded as discussed below. Today, the CFPB estimates that about
half of third party data access currently occurs through APIs; scraping
comprises the bulk of the balance. This is a significant shift: as
recently as 2021, most access was via screen scraping. Much of this
progress has been concentrated among the largest data providers.
---------------------------------------------------------------------------
\20\ See, e.g., Consumer Fin. Prot. Bureau, Bureau Symposium:
Consumer Access to Financial Records Report, at 3-4 (July 2020),
https://s3.amazonaws.com/files.consumerfinance.gov/f/documents/cfpb_bureau-symposium-consumer-access-financial-records_report.pdf.
\21\ See Consumer Fin. Prot. Bureau, Final Report of the Small
Business Review Panel on the CFPB's Proposals and Alternatives Under
Consideration of the Required Rulemaking on Personal Financial Data
Rights, at 30-31 (Mar. 30, 2023), https://files.consumerfinance.gov/f/documents/cfpb_1033-data-rights-rule-sbrefa-panel-report_2023-03.pdf.
---------------------------------------------------------------------------
Open banking use cases continue to emerge and develop. Major use
cases, which the CFPB understands generally rely heavily or exclusively
on data from transaction accounts, include personal financial
management tools of all kinds, payment applications and digital
wallets, credit underwriting (including cashflow underwriting), and
identity verification. While many major use cases began as innovative
offerings by third parties, incumbent financial institutions have
adopted many of them in response to consumer demand. Many use cases
also compete with the core offerings of other types of financial
institutions, such as card networks and credit bureaus.\22\
---------------------------------------------------------------------------
\22\ Conversely, data-sharing schemes owned by large
depositories can also compete with open banking-supported products
and services; see, e.g., Early Warning Sys., Verify Identity--Expand
your customer base with confidence, https://www.earlywarning.com/products/verify-identity (last visited Sept. 7, 2023).
---------------------------------------------------------------------------
C. Challenges in the Open Banking System
Despite these developments, commercial actors are able to use their
market power and incumbency to privilege their concerns and interests
above fair competition that could benefit consumers. Divergent
interests in the market with respect to the scope, terms, and mechanics
of data access, and problems with the responsible collection, use, and
retention of data have impeded the negotiation of access agreements and
the development of market-wide standards. This leads to inconsistent
data access for consumers
[[Page 74799]]
and costs for the market. Most notably, these dynamics impel third
parties to rely on intermediaries. The commercial interests of such
intermediaries may not always advance open banking, since they stand to
benefit from protecting private network effects against open standards
that could displace them or lower their rents.
Market participants' interests may diverge due to interrelated
competitive, legal, and regulatory factors. Data providers may minimize
the data they share or refrain from sharing altogether to protect their
market position. Data providers may also have data security, risk
management, and data privacy concerns regarding consumer-authorized
access to their data and systems.\23\ Motivated by their own self-
interest, third parties may use screen scraping to collect more data
than they reasonably need. Diverging self-interests also lead to
disagreements over issues such as the frequency and duration of data
access, the imposition of access caps, the assignment of liability, and
consumer authorization procedures. These dynamics undermine the
efficient functioning of the open banking system for consumers and the
system's ability to move away from screen scraping.
---------------------------------------------------------------------------
\23\ See, e.g., Off. of the Comptroller of the Currency, Third-
Party Relationships: Interagency Guidance on Risk Management (June
6, 2023), https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html.
---------------------------------------------------------------------------
Third parties' data use can also contribute to problems in the
current open banking system. When consumers go into the market to
obtain a product, they do not want third parties to serve their own
commercial interests by collecting, using, or retaining data beyond
what they need to provide that product.\24\ For example, third parties
with surveillance revenue models monetize consumer data by targeting
consumers with unwanted ads or services or selling the consumer data,
undermining consumers' ability to limit data use to providing the
product they sought. Third parties also collect data using methods that
may compromise consumers' data privacy, security, and accuracy, as well
as data provider interests related to security, liability, and risk
management. For example, screen scraping may pose risks to consumers'
data privacy and security by capturing and storing consumer credentials
and potentially capturing more data than are reasonably necessary to
provide the requested product or service. Additionally, because screen
scraping requires a third party to parse through a data provider's
consumer interface and transpose the unstructured information that a
consumer sees into a structured format the third party can use, any
errors in the transposition or any changes a data provider makes to the
consumer interface can increase the risks of data inaccuracy in the
third party's product or service. Screen scraping also presents risks
to data providers because it involves third parties accessing data on
an automated basis from a system not designed for that purpose, leading
some data providers to report that screen scraping puts undue strain on
their information systems. Screen scraping exacerbates data provider
concerns with respect to liability, because it entails giving third
parties a way to access data provider information systems and initiate
payments in a way that can impede data providers' efforts to monitor
them.
---------------------------------------------------------------------------
\24\ Dan Murphy et al., Financial Data--The Consumer
Perspective, at 15, 18, Fin. Health Network (June 30, 2021), https://finhealthnetwork.org/wp-content/uploads/2021/04/Consumer-Data-Rights-Report_FINAL.pdf; Brooke Auxier, Americans and Privacy:
Concerned, Confused and Feeling Lack of Control Over Their Personal
Information, Pew Rsch. Ctr. (Nov. 15, 2019), https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/.
---------------------------------------------------------------------------
Impacts of These Challenges on the Open Banking System
The challenges described above in this part I.C have impeded
progress in negotiating access agreements in several respects. Data
providers may decide not to establish a developer interface in the
first instance, making it difficult for third parties to access data
without resorting to screen scraping. Even where data providers have a
developer interface, conflicting interests may inhibit parties from
reaching access agreements. And even where such agreements are reached,
negotiating them has often proved costly, and their terms often vary in
key respects that undermine the consistency of data access across the
system. For example, the scope of and frequency with which data are
made available vary from agreement to agreement. Attempts to
standardize or streamline negotiations by publishing model agreements
generally have been undertaken only by certain segments of the market,
limiting their effectiveness.\25\
---------------------------------------------------------------------------
\25\ See, e.g., The Clearing House, The Clearing House Releases
Model Agreement to Help Facilitate Safe Sharing of Financial Data
(Nov. 12, 2019), https://www.theclearinghouse.org/payment-systems/articles/2019/11/model_agreement_press_release_11-12-19.
---------------------------------------------------------------------------
These challenges also hamper efforts by industry to establish
standards for open banking. The absence of clarity around the scope of
consumers' data rights and the appropriate role of various parties has
left standard setters to negotiate a thicket of conflicting interests.
The result has been standards limited in their scope, specificity, and
adoption. These dynamics have limited standard setters from taking on
other functions for which they are potentially well-suited, such as
apportioning liability and developing an accreditation system.
Due to the lack of progress on access agreements and the
establishment of open, fair, and inclusive industry standards, the open
banking system has come to depend heavily on a handful of data
aggregators. Aggregators currently function as connectors and, as a
practical matter, standardize how many third parties receive data. As
such, they accrue economic benefits from the system's inability to
scale bilateral access agreements and open industry standards.
Dependency on a handful of data aggregators creates incentives for them
to rent-seek and self-preference. In a more open system where developer
interfaces are appropriately accessible and third parties are easily
verified, third parties and data providers may choose to connect
without intermediaries if they wish, or continue to use them to the
extent they offer compelling value.
When the challenges impeding progress described above in this part
I.C are resolved, consumers should be able to safely exercise their
data access rights in an open system not dominated by the interests of
any one segment of the market.
D. Overview of Rulemaking Objectives
The CFPB is proposing regulations to implement CFPA section 1033.
In addition to ensuring consumers can access covered data in an
electronic form from data providers, the proposed regulations would
address the challenges described above in part I.C with respect to the
open banking system by delineating the scope of data that third parties
can access on a consumer's behalf, the terms on which data are made
available, and the mechanics of data access. The proposed regulations
also would ensure that third parties act on consumers' behalf when
collecting, using, or retaining data.
If finalized as proposed, this rule will foster a data access
framework that is (1) safe, by ensuring third parties are acting on
behalf of consumers when accessing their data, including with respect
to consumers' privacy interests; (2) secure, by applying a consistent
set of security standards across the market; (3) reliable, by promoting
the accurate and consistent transmission of data that are usable by
consumers and authorized
[[Page 74800]]
third parties; and (4) competitive, by promoting standardization and
not entrenching the roles of incumbent data providers, intermediaries,
and third parties whose commercial interests might not align with the
interests of consumers and competition generally. The proposed rule is
intended to foster this kind of framework by direct regulation of
practices in the market and by identifying areas in which fair, open,
and inclusive standards can develop to provide additional guidance to
the market. Consistent with the statutory mandate in CFPA section
1033(d), various provisions in the proposed rule would promote the use
and development of standardized formats.
1. Clarifying Scope of Data Rights
The CFPB is proposing to define key terms, establish which covered
persons would be required to make data available to consumers, and
define which data would need to be made available to consumers. As
discussed in part IV.A, the CFPB is proposing to first apply part 1033
to a subset of covered persons--namely, entities providing asset
accounts subject to the Electronic Fund Transfer Act (EFTA) \26\ and
Regulation E,\27\ credit cards subject to the Truth in Lending Act
(TILA) \28\ and Regulation Z,\29\ and related payment facilitation
products and services. This proposed scope is intended to prioritize
some of the most beneficial use cases for consumers and leverage data
providers' existing capabilities. The proposed definition of covered
data would ensure consumers have access to key pricing terms,
transaction and balance information, payment initiation information,
and terms and conditions. As discussed in part IV.B, this would
facilitate consumer choice, including the ability of consumers to
change providers of products or services. Clarifying the scope of the
data right also would promote consistency in the data made available to
consumers, reduce costs of negotiating the inclusion of such data in
access agreements, and focus the development of technical standards
around such data.
---------------------------------------------------------------------------
\26\ 15 U.S.C. 1693 et seq.
\27\ 12 CFR part 1005.
\28\ 15 U.S.C. 1601 et seq.
\29\ 12 CFR part 1026.
---------------------------------------------------------------------------
2. Establishing Basic Standards for Data Access
As discussed in part IV.C, the proposed rule would require data
providers to establish and maintain a developer interface for third
parties to access consumer-authorized data. Developer interfaces would
need to make available covered data in a standardized format, in a
commercially reasonable manner, without unreasonable access caps, and
pursuant to certain security specifications. In addition, data
providers would need to follow certain procedures to disclose
information about themselves and their developer interfaces, which
would ensure that consumers and authorized third parties have
information necessary to make requests and use the developer interface.
Data providers also would be required to establish and maintain certain
written policies and procedures to promote these objectives.
Altogether, these provisions would ensure data providers make data
available reliably, securely, and in a way that promotes competition.
3. Transitioning the Market From Screen Scraping
The proposed rule would prevent data providers from relying on
screen scraping to comply with the proposal because it is not a viable
long-term method of access for the reasons discussed in part I.C above.
Instead, data providers would be required to establish and maintain
developer interfaces that would make data available in a machine-
readable, standardized format and could not allow a third party to
access the system using consumer interface credentials. These
provisions would help the market move away from screen scraping, even
outside of the product markets covered under the proposed rule. Once
developer interfaces have been established by data providers with
respect to covered data, it will be more efficient for these data
providers to provide access to other data types via the same developer
interface. And, as the infrastructure for establishing and using
developer interfaces embeds itself in the market for accessing consumer
financial data, data providers outside the scope of the proposed rule
will face competitive pressure to adopt and use developer interfaces as
well. During the rule's implementation period, and for data accessed
outside its coverage, the CFPB plans to monitor the market to evaluate
whether data providers are blocking screen scraping without a bona fide
and particularized risk management concern or without making a more
secure and structured method of data access available (e.g., through a
developer interface). If so, the CFPB would consider using the tools at
its disposal to address this topic in advance of the proposed
compliance dates.
4. Clarifying Mechanics of Data Access
As discussed in part IV.C, the CFPB is proposing certain
requirements and clarifications to implement CFPA section 1033 with
respect to when a data provider must make available covered data upon
request to consumers and authorized third parties. These proposed
provisions address how a data provider can manage requests for third
parties to access a developer interface and when a data provider must
respond to requests for information through a consumer and developer
interface. While the CFPB is not proposing amendments to Regulation E
at this time, proposed part 1033 contains multiple provisions that
would reduce fraud and unauthorized access risk in the open banking
system. These provisions include requiring that third party access be
effected through a developer interface (rather than through credential-
based screen scraping); prohibiting a developer interface from
requiring a third party to obtain or possess credentials for the
consumer interface; and allowing data providers to share tokenized
account and routing numbers. The proposed rule would allow data
providers to restrict access to their developer interface when they
have reasonable risk management grounds to do so.
5. Ensuring Third Parties are Acting on Behalf of Consumers
To effectuate consumers' control of access to their data, the
proposed rule contains provisions intended to ensure that when
consumers authorize a third party to access data on their behalf, the
third party is actually doing so. To that end, the proposed rule would
require a third party to certify to consumers that it will only
collect, use, and retain the consumer's data to the extent reasonably
necessary to provide the consumer's requested product or service. The
proposed rule also would aim to improve consumers' understanding of
third parties' data practices by requiring a clear and conspicuous
authorization disclosure including key facts about the third party and
its practices. Other key protections in the proposed rule include
limiting the length of data access authorizations and requiring
deletion of consumer data in many cases when a consumer's authorization
expires or is revoked.
Separately, the proposed rule would exercise the CFPB's authority
to define financial products or services under the CFPA to ensure that
it includes providing financial data processing. Although the CFPB has
tentatively concluded that this activity would
[[Page 74801]]
qualify as a financial product or service without a CFPB rule, this
rule provision would provide additional assurance that financial data
processing by third parties or others is subject to the CFPA and its
prohibition on unfair, deceptive, and abusive acts or practices.
6. Promoting Fair, Open, and Inclusive Industry Standards
Industry standard-setting bodies that operate in a fair, open, and
inclusive manner have a critical role to play in ensuring a safe,
secure, reliable, and competitive data access framework. Accordingly,
indicia of compliance with various provisions in the rule, if finalized
as proposed, would include conformance with standards promulgated by
fair, open, and inclusive standard-setting bodies recognized by the
CFPB.
Comprehensive and detailed technical standards mandated by Federal
regulation could not address the full range of technical issues in the
open banking system in a manner that keeps pace with changes in the
market and technology. A rule with very granular coding and data
requirements risks becoming obsolete almost immediately, which means
the CFPB and regulated entities would experience constant regulatory
amendment, or worse, the rule would lock in 2023 technology, and
associated business practices, potentially for decades. In developing
the proposal, the CFPB is mindful of these limitations and the risk
that they may adversely impact the development and efficient evolution
of technical standards over time. In contrast, industry standards
appropriately developed within the CFPB's proposed data access
framework would not be subject to these limitations.
To help support and maintain a data access framework that enables
consumer access in a consistently safe, reliable, and secure manner
across the market, industry standards must be widely adopted. To
meaningfully scale, standards must reflect a diverse set of interests,
increasing the likelihood that market participants will adopt the
standards and maintain their integrity. Conversely, if standards are
controlled by dominant incumbents or intermediaries, they may enable
rent-extraction and cost increases for smaller participants. Fair,
open, and inclusive standard-setting bodies are vital to promote
standards that can support a data access system that works for
consumers, rather than the interests of dominant firms.
E. Applicability of Other Laws
1. Electronic Fund Transfer Act
This proposed rule would not alter a consumer's statutory right
under EFTA to resolve errors through their financial institution.
Regulation E financial institutions--including digital wallet
providers, entities that refer to themselves as neobanks, and
traditional depository institutions--have and will continue to have
error resolution obligations in the event of a data breach where stolen
account or ACH credentials are used to initiate an unauthorized
transfer from a consumer's account and the consumer provides proper
notice. Consumers are protected from liability from these unauthorized
transfers under EFTA and Regulation E, although the relevant financial
institution may be able to seek reimbursement from other parties
through private network rules, contracts, and commercial law. For
example, although a consumer's financial institution is required to
reimburse the consumer for an unauthorized transfer under Regulation E,
ACH private network rules generally dictate that the receiving
financial institution is entitled to reimbursement from the originating
depository institution that initiated the unauthorized payment.
Various stakeholders have suggested that consumer-authorized data
sharing may create risks to consumers and financial costs to financial
institutions arising from an increased risk of unauthorized
transactions and other errors, especially when data access relies on
screen scraping. In implementing CFPA section 1033, the CFPB is
proposing a variety of measures to mitigate unauthorized transfer and
privacy risks to data providers and consumers, including allowing data
providers to share TANs, not allowing data providers to rely on
credential-based screen scraping to satisfy their obligations under
CFPA section 1033, clarifying that data providers can engage in
reasonable risk management activities, and implementing authorization
procedures for third parties that would require they commit to data
limitations and compliance with the Gramm-Leach-Bliley Act (GLBA) \30\
Safeguards Framework. These provisions are intended to drive market
adoption of safer data sharing practices.
---------------------------------------------------------------------------
\30\ 15 U.S.C. 6801 et seq.
---------------------------------------------------------------------------
2. Fair Credit Reporting Act
As described above, entities engaged in data aggregation activities
play a role in the open banking system by transmitting consumer-
authorized data from data providers to third parties. When the data
bears on a consumer's creditworthiness, credit standing, credit
capacity, character, general reputation, personal characteristics, or
mode of living and is used or expected to be used, or collected, for
``permissible purposes'' as defined by the FCRA, such as when a third
party uses the data to underwrite a loan to a consumer, and when the
entity, for monetary fees, dues, or on a cooperative nonprofit basis,
regularly engages in whole or in part in the practice of assembling or
evaluating such data for the purpose of furnishing reports containing
the data to third parties (and uses any means or facility of interstate
commerce to prepare or furnish such reports), the data aggregator is
regulated as a consumer reporting agency under the FCRA.
II. Legal and Procedural Background
In 2010, Congress passed the CFPA, including section 1033. This is
the first proposed CFPB rule under section 1033.
A. Small Business Advisory Review Panel
Pursuant to the Small Business Regulatory Enforcement Fairness Act
of 1996 (SBREFA),\31\ the CFPB issued its Outline of Proposals and
Alternatives under Consideration for the Required Rulemaking on
Personal Financial Data Rights (Outline or SBREFA Outline).\32\ The
CFPB convened a SBREFA Panel for this proposed rule on February 1,
2023, and held two Panel meetings on February 1 and 2, 2023.\33\
Representatives from 18 small businesses were selected as small entity
representatives for this SBREFA process. These entities represented
small businesses that would likely be directly affected by a CFPA
section 1033 rule. On March 30, 2023, the Panel completed the Final
Report of the Small Business Review Panel on the CFPB's Proposals Under
Consideration for the Required Rulemaking on Personal Financial Data
Rights Rulemaking (Panel Report or SBREFA Panel Report). The CFPB
released the Panel Report on
[[Page 74802]]
April 3, 2023.\34\ The CFPB invited other stakeholders to submit
feedback on the SBREFA Outline by January 25, 2023.\35\ The CFPB has
considered the feedback it received from small entity representatives,
the findings and recommendations of the Panel, and the feedback from
other stakeholders in preparing this proposed rule.
---------------------------------------------------------------------------
\31\ Public Law 104-121, 110 Stat. 857 (1996).
\32\ Consumer Fin. Prot. Bureau, Small Business Advisory Review
Panel for Required Rulemaking on Personal Financial Data Rights,
Outline of Proposals and Alternatives under Consideration (Oct. 27,
2022), https://files.consumerfinance.gov/f/documents/cfpb_data-rights-rulemaking-1033-SBREFA_outline_2022-10.pdf.
\33\ The Panel consists of a representative from the CFPB, the
Chief Counsel for Advocacy of the SBA, and a representative from the
Office of Information and Regulatory Affairs in OMB.
\34\ Consumer Fin. Prot. Bureau, Final Report of the Small
Business Review Panel on the CFPB's Proposals and Alternatives Under
Consideration for the Required Rulemaking on Personal Financial Data
Rights (Mar. 30, 2023), https://files.consumerfinance.gov/f/documents/cfpb_1033-data-rights-rule-sbrefa-panel-report_2023-03.pdf. As required under SBREFA, the CFPB considers the Panel's
findings in its IRFA, as set out in part VII below.
\35\ See https://www.regulations.gov/document/CFPB-2023-0011-0001/comment (last visited Aug. 28, 2023). Feedback from these other
stakeholders was not considered by the Panel and is not reflected in
the Panel Report.
---------------------------------------------------------------------------
B. Other Stakeholder Outreach
In the years leading up to the release of this proposed rule, the
CFPB held a number of outreach meetings with financial institutions,
trade associations, nondepositories, aggregators, community groups,
consumer advocates, researchers, and other stakeholders regarding the
CFPA section 1033 rule, and about the open banking system generally.
Findings from such market monitoring activities inform the CFPB on the
state of the open banking system.
In January 2023, the CFPB issued two sets of CFPA section
1022(c)(4) market monitoring orders to collect information related to
personal financial data rights--one set of orders was sent to a group
of data aggregators (Aggregator Collection); \36\ the second to a group
of large data providers (Provider Collection).\37\ The information
gathered through these orders informs this proposed rule, including the
CFPA section 1022(b) analysis in part VI below.
---------------------------------------------------------------------------
\36\ Consumer Fin. Prot. Bureau, Generic Order for Data
Aggregators, https://files.consumerfinance.gov/f/documents/cfpb_generic-1022-order-data-aggregator_2023-01.pdf (last visited
Aug. 28, 2023).
\37\ Consumer Fin. Prot. Bureau, Generic Order for Data
Providers, https://files.consumerfinance.gov/f/documents/cfpb_generic-1022-order-data-provider_2023-01.pdf (last visited Aug.
28, 2023).
---------------------------------------------------------------------------
The CFPB regularly hears from several advisory committees on
emerging trends and practices in the consumer financial marketplace and
engages with advisory committee members in different formats, including
non-public and public engagements. In November 2022, the CFPB Director
and CFPB staff engaged in a discussion about data privacy in the
context of CFPA section 1033 with members of the Consumer Advisory
Board. Additionally, the CFPB Director and CFPB staff received two
briefings related to the CFPA section 1033 rule--one from the Consumer
Advisory Board and one from the combined Community Bank Advisory
Council and Credit Union Advisory Council.\38\
---------------------------------------------------------------------------
\38\ See Consumer Fin. Prot. Bureau, Consumer Advisory Board
Meeting (Nov. 2, 2022), https://s3.amazonaws.com/files.consumerfinance.gov/f/documents/cfpb_consumer-advisory-board-meeting_summary_2022-11.pdf; Consumer Fin. Prot. Bureau, Cmty. Bank
Advisory Council & Credit Union Advisory Council, Combined Advisory
Councils Meeting (Nov. 3, 2022), https://s3.amazonaws.com/files.consumerfinance.gov/f/documents/cfpb_combined-advisory-board-meeting_summary_2022-11.pdf.
---------------------------------------------------------------------------
Prior to issuing this proposed rule (in accordance with CFPA
sections 1033(e) and 1022(b)(2)(B), and as recommended by the SBREFA
Panel), the CFPB consulted on several occasions with staff from the
prudential regulators and the FTC to discuss various aspects of this
proposed rule. Specifically, the CFPB met with staff from the Board of
Governors of the Federal Reserve System, the OCC, the FDIC, the NCUA,
the FTC, the Department of Treasury's Bureau of the Fiscal Service, the
United States Department of Justice, and the Financial Crimes
Enforcement Network. The CFPB also met with a number of State
regulators and an association of State regulators to discuss the CFPB's
proposals under consideration. The CFPB also met with its foreign
counterparts to discuss open banking frameworks in their respective
countries.
III. Legal Authority
The CFPB is issuing this proposed rule pursuant to its authority
under the CFPA. This part includes a general discussion of several CFPA
provisions on which the CFPB relies in this proposed rule.\39\ As set
forth in section 1021 of the CFPA, Congress established the CFPB to
ensure that ``all consumers have access to markets for consumer
financial products and services and that markets for consumer financial
products and services are fair, transparent, and competitive.''
Congress also authorized the CFPB to exercise its authorities under
Federal consumer financial law, including the CFPA, to ensure that,
with respect to consumer financial products and services, consumers
have ``timely and understandable information to make responsible
decisions about financial transactions,'' ``consumers are protected
from unfair, deceptive, or abusive acts and practices and from
discrimination,'' that ``markets for consumer financial products and
services operate transparently and efficiently to facilitate access and
innovation,'' and that ``Federal consumer financial law is enforced
consistently without regard to the status of a person as a depository
institution in order to promote fair competition.''
---------------------------------------------------------------------------
\39\ Part IV contains additional material on these authorities.
---------------------------------------------------------------------------
A. CFPA Section 1033
CFPA section 1033(a) and (b) provide that, subject to rules
prescribed by the CFPB, a covered person shall make available to a
consumer, upon request, information in the control or possession of the
covered person concerning the consumer financial product or service
that the consumer obtained from such covered person, subject to certain
exceptions. The information must be made available in an electronic
form usable by consumers. Section 1002 of the CFPA defines certain
terms used in CFPA section 1033, including defining consumer as ``an
individual or an agent, trustee, or representative acting on behalf of
an individual.'' In light of these purposes and objectives of section
1033 and the CFPA generally, the CFPB interprets CFPA section 1033 as
authority to establish a framework that readily makes available covered
data in an electronic form usable by consumers and third parties acting
on behalf of consumers, upon request, including authorized third
parties offering competing products and services. In addition, CFPA
section 1033(d) provides that the CFPB, by rule, shall prescribe
standards applicable to covered persons to promote the development and
use of standardized formats for information, including through the use
of machine-readable files, to be made available to consumers under this
section. Moreover, the CFPB interprets CFPA section 1033 as authority
to specify procedures to ensure third parties are truly acting on
behalf of consumers when accessing covered data. These procedures would
help ensure the market for consumer-authorized data operates fairly,
transparently, and competitively.
CFPA section 1033(c) provides that nothing in CFPA section 1033
shall be construed to impose any duty on a covered person to maintain
or keep any information about a consumer. Further, CFPA section 1033(e)
requires that the CFPB consult with the prudential regulators and the
FTC to ensure, to the extent appropriate, that certain objectives are
met.
B. CFPA Sections 1022(b) and 1024(b)(7)
CFPA section 1022(b)(1) authorizes the CFPB to, among other things,
[[Page 74803]]
prescribe rules ``as may be necessary or appropriate to enable the CFPB
to administer and carry out the purposes and objectives of the Federal
consumer financial laws, and to prevent evasions thereof.'' The CFPA is
a Federal consumer financial law.\40\ Accordingly, in issuing the
proposed rule, the CFPB is exercising its authority under CFPA section
1022(b) to prescribe rules that carry out the purposes and objectives
of the CFPA and to prevent evasions thereof. This would include, at
least in part, provisions to require covered persons or service
providers to establish and maintain reasonable policies and procedures,
such as those to create and maintain records that demonstrate
compliance with the rule when final. CFPA section 1024(b)(7) also
grants the CFPB authority to impose record retention requirements on
CFPB-supervised nondepository covered persons ``for the purposes of
facilitating supervision of such persons and assessing and detecting
risks to consumers.''
---------------------------------------------------------------------------
\40\ See 12 U.S.C. 5481(14) (defining ``Federal consumer
financial law'' to include the provisions of the CFPA).
---------------------------------------------------------------------------
CFPA section 1022(b)(3)(A) generally provides that the CFPB, by
rule, may conditionally or unconditionally exempt any class of covered
persons, service providers, or consumer financial products or services,
from any provision of the CFPA, or from any rule issued under the CFPA,
as the CFPB determines necessary or appropriate to carry out the
purposes and objectives of the CFPA, taking into consideration several
factors. For a discussion of the CFPB's proposed use of this authority,
see the discussion in part IV.A. The statutory language indicates that
the CFPB should evaluate the case for creating such an exemption in
light of its general purposes and objectives as Congress articulated
them in section 1021 of the CFPA, as described above.
C. CFPA Section 1032
CFPA section 1032(a) provides that the CFPB may prescribe rules to
ensure that the features of any consumer financial product or service,
both initially and over the term of the product or service, are fully,
accurately, and effectively disclosed to consumers in a manner that
permits consumers to understand the costs, benefits, and risks
associated with the product or service, in light of the facts and
circumstances. Under CFPA section 1032(a), the CFPB is empowered to
prescribe rules regarding the disclosure of the ``features'' of
consumer financial products and services generally. CFPA section
1032(c) provides that, in prescribing rules pursuant to CFPA section
1032, the CFPB shall consider available evidence about consumer
awareness, understanding of, and responses to disclosures or
communications about the risks, costs, and benefits of consumer
financial products or services.
D. CFPA Section 1002
Certain provisions of the CFPA, such as its prohibition on unfair,
deceptive, or abusive acts or practices, apply in connection with a
consumer financial product or service. Under CFPA section 1002(5), this
is generally defined as a financial product or service that is
``offered or provided for use by consumers primarily for personal,
family, or household purposes.'' In turn, CFPA section 1002(15) defines
a financial product or service by reference to a number of categories.
In addition, CFPA section 1002(15)(A)(xi)(II) authorizes the CFPB to
issue a regulation to define as a financial product or service, for
purposes of the CFPA, ``such other financial product or service'' that
the CFPB finds is ``permissible for a bank or for a financial holding
company to offer or to provide under any provision of a Federal law or
regulation applicable to a bank or a financial holding company, and
has, or likely will have, a material impact on consumers.'' The CFPB is
proposing to exercise this authority in proposed Sec. 1001.2(b).
IV. Discussion of the Proposed Rule
12 CFR Part 1033
A. Subpart A--General
1. Overview
Proposed subpart A would establish the coverage and terminology
necessary to implement CFPA section 1033 for this proposed rule,
beginning with proposed Sec. 1033.101, which would describe the
authority, purpose, and organization of the regulation in proposed part
1033. It contains defined terms appearing throughout the regulatory
text, which are described in this part IV.A and elsewhere in part IV
and sets forth tiered compliance dates to provide appropriate
flexibility to smaller institutions in implementing the rule's
requirements.
2. Coverage of Data Providers (Sec. 1033.111(a) Through (c))
Regulation Z Card Issuers, Regulation E Financial Institutions, and
Other Payment Facilitation Providers
In this first proposed rule to implement CFPA section 1033(a), the
CFPB is proposing to define a subset of covered persons and consumer
financial products or services that would be required to make data
available under section 1033(a) of the CFPA. The proposed rule would
cover the following consumer financial products or services, as defined
at proposed Sec. 1033.111(b)(1) through (3)--generally, Regulation E
asset accounts, Regulation Z credit cards, and products or services
that facilitate payments from a Regulation E account or a Regulation Z
credit card. The latter category--products or services that facilitate
payments from a Regulation E account or a Regulation Z credit card--
would be intended to clarify that the proposed rule would cover all
consumer-facing entities involved in facilitating the transactions the
CFPB intends to cover.
Payment data from these products and services support common
beneficial consumer use cases today, including transaction-based
underwriting, payments, deposit account switching, and comparison
shopping for bank and credit card accounts. Credit cards are
increasingly used as payment devices for everyday expenses, and credit
card transaction data have in some cases become interchangeable with
Regulation E account transaction data. In addition, digital wallet
providers hold valuable data that can provide a complete understanding
of a consumer's finances. Today, a digital wallet can initiate payments
from multiple credit cards, prepaid accounts, and checking accounts. A
digital wallet can facilitate payments from accounts that the digital
wallet provider offers through depository institution partners, or from
linked accounts that were originally issued by other institutions
(sometimes referred to as pass-through payments).
The CFPB has preliminarily determined that the marginal burden of
including other payment facilitation products and services would be
minimal given how these providers would generally already be covered as
Regulation E financial institutions. Digital wallet providers and
entities that refer to themselves as neobanks generally qualify as
Regulation E financial institutions and sometimes also may be
Regulation Z card issuers. Adopting a broad definition could help avoid
creating unintentional loopholes as the market evolves.
Covering Regulation E asset accounts, Regulation Z credit cards,
and payment facilitation products and services would have additional
benefits. This coverage would leverage existing infrastructure for
consumer-authorized data sharing, which would facilitate
implementation. Data providers generally share the
[[Page 74804]]
covered data described in this proposed rule on consumer interfaces
today, and some share covered data with third parties. Additionally,
given the current level of data sharing associated with these products
and services, the proposed coverage would prioritize these data for
greater protection compared to what is available today. In particular,
consumers' payment data can be used to access consumer funds or track
household spending. As discussed in part I.D, this proposal would
include a number of measures to foster a safe and secure data access
framework.
The SBREFA Panel recommended that the CFPB consider clarifying the
types of products that would be covered under the proposed rule.\41\ In
addition, the CFPB received feedback from small entity representatives
and other stakeholders indicating confusion about whether the CFPB
intended to cover nondepository data providers and their products, and
whether all credit card products would be included.
---------------------------------------------------------------------------
\41\ SBREFA Panel Report at 42.
---------------------------------------------------------------------------
Consistent with the Panel recommendation and the feedback received,
the proposal would make clear that a data provider generally would have
obligations to make available covered data with respect to a covered
consumer financial product or service. Proposed Sec. 1033.111(b) would
define covered consumer financial product or service to mean (1) a
Regulation E account, a defined term that would have the same meaning
as defined in 12 CFR 1005.2(b); (2) a Regulation Z credit card, a
defined term that would have the same meaning as defined in 12 CFR
1026.2(a)(15)(i); and (3) the facilitation of payments from a
Regulation E account or Regulation Z credit card. Proposed Sec.
1033.111(c) would define data provider to mean (1) a Regulation E
financial institution, as defined in 12 CFR 1005.2(i); (2) a Regulation
Z card issuer as defined in 12 CFR 1026.2(a)(7); or (3) any other
person that controls or possesses information concerning a covered
consumer financial product or service the consumer obtained from that
person. Proposed example 1 to Sec. 1033.111(c) explains that a digital
wallet provider is a data provider. The CFPB requests feedback on the
proposed definitions, including whether any further clarification is
needed to demonstrate that entities that refer to themselves as
neobanks, digital wallet providers, and similar nondepository entities
would qualify as data providers.
Other Consumer Financial Products and Services
Today, covered persons typically share information concerning
financial products and services that would not fall within the
definition of covered data in proposed Sec. 1033.211, such as
mortgage, automobile, and student loans. Similar to the payment data
that would be covered, information about these products is generally
shared through consumer interfaces and supports a variety of beneficial
use cases. A significant difference is that this information does not
typically support transaction-based underwriting across a range of
markets or payment facilitation. Accordingly, the CFPB has
preliminarily concluded that prioritizing Regulation E accounts,
Regulation Z credit cards, and payment facilitation products and
services in this proposed rule could serve to advance competition goals
across a broader range of markets. The CFPB intends to implement CFPA
section 1033 with respect to other covered persons and consumer
financial products or services through supplemental rulemaking.
When distributed electronically, needs-based benefits established
under State or local law or administered by a State or local agency are
primarily issued to consumers via EBT cards. EBT-related data are
mainly accessed directly by the consumer through private entities that
have contracted with State or local governments that administer
programs for Federal government agencies. The CFPB has received
feedback from small entity representatives and other stakeholders that
there can be limitations to the availability of EBT-related data and
that third party access to EBT data could address these issues. EBT
cards are exempt from EFTA coverage by statute; pursuant to the
Consolidated Appropriations Act of 2023, the U.S. Department of
Agriculture has been directed to engage in a rulemaking and issue
guidance on EBT card security practices.\42\
---------------------------------------------------------------------------
\42\ Public Law 117-328, 136 Stat. 5985 (2022).
---------------------------------------------------------------------------
The CFPB is considering whether to add EBT-related data to the
final rule, or whether to reach EBT cards in a subsequent rulemaking.
While EBT cards differ from the current scope of data types included in
the proposed regulation in some ways, they have some significant
similarities, including that they are used by consumers to make regular
purchases. The CFPB requests comment on whether the most appropriate
way to solve issues related to EBT data accessed directly by the
consumer is through section 1033 of the CFPA, and whether it should do
so as part of this first rulemaking related to payments data or a
subsequent rule under section 1033. The CFPB also seeks comment on
third party practices related to consumer-authorized EBT data,
including the interaction between those practices and the limitations
on uses that are not reasonably necessary in proposed Sec. 1033.421(a)
and (c). Finally, the CFPB seeks comment on the benefits and drawbacks
of enabling third party access to EBT-related data, including with
respect to data security.
3. Excluded Data Providers (Sec. 1033.111(d))
Pursuant to CFPA section 1022(b)(3), proposed Sec. 1033.111(d)
generally would exempt data providers (as defined in proposed Sec.
1033.111(c)) from the requirements of the proposed rule if they have
not established a consumer interface as of the applicable compliance
date. Proposed Sec. 1033.131 would define consumer interface as an
interface that a data provider maintains to receive requests for
covered data and make available covered data in an electronic form
usable by consumers in response to the requests. The term is intended
to encompass consumer-facing digital banking interfaces that allow
consumers to make requests for information, as described in part I.A
above.
While the vast majority of banks and credit unions offer consumer
interfaces, such as online banking or mobile banking applications, a
small number of depository institutions do not offer any such service.
For example, among credit unions with fewer than 1,000 deposit
accounts, only 21 percent offer online banking services.\43\ These
institutions tend to be very small and may not have adequate resources
to support or maintain these online or mobile banking systems. They may
also use a relationship banking model and have a more personalized
relationship with their customers.\44\
---------------------------------------------------------------------------
\43\ CFPB calculations based on NCUA data. For details on data
see part VII.B.6.
\44\ See, e.g., Consumer Fin. Prot. Bureau, Request for
Information Regarding Relationship Banking and Customer Service
(June 14, 2022), https://www.federalregister.gov/documents/2022/07/20/2022-15243/request-for-information-regarding-relationship-banking-and-customer-service.
---------------------------------------------------------------------------
Some depositories do not offer digital banking in the current
environment, despite the ubiquity of computers and smartphones, broad
consumer utilization of online banking and mobile banking applications,
and the impact of the COVID-19 pandemic, which impeded many consumers'
access to
[[Page 74805]]
traditional banking channels. This suggests that, first, such entities
have not found that the business reasons to provide these services
justify the associated costs; and, second, that their customers have
not switched to institutions that do provide digital banking services,
indicating that such services may not be an important factor for such
customers when choosing where to deposit or borrow money.\45\ The CFPB
notes that it has preliminarily determined to limit this proposed
exclusion to depositories that qualify as financial institutions under
Regulation E or as card issuers under Regulation Z. Not all CFPA-
covered persons will necessarily have the same incentives to facilitate
direct customer service with consumers. For example, there may be
covered persons that do not market to or contract with consumers and
that do not have the same incentives to invest in customer service.
---------------------------------------------------------------------------
\45\ See, e.g., Miriam Cross, Credit Unions Podcast: A tiny
credit union's tall order, Am. Banker (May 25, 2023), https://www.americanbanker.com/podcast/a-tiny-credit-unions-tall-order
(discussing factors some customers of very small credit unions use
when determining whether to continue to patronize such
institutions).
---------------------------------------------------------------------------
The SBREFA Panel recommended that the CFPB consider whether to
create complete or partial exemptions for data providers, or whether to
delay implementation for certain data providers for certain aspects of
the proposed rule, such as a requirement to establish a developer
interface.\46\ The Panel also recommended that the CFPB seek comment on
how to define potential exemption eligibility requirements or
implementation tiers, such as by establishing a threshold based on
asset size or activity level, or by exempting data providers based on
entity type.\47\ Consistent with these recommendations, the CFPB
considered whether to exempt all data providers, not just certain
depository institutions, that do not provide a consumer interface and,
if so, how to structure such an exemption. However, the complicating
factors that exist for these types of depository institutions may be
less likely to exist for these types of nondepository institutions. For
example, nondepository data providers within the scope of the proposed
rule tend to be institutions whose business models are built upon
providing interfaces to consumers. This is not the case for depository
institutions that do not provide an interface for their customers. The
CFPB requests comment on whether there are nondepositories that do not
provide an interface for their customers, and if so, whether an
exemption should include them. The CFPB also seeks comment on whether
it should require any exempt depositories to make covered data
available in a non-electronic form.
---------------------------------------------------------------------------
\46\ SBREFA Panel Report at 43.
\47\ Id. at 42.
---------------------------------------------------------------------------
As noted in the discussion of the proposed rule's compliance dates,
the CFPB is proposing to provide a longer compliance period for the
smallest depository institution data providers. The CFPB also
considered not proposing an exemption for any data providers, and
instead simply giving some data providers more time to comply. However,
because of the dynamics with respect to depository institutions that do
not provide an interface for their customers, the compliance burden on
these entities would most likely outweigh the marginal benefit of the
rule covering an additional very small set of consumer accounts.
The proposed rule would not provide a grace period for depository
institutions that do not have a consumer interface as of the effective
date but subsequently offer such an interface to their customers. The
CFPB requests comment on whether such depositories should be offered
some grace period to achieve compliance. Proposed Sec. 1033.111(d)
would not exempt depositories that stop providing a customer interface
after the effective date. Such depositories possessed the ability to
provide an interface for their consumers, and so should remain subject
to the rule.
Under CFPA section 1022(b)(3)(A), the CFPB may exercise exemption
authority as it determines necessary or appropriate to carry out the
purposes and objectives of CFPA section 1033, taking into
consideration, as appropriate: (1) the total assets of the class of
covered persons; (2) the volume of transactions involving consumer
financial products or services in which the class of persons engages;
and (3) existing provisions of law which are applicable to the consumer
financial product or service and the extent to which such provisions
provide consumers with adequate protections.
The CFPB has preliminarily determined that the proposed exemption
would promote the CFPB's objectives, discussed in part I above, to
ensure that the markets for consumer financial products and services
operate transparently and efficiently to facilitate access, as well as
its objective to ensure that consumers are provided with timely and
understandable information to make responsible decisions about
financial transactions. The CFPB has also preliminarily determined that
the proposed exemption would promote the CFPA's purpose of ensuring
that markets for consumer financial products and services are
competitive. As noted above, the depository institutions that would be
exempt from the proposed rule's requirements tend to be very small
institutions that may not be as technologically sophisticated as larger
institutions and likely do not have the resources to support or
maintain the interfaces that would be required by the proposed rule.
Subjecting these institutions to the proposal could significantly
disrupt their businesses, potentially threatening access to consumer
financial products and services and reducing competition for consumer
financial products and services--both contrary to carrying out the
objectives of CFPA section 1033.
The CFPB acknowledges that some consumers would not be given the
benefits provided by the proposed rule if these entities were exempt.
However, as noted above, these small depository institutions generally
provide timely and understandable information through ongoing personal
relationships to assist customers in making decisions about financial
transactions. The CFPB seeks comment on whether the exclusion for
depository institutions that do not provide an interface for their
customers should be limited solely to the provision of the interfaces
required by the proposed rule, or whether the rule should still require
such institutions to comply with the general obligations outlined in
proposed Sec. 1033.201(a) and allow flexible compliance with this
section. The CFPB also seeks comment on whether different or additional
criteria, such as an institution's asset size or activity level, should
be taken into consideration when determining what depository
institutions would be exempt from the proposed rule.
As noted above, the CFPB considers, as appropriate, the applicable
statutory factors in CFPA section 1022(b)(3)(A). Because the
requirements of this proposed rule would focus on consumers' data, a
suitable proxy for considering two of the three factors--total assets
of the class of covered persons and the volume of transactions--would
be the number of accounts exempted. The CFPB expects the number of data
requests will be approximately proportional to the number of accounts.
By exempting depository institutions that do not have an interface, the
proposed rule would exempt approximately 0.64 percent of total deposit
accounts, a very small percentage of deposit accounts covered by the
proposed rule.
[[Page 74806]]
This exemption would treat some depository data providers
differently than nondepository ones. However, nondepository data
providers within scope of this proposed rule tend to use business
models built on the ability to innovate with respect to technology and
move quickly to implement technological changes and solutions, in
contrast to depository institutions that have not established a
consumer interface for their customers. Thus, the CFPB preliminarily
concludes that these two groups are not similarly situated for purposes
of this proposed rule. By exempting these depository institutions from
regulations that would be more costly and burdensome for them than it
would be for their peers with greater technological capabilities, the
CFPB would be promoting fair competition.
The CFPB's preliminary determination regarding exempting depository
institution data providers that do not provide a consumer interface to
their customers is specific to this proposed rule and the data that
would be covered by it. Further rulemaking under section 1033 of the
CFPA may make different determinations based upon the types of data
providers and types of data covered.
4. Compliance Dates (Sec. 1033.121)
Proposed Sec. 1033.121 would stagger dates by which data providers
need to comply with proposed Sec. Sec. 1033.201 and 1033.301 (the
obligations to make data available and establish interfaces) into four
distinct tiers to ensure timely compliance with the rule's
requirements. From the SBREFA process and other stakeholder feedback,
the CFPB understands that a number of factors may affect how quickly a
data provider could comply with the proposed rule. These include, for
example, a data provider's size, relative technological sophistication,
use of third party service providers to build and maintain software and
hardware systems, and, in the case of many data providers, the
existence of multiple legacy hardware and software systems that impact
their ability to layer on new technology.\48\ Many smaller depository
data providers will need to rely on cores and other third party service
providers to create interfaces required by the proposed rule.\49\ These
entities may experience significant wait times since many other
entities may be relying on the same providers for the development of
their interfaces.\50\ If a depository institution data provider builds
its own interface without the assistance of a third party service
provider, it may need additional time to do so.
---------------------------------------------------------------------------
\48\ Id. at 36.
\49\ Id. at 36-37.
\50\ Id. at 36.
---------------------------------------------------------------------------
The CFPB preliminarily believes nondepository data providers do not
have the same obstacles with respect to compliance as depository
institutions because they do not have as many vendors and information
technology systems that would need to be connected, and implementation
could occur in-house.\51\ Thus, these data providers would be able to
move more quickly to implement the proposed rule's requirements.
---------------------------------------------------------------------------
\51\ Id. at 38.
---------------------------------------------------------------------------
The SBREFA Panel made several recommendations related to compliance
dates. Generally, the Panel recommended that the CFPB seek comment on
ways to facilitate implementation for small entities, and on
implementation options that reduce impacts on small entities, including
staging implementation based on categories of data to be made
available, entity size, or other factors.\52\ The Panel also
recommended that the CFPB continue to study the time needed for vendors
to establish a data portal on behalf of data providers, as well as the
time needed by data providers, data aggregators, and data recipients to
integrate into data portals at the scale envisioned by the
proposal.\53\ Lastly, the Panel recommended that the CFPB consider
whether to delay implementation for certain data providers for certain
aspects of the rule, such as a requirement to establish a third party
access portal, and should seek comment on how to define implementation
tiers, such as by establishing a threshold based on asset size or
activity level.\54\ (The CFPB is proposing to define and use the term
developer interface in lieu of the SBREFA Outline's ``third-party
access portal.'')
---------------------------------------------------------------------------
\52\ Id. at 46.
\53\ Id.
\54\ Id. at 43.
---------------------------------------------------------------------------
The CFPB considered a number of alternatives to the four tiers
outlined in the proposed rule. One option was to have the same
compliance date for all data providers. For the reasons discussed in
this part IV.A, the CFPB has preliminarily determined that it is
necessary to provide some data providers with a longer compliance
period than others. The CFPB has preliminarily determined that the
proposed exemption combined with the tiered compliance dates based on
asset size or revenue appropriately balances the need to provide relief
to the smallest data providers that may not be as technologically
sophisticated as larger providers while providing a longer timeline for
compliance to entities that may need more time. The CFPB also
considered basing the compliance tiers on an institution's number of
accounts/activity level, rather than asset size or revenue. With
respect to number of accounts, the CFPB has preliminarily determined
that, because of the breadth of types of data providers and services
covered by the proposed rule, it would be difficult to define accounts
to properly segment data providers into appropriate tiers, and asset
size and revenue provide more precise metrics in which to separate
compliance tiers.
Subject to a data provider's ability to deny access, as described
in Sec. 1033.321, and the exclusion for data providers described in
proposed Sec. 1033.111(d), proposed Sec. 1033.121 would require data
providers to grant access to the interfaces required by proposed Sec.
1033.301 to consumers and third parties by four applicable compliance
dates based on asset size or revenue, depending on the type of data
provider. Under proposed Sec. 1033.121(a), the first compliance date
would occur approximately six months after publication of the final
rule in the Federal Register and would apply to depository institutions
that hold at least $500 billion in total assets, and to nondepository
institutions that generate at least $10 billion in revenue in the
preceding calendar year or are projected to generate at least $10
billion in revenue in the current calendar year. The CFPB uses the term
``total assets'' to make clear that this amount is based upon the total
consolidated assets of the institution as reported in published
financial statements, as used by the FFIEC.\55\ Under proposed Sec.
1033.121(b), the second compliance date would occur approximately one
year after Federal Register publication and would apply to depository
institutions that hold at least $50 billion in total assets but less
than $500 billion in total assets, and to nondepository institutions
that generate less than $10 billion in revenue in the preceding
calendar year and are projected to generate less than $10 billion in
revenue in the current calendar year. The CFPB has preliminarily
determined that placing all nondepository data providers in the first
two tiers for compliance appropriately balances the need to provide
data providers enough time for compliance with depository data
[[Page 74807]]
providers potentially needing additional time. Under proposed Sec.
1033.121(c), the third compliance date would occur approximately 2.5
years after Federal Register publication and would apply to depository
institutions that hold at least $850 million but less than $50 billion
in total assets. Finally, under proposed Sec. 1033.121(d), the fourth
and final compliance date would occur approximately four years after
Federal Register publication and would apply to depository institutions
with less than $850 million in total assets.
---------------------------------------------------------------------------
\55\ See, e.g., Fed. Fin. Insts. Examination Council, Large
Holding Companies, https://www.ffiec.gov/npw/Institution/TopHoldings
(last visited Sept. 22, 2023).
---------------------------------------------------------------------------
The CFPB seeks comment on whether different or additional criteria,
such as an institution's number of accounts or other criteria, should
be taken into consideration when determining compliance dates. The CFPB
also seeks comment on the structure of each tier, and whether
nondepository institutions should be included in all four tiers.
The CFPB recognizes that data providers may need to transition
third parties to developer interfaces in a staggered order. Under the
proposed rule, a data provider not excluded from coverage could delay a
third party's access to an interface in accordance with proposed Sec.
1033.321. The CFPB seeks comment on whether the proposed rule provides
data providers sufficient flexibility for such a transition or whether
revisions to the proposed rule or additional guidance is needed. For
example, the CFPB seeks comment on whether the final rule should
include language clarifying that data providers should be granted any
period of time to fully transition third parties to the interfaces that
would be required under proposed Sec. 1033.301 to ensure that data
providers do not impede timely third party access to an interface while
accounting for reasonable risk management concerns.
5. Third Party, Authorized Third Party, Consumer, and Data Aggregator
(Sec. 1033.131)
The CFPB is proposing that a third party acting on behalf of a
consumer would be able to access covered data. Proposed Sec. 1033.131
includes several definitions that are used in describing the proposed
processes and conditions for a third party to access covered data on
behalf of a consumer. The CFPB is proposing these definitions to carry
out the objectives of CFPA section 1033.
The CFPB is proposing to define the term third party as any person
or entity that is not the consumer about whom the covered data pertains
or the data provider that controls or possesses the consumer's covered
data. The proposed rule uses the term third party to refer to entities
seeking access to covered data and to other parties, including data
aggregators.
As discussed in part III above, the CFPB interprets CFPA section
1033(a) to require data providers to make available covered data to
certain third parties ``acting on behalf'' of a consumer. The CFPB is
proposing to define the term authorized third party as a third party
that has complied with the authorization procedures described in
proposed Sec. 1033.401. Proposed Sec. 1033.401, discussed in part
IV.D, specifies what requirements a third party must satisfy to become
an authorized third party that is entitled to access covered data on
behalf of a consumer.
The CFPB is proposing to define the term data aggregator to mean an
entity that is retained by and provides services to the authorized
third party to enable access to covered data. As discussed below, some
third parties retain data aggregators for assistance in obtaining
access to data from data providers. The proposed rule includes certain
provisions in proposed Sec. 1033.431 that specify what role data
aggregators would play in the third party authorization procedures,
what information about data aggregators would have to be included in
the authorization disclosure, and what conditions data aggregators
would have to certify that they agree to as part of the third party
authorization procedures. The CFPB requests comment on whether data
aggregator is an appropriate term for describing third parties that may
provide assistance in accessing covered data or whether there are other
terms, such as ``data intermediary,'' that would be more appropriate.
Proposed Sec. 1033.131 would also define the term consumer for
purposes of part 1033. The CFPB is proposing to define the term
consumer to mean a natural person. The definition would further specify
that trusts established for tax or estate planning purposes are
considered natural persons for purposes of the definition of consumer.
The proposed definition of consumer differs from the definition of
consumer in CFPA section 1002(4), which defines one as ``an individual
or an agent, trustee, or representative acting on behalf of an
individual.'' The CFPB is proposing to define the term consumer to be a
natural person to distinguish the term from the third parties that are
authorized to access covered data on behalf of consumers pursuant to
the proposed procedures in subpart D.
6. Qualified Industry Standard (Sec. Sec. 1033.131 and 1033.141)
As discussed in part I.D, fair, open, and inclusive industry
standards are a critical element in the maintenance of an effective and
efficient data access system. To promote the development of such
external standards, the CFPB is generally proposing throughout part
1033 that indicia of compliance with certain provisions include
conformance to an applicable industry standard issued by a fair, open,
and inclusive standard-setting body. Proposed Sec. Sec. 1033.131 and
1033.141 would carry out the objectives of CFPA section 1033 by
encouraging the development of fair, open, and competitive industry
standards that would satisfy certain provisions of the proposed rule.
The CFPB also is proposing Sec. Sec. 1033.131 and 1033.141 pursuant to
its authority under CFPA sections 1022(b)(1) and 1033(d).
Proposed Sec. 1033.131 would define the term qualified industry
standard to mean a standard that is issued by a standard-setting body
that is fair, open, and inclusive. In turn, proposed Sec. 1033.141
provides that a standard-setting body is fair, open, and inclusive and
is an issuer of qualified industry standards when the body has the
following attributes: (1) openness (sources and processes used are open
to all interested parties, including consumer and other public interest
groups, authorized third parties, data providers, and data
aggregators); (2) balance (decision-making power is balanced across all
interested parties, including consumer and other public interest
groups, with no single interest dominating decision-making); (3) due
process (publicly available policies and procedures, adequate notice of
meetings and standards development, and a fair process for resolving
conflicts); (4) an impartial appeals process; (5) consensus (general
agreement, not unanimity, reached through fair and open processes); (6)
transparency (procedures are transparent to participants and publicly
available); and (7) the body has been recognized by the CFPB within the
last three years as an issuer of qualified industry standards.
Under this proposed rule, indicia of compliance with a particular
rule provision would include conformance to a qualified industry
standard. However, an entity does not have to show adherence to a
qualified industry standard to demonstrate compliance with a provision
of the rule, as long as its conduct meets the requirement of the rule
provision. Conversely, adherence to a qualified industry standard would
not guarantee that the entity has complied
[[Page 74808]]
with the rule provision. There are provisions in the proposed rule that
would not mention qualified industry standards at all, generally
because their terms do not leave the same room for compliance to be
informed by adherence to an external standard.
The one instance in which the proposed rule would take account of
external standards in a manner that differs from that described above
is the proposed requirement in Sec. 1033.311(b) that data providers
use standardized formats. There, the CFPB is proposing that if a data
provider's interface makes covered data available in a format that is
set forth in a qualified industry standard, then the interface is
deemed to satisfy the proposed requirement to use a standardized
format. The CFPB is also proposing that a data provider's developer
interface would be deemed to satisfy the proposed format requirement
if, in the absence of an industry standard, it makes covered data
available in a format that is widely used by the developer interfaces
of other similarly situated data providers. For certain other proposed
requirements, indicia of compliance may include conformance to a
qualified industry standard; for this one alone, however, conformance
with such a standard would be deemed to constitute compliance. CFPA
section 1033(d) requires the CFPB by rule to prescribe standards to
promote the development of standardized data formats. Conformance with
a qualified industry standard with respect to standardized formats
would carry out this objective of CFPA section 1033(d).
To promote a competitive data access framework in which standard-
setting bodies do not inappropriately use their position to benefit a
single set of interests, the CFPB has preliminarily determined they
should reflect a full range of relevant interests--consumers and firms,
incumbents and challengers, and large and small actors. The proposed
definition would respond to the recommendation of the SBREFA Panel that
the CFPB consider to what extent existing external standards for data
sharing should inform the proposed rule.\56\ In line with the Panel
recommendation, the CFPB has preliminarily determined that external
standards would reflect the requisite input from the full range of
relevant interests, and therefore would properly serve as indicia of
compliance with various provisions of proposed part 1033, if the
standards were to achieve the status of being a qualified industry
standard as defined. A qualified industry standard, by definition,
would be developed, adopted, and maintained by a fair, open, and
inclusive standard-setting body, and such a body would, per the
proposed attributes listed above, necessarily be a body that reflects
the full range of relevant interests.
---------------------------------------------------------------------------
\56\ SBREFA Panel Report at 44.
---------------------------------------------------------------------------
The proposed rule would be agnostic about what specific technical
format a data provider must use and would not envision that the CFPB
would develop the infrastructure through which data could be processed,
as was suggested by a small entity representative.\57\ While the CFPB
has not ruled out these types of alternatives, the CFPB has
preliminarily determined that they could inappropriately stifle ongoing
evolution of financial industry data-sharing practices.
---------------------------------------------------------------------------
\57\ Id. at 28.
---------------------------------------------------------------------------
The proposed attributes of the qualified industry standard
definition would be consistent with longstanding OMB Circular A-119,
which addresses Federal participation in the development and use of
standards,\58\ and which is well accepted by standard-setting experts
as setting forth ``a limited set of foundational attributes of
standardization activities.'' \59\ Nonetheless, the CFPB acknowledges
that the open banking system comprises arguably a more diverse and
larger set of participants than many other environments to which
industry standards might apply. Accordingly, the CFPB requests comment
on the adequacy of these proposed attributes for ascertaining whether
an open banking standard-setting body is fair, open, and inclusive. In
this regard, the CFPB emphasizes that it intends the proposed
attributes to pertain only to industry standards and standard-setting
bodies; the attributes would not be pertinent with respect to standards
issued by governmental standard-setting bodies such as the National
Institute of Standards and Technology.
---------------------------------------------------------------------------
\58\ OMB Circular A-119 was originally published in 1996; see
https://www.govinfo.gov/content/pkg/FR-1996-12-27/html/96-32917.htm.
The current Circular, effective January 27, 2016, is available at
https://www.whitehouse.gov/wp-content/uploads/2020/07/revised_circular_a-119_as_of_1_22.pdf.
\59\ March 17, 2022 testimony of Dr. James Olthoff, Performing
the Non-Exclusive Functions and Duties of the Under Secretary of
Commerce for Standards and Technology & Director, of the Department
of Commerce's NIST, before the United States House of
Representatives Committee on Science, Space and Technology
Subcommittee on Research and Technology, available at https://www.nist.gov/speech-testimony/setting-standards-strengthening-us-leadership-technical-standards.
---------------------------------------------------------------------------
The CFPB's proposed approach to defining qualified industry
standards aligns with the statutory purposes and objectives for the
CFPB established in section 1021 of the CFPA, which include ensuring
that consumer financial markets, such as the market for data sharing,
are fair, transparent, competitive, and efficient, and ensuring that
Federal consumer financial law is enforced consistently, without regard
to the status of a person as a depository institution. Moreover, the
proposed industry standard definition would align with the language of
CFPA section 1033(e)(3) that rules do not inappropriately ``promote the
use of any particular technology.''
CFPB Recognition of Industry Standard-Setting Bodies
Proposed Sec. 1033.141(b) provides that a standard-setting body
may request that the CFPB recognize it as an issuer of qualified
industry standards. The attributes of fairness, openness, and inclusion
listed as factors in proposed Sec. 1033.141(a)(1) through (6) would
inform the CFPB's consideration of the request. CFPB recognition would
help provide clarity to market participants that a standard-setting
body has the necessary attributes of fairness, openness, and inclusion.
It would also incentivize standard-setting bodies to devote the
resources needed to achieve these attributes by providing them with
validation from the CFPB, which would encourage adoption of their
standards. The CFPB requests comment on the procedures it should use to
recognize standard-setting bodies. For example, the CFPB requests
comment on whether it should recognize a given body before, after, or
at about the same time as the body seeks to issue a qualified industry
standard or whether the recognition procedures should be flexible
enough to accommodate all of those possibilities.
The CFPB intends to subsequently provide guidance on the substance
of the standards issued by the qualified industry standard-setting
bodies recognized by the CFPB. The CFPB requests comment on how to
provide guidance and, in particular, on how to ensure that the
substance is consistent with the provisions of this proposed rule, as
finalized.
B. Subpart B--Obligation To Make Covered Data Available
1. Overview
As discussed in part I.C, disagreements around the types of data
that should be available to consumers and authorized third parties have
limited consumers' ability to use their data and imposed costs on data
providers and third parties. Proposed subpart B would seek to resolve
these questions with respect to how CFPA section 1033(a) applies by
establishing a
[[Page 74809]]
framework for the general categories of data that would need to be made
available, including specific data fields that have been significant
sources of disagreement, and exceptions from these requirements.
Proposed subpart B also restates the general requirement in CFPA
section 1033(a) for data providers to make covered data available in an
electronic form usable by consumers.
2. Obligation To Make Covered Data Available (Sec. 1033.201)
Consistent with the general obligation in section 1033(a) of the
CFPA, proposed Sec. 1033.201(a) would require a data provider to make
available to a consumer and an authorized third party, upon request,
covered data in the data provider's control or possession concerning a
covered consumer financial product or service that the consumer
obtained from the data provider. These covered data would need to be
made available in an electronic form usable by consumers and authorized
third parties. Compliance with the requirements in proposed Sec. Sec.
1033.301 and 1033.311 also would be required.
The CFPB interprets CFPA section 1033(a) to set forth a general
obligation to make available data in an electronic form usable by
consumers and authorized third parties that is independent of other
obligations proposed in subpart C. Even if a data provider fully
complied with the requirements of proposed subpart C with respect to
consumer and developer interfaces, they might attempt to circumvent the
objectives of section 1033 by engaging in other conduct that
effectively makes data unavailable or unusable to consumers and
authorized third parties. The CFPB requests comment on whether it would
be clearer to interpret CFPA section 1033(a) to set forth explicit
prohibitions against (1) actions that a data provider knows or should
know are likely to interfere with a consumer's or authorized third
party's ability to request covered data, and (2) making available
information in a form or manner that a data provider knows or should
know is likely to render the covered data unusable. Such a provision
would carry out the objectives of CFPA section 1033, and would prevent
evasion, pursuant to the CFPB's authority under section 1022(b)(1), by
ensuring data providers do not engage in conduct not specifically
addressed by the proposal but that nonetheless could practically
interfere with the exercise of rights under CFPA section 1033(a). The
CFPB also requests comment on whether there are specific practices that
the proposal should identify that might effectively make data
unavailable or unusable to consumers and authorized third parties,
other than those already identified in proposed subpart C, such as fees
for data access, as discussed with respect to proposed Sec.
1033.301(c), or unreasonable access caps, as discussed with respect to
proposed Sec. 1033.311(c)(2).
The CFPB requests comment on whether other language might be
appropriate to achieve this objective. For example, section 3022(a) of
the Public Health Service Act (PHSA) \60\ and implementing regulations
promulgated by HHS \61\ address the practice of ``information
blocking,'' defined, in part, as a practice that ``is likely to
interfere with, prevent, or materially discourage access, exchange, or
use of'' electronic health information, except as required by law or
specified by HHS rule. The CFPB seeks comment on whether this language
would be appropriate to include as a general prohibition implementing
CFPA section 1033, considering that the market for electronic health
information and the applicable legal framework are distinct from the
context and authorities applicable to this proposal.
---------------------------------------------------------------------------
\60\ 42 U.S.C. 300jj-52.
\61\ 45 CFR 171.103; 85 FR 25642 (May 1, 2020).
---------------------------------------------------------------------------
The CFPB also requests comment on whether, instead of proposing to
restate CFPA section 1033(a) as setting forth an obligation independent
of the specific provisions in proposed subpart C, it should instead
interpret CFPA section 1033(a) to mean that a data provider's
obligations under the statute are fully satisfied if the data provider
complies with all of the requirements of proposed subpart C.
With respect to a data provider's obligation to make available data
in its control or possession, proposed Sec. 1033.201(a) would mean a
data provider would have to make a consumer's data available in any
language maintained in records under its control or possession. For
example, a data provider would have to make Spanish and English
language records available if account records were maintained in
Spanish and English.
The CFPB received questions during the SBREFA process about how
current the covered data must be, including whether data providers
could simply provide the last monthly statement rather than being
required to make available recent transactions and the current account
balance. In the facilitation of payment transactions, data providers
regularly refresh covered data, and such data are often necessary to
enable common beneficial use cases, like transaction-based underwriting
and personal financial management. Both depository and nondepository
data providers typically make available recently updated transaction
and account balance data through online or mobile banking applications.
Proposed Sec. 1033.201(b) would interpret section 1033(a) to require
that, in complying with proposed Sec. 1033.201(a), a data provider
would need to make available the most recently updated covered data
that it has in its control or possession at the time of a request. For
example, a data provider would need to make available information
concerning authorized but not yet settled debit card transactions. When
consumers make a request for information concerning a consumer
financial product or service, the most recently updated information in
a data provider's control or possession is likely to be most usable.
However, proposed Sec. 1033.201(b) is not intended to limit a
consumer's right to access historical covered data. The CFPB requests
comment on whether the provision regarding current data would benefit
from additional examples or other clarifications. The CFPB also
requests input on issues in the market today with data providers making
available only older information that is not fully responsive to a
consumer's request.
3. Covered Data (Sec. 1033.211)
CFPA section 1033(a) generally requires data providers to make
available ``information in the control or possession of the covered
person concerning the consumer financial product or service that the
consumer obtained from such covered person, including information
relating to any transaction, series of transactions, or to the account
including costs, charges and usage data.'' Proposed Sec. 1033.211
would implement this broad language to define the information that a
data provider would need to make available under the general obligation
in proposed Sec. 1033.201(a). Proposed Sec. 1033.211 uses the term
covered data instead of the statutory term ``information'' and defines
covered data to mean several categories of information, as applicable:
transaction information (including historical transaction information),
account balance, information to initiate payment to or from a
Regulation E account, terms and conditions, upcoming bill information,
and basic account verification information.
Several small entity representatives and other stakeholders raised
concerns during the SBREFA process with respect to a proposal the CFPB
was considering to require a broader set of data than
[[Page 74810]]
what would be included in this proposed rule, such as certain payment
routing and demographic information that is not typically shared with
consumers or third parties. Commenters stated that requiring that this
information be made available could introduce new fraud and privacy
risks to consumers that do not exist in the market today, would not
support particularly beneficial use cases, and could impose significant
new burden on data providers as some data are held across multiple
information technology systems. Many data provider commenters supported
an approach to require data that are already available through digital
banking, or otherwise supported the inclusion of periodic statement
information.
The SBREFA Panel recommended that the CFPB further consider whether
the proposed rule should require data providers to make available all
six categories of information set forth in the SBREFA Outline.\62\ In
considering the types of information that data providers would need to
make available, the Panel recommended that the CFPB consider the small
entity representatives' feedback on costs to small data providers with
respect to the following: accessing data stored with multiple vendors
or under the control of other third party service providers;
restrictions on data providers' ability to share information; and
whether sharing certain information could expose data providers and
authorized third parties to legal liability or reputational risk.\63\
---------------------------------------------------------------------------
\62\ SBREFA Panel Report at 43.
\63\ Id.
---------------------------------------------------------------------------
The proposed covered data definition would leverage existing
operational and legal infrastructure: data providers generally make
this covered data available through digital account management and
existing laws require most of the proposed categories of information to
be disclosed through periodic statement and account disclosure
requirements. The CFPB preliminarily concludes that requiring data that
is generally made available to consumers today would support most
beneficial consumer use cases, including transaction-based
underwriting, payment credential verification, comparison shopping,
account switching, and personal financial management. The CFPB
understands that certain of the proposed categories of information,
such as upcoming bill information, historical transaction information,
information to initiate a transfer to or from a Regulation E account,
and basic account identity information can support account switching
because it can ease the account opening process, identify recurring
payments that need to be set up at the new account, and transfer funds
out of the old account. The CFPB requests comment on the benefits and
data needs for consumers who are in the process of switching accounts.
The proposed covered data definition also would address several
issues in the consumer-authorized data sharing system today, including
(1) maximizing consumer benefits by clarifying which types of data
would be included in the consumer's CFPA section 1033 right; (2)
addressing potential data provider anti-competitive conduct and
incentives to withhold particular types of data; and (3) promoting
conditions for standardization in the market. Currently, data providers
have different interpretations of the categories of information that
would be included in the proposed covered data definition and provide
authorized third parties with inconsistent access to that data. Pricing
terms, like APR, have been particularly contested. Inconsistent access
to consumer-authorized data may prevent the development of new use
cases and the improvement of existing use cases. In addition,
inconsistent access to consumer-authorized data may be hindering
standardization in the market, and therefore further hindering
competition and innovation, as parties to data access agreements must
negotiate individual categories of information that can be shared.
To address concerns about data providers restricting access to
specific pieces of information, the proposed rule also would give
examples of information that would fall within the covered data
categories. These examples are illustrative and are not an exhaustive
list of data that a data provider would be required to make available
under the proposed rule. A data provider would only have an obligation
to make available applicable covered data; for example, a Regulation E
financial institution providing only a Regulation E account would not
need to make available a credit card APR or billing statement. The CFPB
requests comment on whether additional data fields should be specified
to minimize disputes about whether the information would fall within
the proposed covered data definition. In addition, the proposed rule
would allow flexibility as industry standards develop while minimizing
ambiguity over the types of information that must be made available.
The CFPB also requests comment on whether the proposed categories of
information provide sufficient flexibility to market participants to
develop qualified industry standards.
These provisions would carry out the objectives of CFPA section
1033 of ensuring data are usable by consumers and authorized third
parties by focusing on data that stakeholders report are valuable for
third party use cases and that are generally under the control or
possession of all covered persons. These provisions also would promote
the use and development of standardized formats for carrying out the
objectives of CFPA section 1033(d) by encouraging industry to focus
format standardization efforts around these data categories.
Transaction Information
Transaction information under proposed Sec. 1033.211(a) refers to
information about individual transactions, such as the payment amount,
date, payment type, pending or authorized status, payee or merchant
name, rewards credits, and fees or finance charges. Some bank data
providers have provided feedback suggesting that a rule not cover
pending transactions. These stakeholders have cited concerns about how
the information is subject to change and is not provided on monthly
account statements. Some bank data providers have stated that pending
transaction information is already provided through online or mobile
banking applications today, or otherwise supported including that
information. The CFPB preliminarily concludes that pending transaction
information supports a variety of beneficial use cases, including fraud
detection and personal financial management, and therefore should be
included within the proposed covered data definition.
Transaction information also would include historical transaction
information in the control or possession of the data provider. Proposed
Sec. 1033.211(a) explains that a data provider would be deemed to make
available sufficient historical transaction information if it makes
available at least 24 months of such information. The CFPB is aware
that historical transaction data supports a variety of use cases,
including transaction-based underwriting, account switching, and
personal financial management. However, data providers do not make a
consistent amount of historical transaction information available, so a
consumer's ability to access historical data depends on their provider.
For example, some nondepository data providers appear to make over five
years of historical transaction data available, while some bank data
providers limit historical
[[Page 74811]]
transaction data to 3, 6, 12, 24, or 30 months.
Many stakeholders, including third party small entity
representatives during the SBREFA process, have provided feedback that
24 months of historical transaction data would support the vast
majority of consumer use cases. Some data provider and consumer
advocate stakeholders have explained that 24 months would be consistent
with the recordkeeping requirements in Regulation E and Regulation Z.
The CFPB preliminarily concludes that setting a safe harbor at a
minimum of 24 months would ensure that consumers have access to
sufficient historical transaction data for common beneficial use cases,
while providing compliance certainty to data providers. This amount
would also be consistent with the existing recordkeeping timeframes in
Regulation E, 12 CFR 1005.13, and Regulation Z, 12 CFR 1026.25. The
CFPB also understands that data providers typically control or possess
more than 24 months of historical transaction data and may continue to
make more than 24 months available. In the SBREFA Outline, the CFPB
considered a data parity approach to historical transaction data, where
a data provider would only need to share as much historical transaction
data as it makes available through a consumer interface.\64\ However,
the CFPB is concerned that, in practice, a data parity approach would
be difficult to enforce and would leave some consumers without
sufficient historical transaction data to support transaction-based
underwriting, account switching, and other use cases.
---------------------------------------------------------------------------
\64\ SBREFA Outline at 27.
---------------------------------------------------------------------------
The CFPB requests comment on whether the transaction information
examples are sufficiently detailed and consistent with market
practices. The CFPB also requests comment on whether to retain the safe
harbor for historical transaction data and whether a different amount
of historical transaction data would be more appropriate. The CFPB also
requests comment on whether and how the rule should require that data
providers make available historical data for other categories of
information, such as account terms and conditions, whether such
historical data are kept in the ordinary course of business today, and
the use cases for such data.
Account Balance
The account balance category would include available funds in an
asset account and any credit card balance. The CFPB requests comment on
whether this term is sufficiently defined or whether additional
examples of account balance, such as the remaining credit available on
a credit card, are necessary.
Information To Initiate Payment To or From a Regulation E Account
This category of information would require a data provider to make
available information to initiate a payment to or from the consumer's
Regulation E account. The proposed rule explains that this category
includes a tokenized account and routing number that can be used to
initiate an ACH transaction. In complying with its obligation under
proposed Sec. 1033.201(a), a data provider would be permitted to make
available a tokenized account and routing number instead of, or in
addition to, a non-tokenized account and routing number.
Regulation E account numbers are typically shared through consumer
interfaces and are required to be disclosed under existing Regulation E
periodic statement provisions. Account numbers and routing numbers can
be used to initiate a transfer of funds to or from a Regulation E
account over the ACH network, enabling common use cases like initiating
payments and depositing loan proceeds. Although data providers have
recourse under private contracts, network rules, and commercial law to
recover funds stolen by an unauthorized entity, many data providers
have expressed concern about their Regulation E obligations and urged
the CFPB to allow the sharing of TANs with authorized third parties.
These TANs, which are in use today, may help mitigate fraud risks to
consumers and data providers. TANs allow data providers to identify
compromised points more easily and revoke payment credentials on a
targeted basis (rather than issuing a new account number to the
consumer). However, some third parties have argued that TANs do not
support certain use cases, such as allowing third parties to print
checks to pay vendors, initiating payments by check or wire, and
detecting fraud.
The CFPB preliminarily concludes that TANs allow third parties to
enable most beneficial payment use cases while mitigating fraud risks,
and therefore data providers should have the option of making TANs
available to authorized third parties in lieu of full account and
routing numbers. The CFPB notes that a TAN would only meet this
requirement if it contained sufficient information to initiate payment
to or from a Regulation E account. The CFPB requests comment on whether
to allow TANs in lieu of non-tokenized account and routing numbers,
including whether TANs would mitigate fraud risks and, in contrast,
whether TANs have any limitations that could interfere with beneficial
consumer use cases, and whether and how adoption and use of TANs might
be informed by qualified industry standards. The CFPB also requests
comment on whether data providers should also be required to make
available information to initiate payments from a Regulation Z credit
card.
Terms and Conditions
Terms and conditions generally refer to the contractual terms under
which a data provider provides a covered consumer financial product or
service. The proposed rule would describe several non-exhaustive
examples of information that would constitute terms and conditions.
Certain terms and conditions, such as pricing, reward programs
terms, and whether an arbitration agreement applies to the product,
support beneficial use cases, like comparison shopping and personal
financial management. Authorized third parties could use this
information to help consumers more easily understand and compare the
terms applicable to a covered consumer financial product or service.
Since pricing is a fundamental term that is provided in account opening
disclosures and change in terms disclosures, the CFPB is proposing to
include APR, annualized percentage yield, fees, and other pricing
information in this category. In addition, this provision would benefit
consumers because consumers today may not be able to easily find this
information through their online or mobile banking applications, and
some data providers may not be consistently sharing it with authorized
third parties. The CFPB requests comment on whether the final rule
should include more examples of information that must be made available
under terms and conditions.
Upcoming Bill Information
Upcoming bill information would include bills facilitated through
the data provider, such as payments scheduled through the data provider
and payments due from the consumer to the data provider. For example,
it would include the minimum amount due on the data provider's credit
card billing statement, or a utility payment scheduled through a
depository institution's online bill payment service. The CFPB
preliminarily concludes that this information would be necessary to
support personal financial management
[[Page 74812]]
and consumers who are switching accounts. The CFPB seeks comment on
whether this category is sufficiently detailed to support situations
where a consumer is trying to switch recurring bill payments to a new
asset account, such as transferring a monthly credit card payment to a
new bank.
Basic Account Verification Information
Basic account verification information would be limited to the
name, address, email address, and phone number associated with the
covered consumer financial product or service.
The CFPB is aware that certain pieces of identifying consumer
information are commonly shared with third parties today for beneficial
use cases. For example, a lender may seek to verify that loan funds are
being deposited into an account that belongs to the consumer who is
applying for the loan, or a mortgage underwriter may seek to verify
that funds in a savings account belong to the mortgage applicant. On
the other hand, third parties have raised concerns that data providers
sometimes limit access to this information, and requested that the CFPB
should clarify that account verification information must be shared.
However, many small entity representatives and other stakeholders
raised significant concerns about the proposed rule covering other
identity information that is not typically shared today, such as
demographic data, as the beneficial use cases for such information is
limited compared to the significant privacy and discrimination risks.
The CFPB preliminarily concludes that requiring data providers to
share basic account verification information is necessary to ensure the
usability of the covered data. For example, confirming that funds in a
savings account do, in fact, belong to the consumer applying for a
mortgage loan is necessary to determine whether the mortgage
underwriting can rely on that information. Similarly, a loan provider
is mitigating fraud risks when it ensures that the name, address, email
address, and phone number on a recipient account matches the
information of the loan applicant; matching information helps ensure
that the funds are going to the correct account, and that the account
opening notifications are not going to someone who stole the consumer's
identity. Email addresses and phone numbers are increasingly being used
as substitutes for consumer and account identifiers, particularly in
the payments market where such information can be used to send a
person-to-person payment. Accordingly, the CFPB has preliminarily
determined that limiting basic account verification information to the
name, address, email address, and phone number associated with the
covered consumer financial product or service would facilitate the most
common use cases and is consistent with market practices today.
The CFPB considered whether to include SSNs, as SSNs are shared for
some beneficial consumer use cases, like mortgage underwriting.
However, the sharing of SSNs is not ubiquitous. The CFPB preliminarily
concludes that SSNs may continue to be shared as appropriate but, given
the risks to consumers, the proposed rule would not require data
providers to make them available.
The CFPB requests comment on whether the proposed basic account
verification information category would accommodate or unduly interfere
with beneficial consumer use cases today. Given privacy and security
concerns about unintentionally covering other kinds of information that
are not typically shared today, the CFPB also requests comment on
whether it is appropriate to limit this category to only a few specific
pieces of information.
4. Exceptions (Sec. 1033.221)
The CFPB is proposing in Sec. 1033.221 four exceptions to the
requirement to make data available under the proposed rule, along with
some clarifications of data that do not fall within these exceptions.
These proposed exceptions would implement section 1033(b) of the CFPA
by restating the statutory language and providing certain
interpretations.
The first exception would cover any confidential commercial
information, including an algorithm used to derive credit scores or
other risk scores or predictors. The CFPB is aware that some data
providers have argued that certain account information falls within
this exception because such information is an input or output to a
proprietary model. The CFPB is proposing to clarify that information
would not qualify for this exception merely because it is an input to,
or an output of, an algorithm, risk score, or predictor. For example,
APR and other pricing information are sometimes determined by an
internal algorithm or predictor, but such information would not fall
within this exception.
The second exception would cover any information collected by a
data provider for the purpose of preventing fraud or money laundering,
or detecting, or making any report regarding other unlawful or
potentially unlawful conduct. The CFPB received feedback during the
SBREFA process that at least one data provider cited this exception to
avoid including general account information, such as the name on the
account.\65\ To avoid misuse of this exception where information has
multiple applications, the CFPB is proposing to clarify that
information collected for other purposes does not fall within this
exception. For example, name and other basic account verification
information would not fall within this exception.
---------------------------------------------------------------------------
\65\ SBREFA Panel Report at 25.
---------------------------------------------------------------------------
The third exception would cover information required to be kept
confidential by any other provision of law. Information would not
qualify for this exception merely because a data provider must protect
it for the benefit of the consumer. For example, a data provider cannot
restrict access to the consumer's own information merely because that
information is subject to privacy protections.
The fourth exception would cover any information that a data
provider cannot retrieve in the ordinary course of its business with
respect to that information.
The proposed definition for covered data in proposed Sec. 1033.211
would include information that is made available to consumers and
authorized third parties today or is required to be disclosed under
other existing laws. The exceptions proposed in Sec. 1033.221 are
narrow, and covered data would not typically qualify for any of these
exceptions; note that proposed Sec. 1033.351(b)(1) would require a
data provider to create a record of what covered data are not made
available pursuant to an exception in proposed Sec. 1033.221 and
explain why the exception applies.
During the SBREFA process, small entity representatives and other
stakeholders provided examples of data that could fall within the
exceptions, such as proprietary algorithms or underwriting models, but
the examples would not be considered covered data and accordingly would
not fall within the scope of the proposed rule. The SBREFA Panel
recommended that the CFPB continue to seek feedback on how to interpret
these exceptions, and further consider whether there are specific
pieces of information that should be covered under any of these
exceptions.\66\ Consistent with the Panel recommendation, the CFPB
requests comment on whether it should include additional examples of
data that would or would not fall within the exceptions, and whether
this provision sufficiently mitigates concerns that data providers may
cite these exceptions on a
[[Page 74813]]
pretextual basis. The CFPB intends to monitor the market for pretextual
use of the CFPA section 1033 exceptions.
---------------------------------------------------------------------------
\66\ Id. at 43.
---------------------------------------------------------------------------
C. Subpart C--Establishing and Maintaining Access
1. Overview
The provisions in proposed subpart C would address some of the
significant questions and challenges described in part I.C by
clarifying the terms on which data are made available and the mechanics
of data access, including basic operational, performance and security
standards, and other policies and procedures. In particular, certain
provisions would ensure that data providers make covered data available
to third parties through a developer interface rather than through the
screen scraping of a consumer interface. Other provisions would include
procedures to facilitate the ability of third parties to request data
and ensure data providers are accountable for their obligations in
proposed subpart C. In addition, to prevent data providers from
inhibiting consumers' exercise of this statutory right, the CFPB is
proposing a bright-line prohibition against data providers charging
fees for establishing and maintaining the required interfaces or for
receiving requests and making available covered data in response to
requests. Together, the provisions in proposed subpart C would
contribute to a safe, reliable, secure, and competitive data access
framework.
2. General Requirements (Sec. 1033.301)
Requirement To Establish and Maintain Interfaces (Sec. 1033.301(a))
The CFPB proposes in Sec. 1033.301(a) to require a data provider
subject to the requirements of proposed part 1033 to maintain a
consumer interface and to establish and maintain a developer interface.
A data provider's consumer interface and developer interface would be
required to satisfy the requirements in proposed Sec. 1033.301(b) and
(c). The developer interface would be subject to additional
requirements in proposed Sec. 1033.311. Proposed Sec. 1033.301(a)
would carry out the objectives of CFPA section 1033 by ensuring
consumers and authorized third parties can make requests and receive
timely and reliable access to covered data in a usable electronic form,
and would fulfill other objectives discussed below with respect to
proposed Sec. Sec. 1033.301 and 1033.311, including promoting the
development and use of standardized formats.
The terms consumer interface and developer interface are defined in
proposed Sec. 1033.131 as interfaces through which a data provider
receives requests for covered data and makes covered data available in
an electronic form usable by consumers and authorized third parties in
response to the requests. Proposed Sec. 1033.111(d) would exclude data
providers that do not have a consumer interface from the requirements
of proposed part 1033. Thus, proposed Sec. 1033.301(a) would not
require a data provider to establish a consumer interface, but only to
maintain a consumer interface that the data provider already has.
The CFPB is not aware of significant concerns regarding the ability
of consumers to access covered data from consumer interfaces. The CFPB
intends for the provisions in the proposed rule applicable to consumer
interfaces generally to ensure the continuation of current data
provider practices. Based on its market expertise, the CFPB expects
that data providers' existing consumer interfaces will generally
satisfy the data provider's obligation under proposed Sec. 1033.301(a)
to maintain an interface for making covered data available to
consumers. The CFPB requests comment on the extent, if any, to which
the provisions applicable to consumer interfaces in proposed subpart C
would be inconsistent with current practices.
A consumer interface generally would not satisfy a data provider's
obligation under proposed Sec. 1033.301(a) to establish and maintain a
developer interface, which must satisfy requirements in proposed Sec.
1033.311. These provisions in proposed Sec. 1033.311 are intended, in
part, to ensure that data providers do not rely on the screen scraping
of a consumer interface to satisfy their obligations under CFPA section
1033(a). As recommended by the SBREFA Panel, the CFPB considered
whether screen scraping should be an alternative means of sharing data
with third parties in some circumstances.\67\ The CFPB is not proposing
to require that data providers permit screen scraping as an alternative
method of access, such as to address unavailability when the data
provider's system interface is down for maintenance. As discussed in
part I.C, screen scraping as a whole presents risks to consumers and
the market and relying on credential-based screen scraping would
complicate the mechanics of data access, particularly with respect to
authentication and authorization procedures for data providers. The
proposed requirements in subpart C, such as the performance
specifications for developer interfaces in Sec. 1033.311(c), would
ensure that consumers and authorized third parties have reliable access
to consumers' covered data.
---------------------------------------------------------------------------
\67\ Id. at 44.
---------------------------------------------------------------------------
As also recommended by the SBREFA Panel, the CFPB considered
whether there are forms of screen scraping that would reduce the impact
of developer interface service interruptions on third parties and
minimize costs to data providers and third parties while ensuring data
quality and security.\68\ The CFPB has not identified any such forms of
screen scraping. Tokenized screen scraping, in which third parties use
a tokenized version of a consumer's account credentials, provides data
security and consumer control benefits when compared with screen
scraping that uses a consumer's account credentials. However, it does
not mitigate screen scraping's inherent overcollection, accuracy, and
consumer privacy risks, and it would impose costs on data providers in
addition to the costs of a developer interface. Additionally, because
it would inherently rely on the delivery of unstructured data,
permitting data providers to comply with the proposed rule through
tokenized screen scraping would not meaningfully advance the statutory
mandate to promote the development and use of standardized formats.
---------------------------------------------------------------------------
\68\ Id.
---------------------------------------------------------------------------
In some cases, authorized third parties that are natural persons
might have a need to access information in a human-readable form
because they lack the means of accessing a developer interface. The
CFPB requests comment on how a data provider would make covered data
available in a usable electronic form to such authorized third parties.
The SBREFA Panel recommended that the CFPB clarify whether the
online financial account management portal that the CFPB was
considering with respect to direct access--i.e., a consumer interface--
would include a data provider's mobile banking portal in addition to
its online banking portal.\69\ While both online banking and mobile
banking applications could serve as consumer interfaces, proposed Sec.
1033.301(a) would not require that each of the applications satisfy all
of the proposed requirements that would apply to consumer interfaces,
as long as collectively the two applications satisfy the requirements.
The CFPB requests comment on the extent to which data providers
currently inform consumers using mobile banking applications that
additional information about consumers' accounts may be available
[[Page 74814]]
through the providers' online banking interfaces.
---------------------------------------------------------------------------
\69\ Id. at 43.
---------------------------------------------------------------------------
Machine-Readable Files (Sec. 1033.301(b))
The CFPB proposes in Sec. 1033.301(b) to require a data provider
upon specific request to make covered data available in a machine-
readable file that a consumer or authorized third party can retain and
transfer into a separate information system. This proposed requirement
would apply both to data providers' consumer interfaces and to their
developer interfaces. This proposed provision would implement the
requirement of CFPA section 1033(a) that covered data be made available
in a usable electronic form by ensuring that consumers and authorized
third parties can retain electronic files. In addition, the proposed
provision would directly implement CFPA section 1033(d).
The proposed provision would allow a data provider to offer
additional consumer interfaces that do not satisfy Sec. 1033.301(b)
(for example, a smartphone application that does not provide
information in a readily printable or downloadable format), as long as
the data provider makes covered data available upon request in readily
printable or downloadable formats through one of its other consumer
interfaces, such as its digital banking interface.
The CFPB preliminarily understands that, as a general matter,
existing consumer and developer interfaces typically already provide
covered data in a form that would comply with this requirement and may
be subject to similar requirements by other applicable laws.\70\
---------------------------------------------------------------------------
\70\ See, e.g., Cal. Civ. Code sections 1798.100, 1798.130; Va.
Consumer Data Prot. Act section 59.1-577 (2023); Colo. Priv. Act
section 6-1-1306(1)(e); MRS tit. 10, ch. 1057, section 9607(1)(D);
Mass. Info. Priv. & Sec. Act section 10. However, California exempts
information subject to the GLBA, and Colorado and Virginia exempt
financial institutions subject to the GLBA. Separately, the EU's
GDPR requires data portability (Reg. (EU) 2016/679, art. 20, O.J. (L
119) 1 (Apr. 27, 2016)).
---------------------------------------------------------------------------
The CFPB therefore has preliminarily determined that the proposed
requirement in Sec. 1033.301(b) would impose little or no cost on data
providers beyond the cost to establish and maintain a developer
interface in the first place; i.e., the proposed requirement would
impose little or no cost beyond the cost that would be imposed by
proposed Sec. 1033.301(a) (discussed above). The CFPB has also
preliminarily determined that proposed Sec. 1033.301(b) would provide
important consumer benefits, such as by enabling them to share their
data with others, including providers of competing financial products
and services.\71\
---------------------------------------------------------------------------
\71\ See, e.g., Michael S. Barr et al., Consumer Autonomy and
Pathways to Portability in Banking and Financial Services, Univ. of
Mich. Ctr. on Fin., L. & Policy Working Paper No. 1 (Nov. 1, 2019),
https://financelawpolicy.umich.edu/sites/cflp/files/2021-07/umich-cflp-working-paper-consumer-autonomy-and-data-portability-pathways-Nov-3.pdf.
---------------------------------------------------------------------------
Fees Prohibited (Sec. 1033.301(c))
The CFPB proposes in Sec. 1033.301(c) to prohibit a data provider
from imposing any fees or charges for establishing or maintaining the
interfaces required by proposed Sec. 1033.301(a) or for receiving
requests or making available covered data through the interfaces. This
provision is proposed pursuant to the CFPB's authority under CFPA
sections 1033(a) and 1022(b)(1). The CFPB has preliminarily determined
that the prohibition would be necessary and appropriate to effectuate
consumers' rights under CFPA section 1033 by ensuring that consumers
and authorized third parties are not impeded from exercising consumers'
statutory rights because of fees, which would be contrary to the
objectives of the statute.
The CFPB notes that proposed Sec. 1033.301(c) would not prohibit a
data provider from charging a fee for specific services, other than
access to covered data, through the consumer interface. For example, a
data provider would not violate the proposed rule if the data provider
were to impose a fee for sending an international remittance transfer,
which a consumer authorizes and consents to through the consumer
interface. Further, the proposed rule would not address account
maintenance fees that a data provider might charge to consumers
regardless of whether they use the interface.
A data provider that does not already have a developer interface
would incur some upfront and ongoing costs to establish and maintain
one, and data providers in general will incur some cost to maintain the
interfaces as well as a marginal cost of providing covered data through
the interfaces. The CFPB has therefore considered whether its proposed
rule should permit a reasonable, cost-based fee to recover the upfront
or fixed costs associated with establishing and maintaining the
interfaces. There also may be some costs associated with providing
covered data through the interfaces. The CFPB has preliminarily
determined, however, that the marginal cost of providing covered data
in response to a request is negligible.
Each data provider is the sole supplier of its customers' financial
data and therefore able to exert market power over the prices or fees
it charges for authorized access to consumers' data. Data providers
have in the past restricted data access for third parties. These
restrictions have anti-competitive effects and, by allowing data
providers to charge prices for access that are in excess of marginal
cost, may harm consumers and third parties. For example, data providers
may have an incentive to charge fees in excess of their marginal cost
to third parties to make certain competing third party products or
services less profitable or less attractive to consumers. In addition,
data providers charging different prices to different third parties may
also result in competitive harm to consumers and third parties,
especially in a market where some data providers have financial
interests in third parties they are affiliated with, or act as third
parties themselves. Even under circumstances where data providers would
not directly gain, price discrimination of this type may distort
competition among third parties and harm consumers. Further, prolonged
negotiations about fees could delay or obstruct third parties being
granted access expeditiously to data providers' developer interfaces,
in turn undermining the core consumer data access right. The CFPB
requests comment on the above analysis with respect to proposed Sec.
1033.301(c). The CFPB also requests comment on whether any clear and
unambiguous set of conditions, limitations, or other parameters exist
or should be created such that, subject to such parameters, data
providers could charge reasonable, standardized fees that neither
obstruct the access right due to cost nor impede third parties' access
to data provider interfaces due to negotiations over fee amounts or
schedules.
During the SBREFA process, data provider small entity
representatives provided feedback that data providers should be
permitted to charge fees to third parties for access to covered
data.\72\ Further, the SBREFA Panel recommended that the CFPB consider
how data providers would need to defray the costs associated with
developing and maintaining a developer interface.\73\ The CFPB will
continue to consider this recommendation as it reviews comments on this
NPRM and proceeds to develop a final rule. In this regard, the CFPB
notes that the proposed rule differs in many respects from the CFPB's
proposals under
[[Page 74815]]
consideration at the time the SBREFA Panel provided the above
recommendation. Most importantly, the CFPB is now proposing to require
data providers to make available a narrower set of covered data than
the CFPB was considering at the SBREFA stage. Small data providers
generally already make the proposed covered data available through
their consumer interfaces. Accordingly, the CFPB expects that it will
be relatively low cost for smaller data providers to make covered data
available through developer interfaces.
---------------------------------------------------------------------------
\72\ SBREFA Panel Report at 30.
\73\ Id. at 44.
---------------------------------------------------------------------------
3. Requirements Applicable To Developer Interfaces (Sec. 1033.311)
As discussed in part I.C, data providers' developer interfaces do
not function according to a consistent set of terms, resulting in data
that may not be readily usable. In addition, credential-based screen
scraping presents security, privacy, and other risks. To foster a safe,
reliable, secure, and competitive data access framework, the CFPB is
proposing in Sec. 1033.311 additional requirements that would apply
specifically to the developer interface described in proposed Sec.
1033.301(a). Proposed Sec. 1033.311(a) would provide that a developer
interface required by Sec. 1033.301(a) must satisfy proposed
provisions at Sec. 1033.311(b) through (d). These provisions would
interpret data providers' obligation to ``make available'' covered data
in a ``usable'' electronic form, fulfill the mandate in CFPA section
1033(d) to prescribe by rule standards to promote the use and
development of standardized formats, and otherwise carry out the
objectives of CFPA section 1033.
Format of Covered Data (Sec. 1033.311(b))
The CFPB proposes in Sec. 1033.311(b) to require a developer
interface to make available covered data in a standardized format. This
requirement would implement the mandate in CFPA section 1033(d) that
the CFPB prescribe standards to promote the use and development of
standardized formats. The interface would be deemed to satisfy this
requirement if it makes covered data available in a format set forth in
a qualified industry standard (as defined in proposed Sec. 1033.131).
In the absence of such a standard, a data provider's interface would be
deemed to satisfy proposed Sec. 1033.311(b) if it makes available
covered data in a format that is widely used by the developer
interfaces of other similarly situated data providers with respect to
similar data and is readily usable by authorized third parties.
This proposed provision would be intended to ensure that developer
interfaces make covered data available in a standardized format that is
readily processable by the information systems of third parties across
the market, including new entrants and small entities. This proposed
provision also is intended to transition the market from relying on
screen scraping unstructured data from consumer interfaces.
Consistent with the objectives discussed in part I.D, this
provision would seek to foster a reliable and competitive data access
framework. Small entity representatives during the SBREFA process
indicated that consistent standards would reduce costs for small third
parties and small data providers, and would promote competition by
reducing integration costs across the market.\74\ The SBREFA Panel
recommended that the CFPB promote consistency in standards for the
availability of information, including the format and transmission of
information that data providers make available to third parties.\75\
Consistent with that feedback, this provision would seek to ensure that
the information systems of, in particular, new-entrant and small-entity
third parties can process covered data from the full range of data
providers across the market by reducing the extent of varied and
idiosyncratic formats that impel reliance on intermediaries to provide
data in a usable format.
---------------------------------------------------------------------------
\74\ Id. at 28.
\75\ Id. at 44.
---------------------------------------------------------------------------
The CFPB has not determined whether qualified industry standards
for data formats presently exist. The proposed rule would seek to
accommodate the potential absence of such standards by stating that, in
their absence, a data provider could rely on proposed Sec.
1033.311(b)(2) if its developer interface uses a format used by other
similarly situated data providers. The CFPB has preliminarily
determined that, consistent with CFPA section 1033(a) and (d),
requiring covered data to be made available in a usable and
standardized format would reduce variation across the market and
promote greater consistency of data formats.
Because proposed Sec. 1033.311(b)(2) would allow data providers
across the market to rely on more than one formatting standard, the
CFPB acknowledges it would not promote the use and development of a
single formatting standard, such as what might be set forth within a
qualified industry standard described under proposed Sec.
1033.311(b)(1). The CFPB requests comment on the extent of variation in
data formats used for consumer-authorized access today, and the
usability of those formats by third parties. The CFPB also requests
comment on whether the implementation timelines discussed in part
IV.A.4 with respect to proposed Sec. 1033.121 should be adjusted to
enable data providers to rely on a standardized format that is set
forth in a qualified industry standard as of the applicable compliance
date. For example, the CFPB requests comment on whether it should allow
for a separate, later compliance date for Sec. 1033.311(b).
Proposed Sec. 1033.311(b)(2) would apply only in the absence of a
qualified industry standard. The CFPB requests comment on whether
proposed Sec. 1033.311(b)(2) should also be available if there is a
qualified industry standard. Alternatively, the CFPB requests comment
on whether it should omit proposed Sec. 1033.311(b)(2), meaning that
in the absence of a qualified standard only the general requirement
under proposed Sec. 1033.311(b) to make available covered data in a
standardized format would apply. The CFPB further requests comment on
whether there are other approaches that it should deem to comply with
Sec. 1033.311(b), instead of or in addition to proposed Sec.
1033.311(b)(1) or (2). Separately, CFPA section 1033(d) does not define
the term ``format'' and proposed Sec. 1033.311(b) would not include a
definition. The CFPB requests comment on whether a definition is needed
and whether format should be defined to mean the specifications for
data fields, status codes, communication protocols, or other elements
to ensure third party systems can communicate with the developer
interface.
Commercially Reasonable Performance for Data Providers' Developer
Interfaces (Sec. 1033.311(c)(1))
The CFPB proposes in Sec. 1033.311(c)(1) to require that a data
provider's developer interface perform at a commercially reasonable
level, and to include provisions regarding what commercially reasonable
means. This provision would carry out the objectives of CFPA section
1033 by clarifying how a data provider would make available covered
data in a usable form to authorized third parties under CFPA section
1033(a).
Information available to the CFPB indicates that the performance of
data providers' developer interfaces is neither uniform nor always on
par with what one would reasonably expect given the state of
technology. Specifically, the state of technology enables consumer
interfaces to operate at consistently high availability, performance,
and data freshness levels,
[[Page 74816]]
which many data providers' developer interfaces do not meet. With
respect to uniformity, data from the Provider Collection indicated that
providers report widely varying uptime and response time or latency
measurements. This non-uniformity persists both across similarly
situated providers and across the various consumer or developer
interfaces a data provider may make available. The CFPB has
preliminarily determined that the performance of data providers'
developer interfaces needs both to improve and to become more
consistent and predictable from where that performance is today. In
that regard, the CFPB has preliminarily determined that a quantitative
minimum performance level would achieve a sufficient level of
consistency and predictability.
The CFPB proposes the requirements for commercially reasonable
performance of data providers' developer interfaces in proposed Sec.
1033.311(c)(1) pursuant to its authority provided by CFPA section
1033(a) and the CFPB's interpretation of how data providers must make
available covered data in an electronic form that is usable by
consumers and authorized third parties. Specifically, the CFPB proposes
the requirements for commercially reasonable performance in proposed
Sec. 1033.311(c)(1) to implement the statutory requirement that
covered data be made available in an electronic form usable by
authorized third parties. This proposed requirement would carry out the
objectives of CFPA section 1033 by ensuring that data providers make
available data on a basis that enables third parties to provide
products and services, including those that compete with products and
services offered by the data provider.
Quantitative Minimum Performance Specification (Sec.
1033.311(c)(1)(i))
The current performance of data providers' developer interfaces is
not always adequate, and whether a developer interface's performance is
commercially reasonable cannot only be based on the performance of a
data provider's peers. Thus, the CFPB has preliminarily determined that
it is necessary to propose a firm quantitative floor to ensure that the
performance improves in the near term.
The quantitative minimum performance specification in proposed
Sec. 1033.331(c)(1)(i) would be a response rate of at least 99.5
percent. That is, the CFPB proposes that the performance of a developer
interface cannot be commercially reasonable unless the interface has a
response rate (defined below) of at least 99.5 percent. The CFPB has
preliminarily determined that this level of response rate would be an
appropriate floor for commercially reasonable performance for several
reasons. The CFPB understands from the Provider Collection that a
number of data providers' extant consumer interfaces generally meet or
exceed this level of performance. Further, the level of performance
data providers can achieve with their consumer interfaces, in which the
amount and variety of data are generally broader than the set of data
the CFPB proposes to define as covered data, suggests this level of
performance should be achievable for developer interfaces. In general,
ensuring parity between consumer interfaces and developer interfaces
will ensure that data providers make available data in a manner that is
usable to consumers. In addition, Australia and the United Kingdom set
their thresholds at 99.5 percent.\76\ Their thresholds are calibrated
from existing endpoints of data providers in both countries and suggest
that data providers generally are able to meet a 99.5 percent
threshold.\77\ Moreover, the substantial preponderance of the
respondents to the Provider Collection meet or exceed that level of
performance. Thus, the CFPB has preliminarily determined that data
provider interfaces cannot perform to commercially reasonable standards
below a quantitative minimum performance specification of 99.5 percent.
The CFPB requests comment specifically on what role qualified industry
standards should have, if any, regarding the quantitative minimum
performance specification set forth in the final rule.
---------------------------------------------------------------------------
\76\ Australia Consumer Data Standards, Availability
Requirements, https://consumerdatastandardsaustralia.github.io/standards/#availability-requirements (last visited Sept. 16, 2023);
Open Banking Ltd., Operational Guidelines--Availability, https://standards.openbanking.org.uk/operational-guidelines/availability-and-performance/key-indicators-for-availability-and-performance-availability/latest/ (last visited Sept. 16, 2023).
\77\ In the period from July 2022 to July 2023, UK account
providers had an average weighted Open Banking API availability of
99.66 percent. See Open Banking Ltd., API Performance Stats, https://www.openbanking.org.uk/api-performance/ (last visited Sept. 16,
2023). From December 1, 2021, through September 1, 2023, Australian
data holders maintained a platform availability of 96.28 percent.
See Australian Consumer Data Right, Performance, https://www.cdr.gov.au/performance (last visited Sept. 16, 2023).
---------------------------------------------------------------------------
Defining Proper Response Rate
The CFPB proposes to specify in Sec. 1033.311(c)(1)(i) how the
proper response rate would be calculated within a given time period,
such as a month: that rate would be the number of proper responses by
the interface divided by the total number of queries to the interface.
A proper response would be a response, other than an error message
during unscheduled downtime, that meets the following three criteria:
(1) the response either fulfills the query or explains why the query
was not fulfilled; (2) the response complies with the requirements of
proposed part 1033; and (3) the response is provided by the interface
within a commercially reasonable amount of time. With respect to the
third criterion, the CFPB proposes that the amount of time cannot be
commercially reasonable if it is more than 3,500 milliseconds. It is
possible under the CFPB's proposed rule that the amount of time for the
response would not be commercially reasonable even if it were less than
3,500 milliseconds. The CFPB requests comment on whether any generally
applicable industry standard sets forth an amount of time that should
be used in lieu of 3,500 milliseconds.
The CFPB proposes that any responses by and queries to the
interface during scheduled downtime for the interface would be excluded
from the calculation of the proper response rate. Further, the CFPB
proposes that any downtime of the interface would qualify as scheduled
downtime only if the data provider has provided reasonable notice of
the downtime to all third parties to which the data provider has
granted access to the interface. The CFPB also proposes that the total
amount of scheduled downtime for the interface must be reasonable.
Adherence to a qualified industry standard would be an indication that
the notice of downtime and the total amount of downtime are reasonable.
The CFPB requests comment on whether it should provide additional
detail on the amount of scheduled downtime that would constitute a
reasonable amount. The CFPB also requests comment on whether it should
provide additional detail on when and how a data provider must provide
notice of scheduled downtime to third parties for the notice to be
reasonable. For example, the Australia Consumer Data Standards state
that normal planned outages should be reported to third parties with at
least one week of lead time, and the UK Open Banking Standards provide
that notice for planned downtime should be given at least five business
days in advance.\78\
---------------------------------------------------------------------------
\78\ See Consumer Data Standards, Availability Requirements,
https://consumerdatastandardsaustralia.github.io/standards/#session-requirements (last visited Oct. 2, 2023); Open Banking Ltd., Change
and Communication Management--Downtime, https://standards.openbanking.org.uk/operational-guidelines/change-and-communication-management/downtime/latest/ (last visited Oct. 2,
2023).
---------------------------------------------------------------------------
[[Page 74817]]
Indicia of Commercially Reasonable Performance (Sec.
1033.311(c)(1)(ii))
Proposed Sec. 1033.311(c)(1) would require that the performance of
a data provider's developer interface be commercially reasonable. While
satisfaction of the quantitative minimum of 99.5 percent in proposed
Sec. 1033.311(c)(1)(i) would be necessary for commercially reasonable
performance, it would not be sufficient. That is, under the CFPB's
proposed rule it is possible that the performance of a data provider's
developer interface would not be commercially reasonable
notwithstanding that it does satisfy the quantitative minimum.
To provide a regulatory mechanism and incentive through which the
performance of data providers' developer interfaces would improve in
the future beyond the quantitative minimum, the CFPB is proposing, in
addition to that minimum, two indicia of commercially reasonable
performance in Sec. 1033.311(c)(1)(ii) that can be expected to evolve
over time. The first would be whether the performance of the interface
meets the applicable performance specifications set forth in a
qualified industry standard, as defined in proposed Sec. 1033.131. The
CFPB has preliminarily determined that the recurring process of
developing, adopting, and revising a standard that is a qualified
industry standard under the CFPB's proposed definition of that term
would be probative of whether performance of the developer interface is
commercially reasonable because it would take into account the
interests of a wide variety of stakeholders, as discussed more fully in
proposed Sec. 1033.141.
The second would be whether the performance meets the applicable
performance specifications achieved by the developer interfaces
established and maintained by similarly situated data providers. As the
performance of similarly situated data providers' interfaces improves,
the performance of a given data provider's developer interface also
would have to improve to continue to meet this indicator of commercial
reasonability. Conversely, as the performance of the given data
provider's developer interface improves, that improvement would lead
other similarly situated data providers to improve the performance of
their interfaces to meet the performance of the given data provider.
The CFPB requests comment on whether additional indicia would be
appropriate and what they should be. Currently, agreements and
standards name and describe specifications, such as latency and uptime,
for the performance of data providers' developer interfaces. The CFPB
requests comment on whether the final rule, instead of referring
broadly to ``applicable performance specifications,'' should name and
describe certain specifications. For example, rather than providing
that indicia of compliance include meeting the applicable performance
specifications achieved by the developer interfaces of similarly
situated data providers, the final rule could provide that indicia
include meeting the latency and uptime specifications achieved by the
interfaces of the other data providers.
The CFPB also notes that each data provider would have some
information about the performance of other data providers' interfaces
because (as discussed below) the CFPB is proposing in Sec. 1033.341(c)
to require all data providers to disclose publicly the quantitative
proper response metric for their developer interfaces. The CFPB also
seeks comment on what sources of market information data providers
would use to evaluate the performance of their peers' developer
interfaces.
Access Cap Prohibition for Data Providers' Interfaces (Sec.
1033.311(c)(2))
The CFPB proposes in Sec. 1033.311(c)(2) to prohibit a data
provider from unreasonably restricting the frequency with which it
receives and responds to requests for covered data from an authorized
third party through the data provider's developer interface. Such
restrictions are commonly known as ``access caps'' or ``rate limits.''
CFPA section 1033(a) requires that data providers make available
covered data upon request. The CFPB has preliminarily determined that
this proposed provision would be necessary and appropriate to
effectuate consumers' statutory rights under CFPA section 1033 by
ensuring that consumers and their authorized third parties are not
impeded from exercising consumers' statutory rights, including through
unreasonably frequent data requests by other authorized third parties.
Under proposed Sec. 1033.311(c)(2), a data provider would be
prohibited from unreasonably restricting the frequency with which it
receives and responds to requests for covered data from an authorized
third party through its developer interface, except as set forth in
certain sections. Those sections are proposed Sec. 1033.221, which
restates the statutory exceptions in CFPA section 1033(b); proposed
Sec. 1033.321, which describes the risk management reasons applicable
to denying a third party's access to an interface; proposed Sec.
1033.331(b), which identifies the conditions for when a data provider
must respond to an information request; and proposed Sec. 1033.331(c),
which identifies other reasons a response would not be required.
The CFPB does not intend that proposed Sec. 1033.311(c)(2) would
allow a data provider to impose restrictions that would override a
consumer's authorization, including the frequency with which an
authorized third party requests data. Instead, the proposed provision
would allow restrictions only if they reasonably target a limited set
of circumstances in which a third party requests information in a
manner that poses an unreasonable burden on the data provider's
developer interface and impacts the interface's availability to other
authorized third party requests. To prevent abuse of this provision,
proposed Sec. 1033.311(c)(2) provides that any frequency restrictions
must be applied in a manner that is non-discriminatory and consistent
with the reasonable written policies and procedures that the data
provider establishes pursuant to proposed Sec. 1033.351(a). Indicia
that any frequency restrictions applied are reasonable would include
that they adhere to a qualified industry standard.
The CFPB proposes in Sec. 1033.311(c)(2) to prohibit unreasonable
access caps for developer interfaces pursuant to both its authority
under CFPA sections 1033(a) and 1022(b)(1). A data provider that
imposes an access cap for which it has no reasonable basis would not be
making available covered data upon request by authorized third parties.
Prohibiting unreasonable access caps would ensure consumers and third
parties are not impeded from exercising consumers' rights under the
statute based on unreasonable limits imposed by the data provider.
The CFPB requests comment on whether the proposed provision should
be defined more narrowly to prevent data providers from interfering
with a consumer's authorization or whether additional guidance is
needed to prevent abuse. For example, the CFPB requests comment on
whether the final rule should include a presumption that access caps
are unreasonable unless undertaken for a period only as long as
necessary to ensure a third party request does not interfere with the
receipt of and response to requests from other third parties accessing
the interface.
[[Page 74818]]
The CFPB also requests comment on whether data providers should be
permitted to restrict the total amount of covered data that third
parties request over a given period of time and on whether proposed
part 1033 should treat small versus large data providers differently in
this regard. The CFPB also requests comment on whether there should be
different restrictions on data providers' access caps in cases where
the consumer is actively online with a third party requesting data
access, as opposed to when data are being automatically refreshed
without a consumer present.
Security Specifications (Sec. 1033.311(d))
The CFPB is proposing to require data providers to implement
several data security features in their consumer and developer
interfaces. This provision would implement CFPA section 1033(a) by
clarifying how a data provider would ensure it is making data available
to a consumer, including an authorized third party, in a manner that
would carry out the objectives of CFPA section 1033. Certain provisions
also would promote the use and development of standardized formats,
consistent with CFPA section 1033(d).
Access Credentials
As discussed throughout part I, third parties' credential handling
practices--typically resulting from their reliance on credential-based
screen scraping--can raise significant security, risk management,
privacy, and accuracy risks to the system as a whole. Proposed Sec.
1033.311(d)(1) would seek to prevent data providers from relying on a
third party's use of consumer credentials to access the developer
interface.
When they employ screen scraping, third parties generally must
store consumer account credentials they obtain so they can be reused to
collect data as necessary to support the product or service a consumer
is using. Because third parties collect data from many consumers at
once, they must collect and store many sets of consumer credentials.
This creates security and fraud risks: bad actors might target third
parties and attempt to cause a data breach because these third parties
store large quantities of sensitive consumer information. The longer a
third party stores consumer credentials before deleting them, and the
less rigorous a third party is in employing cybersecurity practices to
protect those credentials, the more likely such a breach will occur. If
a breach occurs--whether because of inadequate cybersecurity or
credential storage practices, or for any other reason--the consumers to
whom the leaked credentials correspond may suffer invasions of privacy
or financial harms. This is especially the case for the kinds of funds-
storing and payment accounts that would be covered by this proposed
rule; a breach which results in the theft of credentials could cause
unauthorized transactions or fraudulent use of consumers' personal
financial data. For data providers, designing developer interfaces that
operate using consumers' access credentials would heighten the risks
described in part I.C and create specific risks to data providers. For
example, a data provider may face greater difficulty ensuring
legitimate access by third parties using a consumer's credentials,
impairing its efforts to prevent truly unauthorized access by criminals
or other bad actors. The widespread use of consumers' access
credentials in a developer interface could also raise risk management
concerns.\79\
---------------------------------------------------------------------------
\79\ See generally Fed. Rsrv. Sys., FDIC, OCC, Interagency
Guidance on Third-Party Relationships: Risk Management (June 6,
2023), https://occ.gov/news-issuances/news-releases/2023/nr-ia-2023-53a.pdf.
---------------------------------------------------------------------------
To avoid these problems from arising because of how a data
provider's developer interface is designed, proposed Sec.
1033.311(d)(1) would prohibit a data provider from allowing a third
party to access the data provider's interface by using any credentials
that a consumer uses to access the consumer interface.
The CFPB understands that in current arrangements between data
providers and third parties for use of data providers' developer
interfaces, the data provider often authenticates the consumer using
that consumer's digital banking credentials. In such cases, the CFPB
understands that the third party itself does not request, access, use,
or retain the consumer's credentials; instead, after procuring a
consumer's authority to access data, the third party `passes' the
consumer directly to the data provider, who authenticates the consumer
using the consumer's digital banking credentials, and then provides the
third party with a secure access token. The CFPB seeks comment on
whether and, if so, how the proposed rule should address this practice.
The CFPB also understands that, in some cases, entities that act as
service providers to data providers may develop, deploy, and maintain
developer interfaces on behalf of those data providers whose technical
specifications and requirements entail those service providers
retaining and using consumers' credentials. Such arrangements can
provide lower-cost routes for smaller data providers to offer developer
interfaces, which benefits all participants in the open banking system
and, ultimately, consumers. The CFPB does not intend for proposed Sec.
1033.311(d)(1) to interfere with such arrangements but seeks comment on
situations where an entity acts as both such a service provider and a
third party.
Security Program
Proposed Sec. 1033.311(d)(2) would address general data security
requirements for the data provider's developer interface. Because the
proposed definition of covered data includes transaction information,
information for initiating payments to or from a consumer's account,
and other sensitive financial information, poor data security measures
would expose consumers to significant harm, such as fraud or identity
theft. As the CFPB noted in a recent circular, information security
weaknesses can result in data breaches, cyberattacks, exploits,
ransomware attacks, and other exposure of consumer data.\80\ To prevent
these harms, the proposed rule would require data providers to apply to
their developer interfaces a data security program that satisfies the
GLBA Safeguards Framework. The proposed rule would require a data
provider that is not a GLBA financial institution to apply the
information security program required by the FTC's Safeguards Rule.\81\
---------------------------------------------------------------------------
\80\ Consumer Fin. Prot. Bureau, Consumer Financial Protection
Circular 2022-04 (Aug. 11, 2022), https://www.consumerfinance.gov/compliance/circulars/circular-2022-04-insufficient-data-protection-or-security-for-sensitive-consumer-information/.
\81\ 16 CFR part 314.
---------------------------------------------------------------------------
The CFPB has preliminarily determined that the GLBA Safeguards
Framework appropriately addresses data security risks for developer
interfaces in the market for consumer-authorized financial data. The
GLBA Safeguards Framework generally requires each financial institution
to develop, implement, and maintain a comprehensive written information
security program that contains safeguards that are appropriate to the
institution's size and complexity, the nature and scope of the
institutions' activities, and the sensitivity of the customer
information at issue. These safeguards must address specific elements
set forth in the rule. The framework provides a process for ensuring
that such a program is commensurate with the risks faced by the
financial institution rather than a rigid list of prescriptions. This
flexible,
[[Page 74819]]
risk-based approach allows it to adapt to changing technology and
emerging data security threats.
Requiring data providers to apply the GLBA Safeguards Framework
would also reduce burden by avoiding duplicative or inconsistent data
security requirements. The CFPB understands that all or nearly all data
providers are already subject to the GLBA Safeguards Framework, and
therefore would be able to adapt their information security programs to
the risks created by the developer interface. For example, a State
member bank would apply the information security program that it had
developed pursuant to the Interagency Guidelines Establishing
Information Security Standards issued by the Board of Governors of the
Federal Reserve System.\82\
---------------------------------------------------------------------------
\82\ 12 CFR part 208, app. D-2.
---------------------------------------------------------------------------
The CFPB considered proposing to require data providers to adopt
additional reasonable policies and procedures regarding the data
security of the interfaces for third parties. Such a requirement would
share the GLBA Safeguards Framework's flexibility to accommodate
changing technology and emerging threats while avoiding the potential
uncertainty of applying the GLBA Safeguards Framework's existing
requirements to the open banking system. But a general policies and
procedures requirement would lack the additional detail of the GLBA
Safeguards Framework. Data providers already face a general obligation
to avoid inadequate data security measures under the CFPA's prohibition
on unfair, deceptive, and abusive acts and practices.\83\ Supplying
additional detail to a general policies and procedures requirement has
several potential drawbacks. For example, the CFPB may end up adopting
substantially similar requirements to the GLBA Safeguards Framework,
thus subjecting data providers to duplicative data security
regulations. Or the CFPB might adopt additional clarifications that are
inconsistent with the Federal functional regulators' interpretation of
the GLBA Safeguards Framework. For these reasons, the CFPB declines to
propose a general policies-and-procedures requirement for data security
but seeks comment on such a requirement.
---------------------------------------------------------------------------
\83\ Consumer Fin. Prot. Bureau, Consumer Financial Protection
Circular 2022-04 (Aug. 11, 2022), https://www.consumerfinance.gov/compliance/circulars/circular-2022-04-insufficient-data-protection-or-security-for-sensitive-consumer-information/.
---------------------------------------------------------------------------
Although the CFPB understands that the data security of data
providers' interfaces for third parties is generally regulated by
existing law, the proposed definition of data provider is broad enough
to encompass a diverse array of entities. While the CFPB understands
that all or virtually all data providers are GLBA-covered financial
institutions, the proposed rule would remove any uncertainty by making
compliance with the GLBA Safeguards Framework a requirement for any
developer interface. For data providers not subject to the Interagency
Guidelines issued by the Federal functional regulators,\84\ the
proposed rule would require compliance with the FTC's Safeguards Rule.
As the FTC explained in its recent amendments to the Safeguards Rule,
the Safeguards Rule is designed to operate without the benefit of
direct guidance by an examining agency.\85\ For this reason, the CFPB
has preliminarily determined that the FTC's Safeguards Rule is
appropriate for data providers that might not have the direct
supervision of one of the Federal functional regulators that implement
the Interagency Guidelines.
---------------------------------------------------------------------------
\84\ See 12 CFR 1016.3(k) (defining ``Federal functional
regulator'' as the Board of Governors of the Federal Reserve System,
the OCC, the Board of Directors of the FDIC, the NCUA Board, and the
Securities and Exchange Commission).
\85\ 86 FR 70272, 70287 (Dec. 9, 2021).
---------------------------------------------------------------------------
This proposed rule would implement CFPA section 1033(a) by
clarifying how a data provider must make available data upon request to
a consumer, which would include an authorized third party. Establishing
a consistent set of data security requirements to developer interfaces
will help ensure that developer interfaces are only making data
available to consumers and authorized third parties consistent with the
scope of a consumer's request and do not present unreasonable risks to
the security, confidentiality, and integrity of covered data.
4. Interface Access (Sec. 1033.321)
Proposed Sec. 1033.321 would clarify the circumstances under which
a data provider would be permitted to block a consumer's or third
party's access to its consumer or developer interface without violating
the general obligation of CFPA section 1033(a). In particular, a data
provider would not be required to make available covered data to a
person or entity that presents significant risks to the data provider's
data security or risk management program. It would be inconsistent with
CFPA section 1033(a) for a data provider to make available covered data
to persons or entities that present unreasonable risks to the security
of the data provider's safety and soundness, information systems, or
consumers, or where a data provider could not take steps to ensure they
are making available covered data to an actual consumer or authorized
third party.
Risk Management (Sec. 1033.321(a) Through (c))
The CFPB recognizes that data providers have legitimate interests
in making data available only to authenticated consumers and
authenticated authorized third parties and in a way that avoids
unreasonable risks to consumers and protects covered data. CFPA section
1033(a) does not expressly address how a data provider must take risk
management concerns into account when making data available. However,
as discussed in this section below, the CFPB has preliminarily
determined that CFPA section 1033(a) authorizes procedures to clarify
the circumstances under which a data provider must make available
covered data upon request. The CFPB is proposing to clarify that a data
provider can reasonably deny a consumer or third party access to an
interface described in proposed Sec. 1033.301(a) based on risk
management concerns.
Depository institutions have legal obligations to operate in a safe
and sound manner, and both depository and nondepository institutions
have other security-related obligations.\86\ The prudential regulators
have issued guidance explaining that, to operate in a safe and sound
manner, banking organizations must establish practices to manage the
risks arising from third party relationships.\87\ The guidance explains
that ``[c]onducting due diligence on third parties before selecting and
entering into third party relationships is an important part of sound
risk management.'' \88\ The guidance further explains that ``[n]ot all
relationships present the same level of risk, and therefore not all
relationships require the same level or type of oversight or risk
management.'' \89\ Additionally, data security guidelines issued by the
prudential regulators and
[[Page 74820]]
the FTC also address risk management. For example, the prudential
regulators' data security guidance states that banks should implement
controls to identify reasonably foreseeable internal and external
threats that could result in unauthorized disclosure, misuse,
alteration, or destruction of customer information.\90\
---------------------------------------------------------------------------
\86\ See, e.g., 12 U.S.C. 1831p-1; Interagency Guidelines
Establishing Standards for Safety and Soundness, 12 CFR part 30,
app. A (OCC), 12 CFR part 208, app. D-1 (Bd. of Governors of the
Fed. Rsrv. Sys.); and 12 CFR part 364, app. A (FDIC); the GLBA; the
FTC's Safeguards Rule; Fed. Fin. Insts. Examination Council,
Authentication and Access to Financial Institution Services and
Systems (Aug. 11, 2021), https://www.ffiec.gov/guidance/Authentication-and-Access-to-Financial-Institution-Services-and-Systems.pdf (Security Guidelines).
\87\ Bd. of Governors of the Fed. Rsrv. Sys., Fed. Deposit Ins.
Corp., Off. of the Comptroller of the Currency, Dep't of the Treas.,
Interagency Guidance on Third-Party Relationships: Risk Management,
88 FR 37920, 37927 (June 9, 2023) (Interagency TPRM Guidance).
\88\ Id. at 37929.
\89\ Id. at 37927.
\90\ See, e.g., Security Guidelines at III.B.1.
---------------------------------------------------------------------------
The SBREFA Panel recommended that the CFPB clarify the
circumstances under which data providers would be required to make data
available to third parties.\91\ The Panel also recommended that the
CFPB evaluate options that would allow data providers to take
reasonable steps to reduce security and fraud risks, while still
ensuring that consumers are able to exercise their rights under the
eventual rule.\92\ Further, various stakeholders have asked the CFPB to
clarify whether a data provider would violate the proposed rule if it
were to deny access to a third party based on a legitimate risk
management concern. The CFPB has developed proposed Sec. 1033.321(a)
through (c) to address this feedback.
---------------------------------------------------------------------------
\91\ SBREFA Panel Report at 44.
\92\ Id.
---------------------------------------------------------------------------
Consumers could be harmed if a final rule did not allow data
providers to deny a third party access to the data provider's developer
interface where the data provider has legitimate risk management
concerns. For example, if a data provider had legitimate concerns about
a third party's ability to safeguard the consumer's data, requiring
that data provider to nevertheless grant access to the third party
could result in a data breach that could have been avoided. At the same
time, if denials of access are not narrowly tailored to a specific risk
management concern, they may frustrate a consumer's right to access
data under CFPA section 1033. As discussed in part I.C, the CFPB is
concerned that data providers may have incentives to deny access,
particularly where third parties are offering a competing product or
service, which may result in denials that are not tailored to a
legitimate risk.
To address this possibility, proposed Sec. 1033.321(a) states that
a data provider can reasonably deny a consumer or third party access to
its interface based on risk management concerns, as clarified by
proposed Sec. 1033.321(b) and (c). Subject to proposed Sec.
1033.321(b), discussed below, a denial would not be unreasonable if it
is necessary to comply with the safety and soundness requirements or
data security requirements in Federal law.
Proposed Sec. 1033.321(b) explains that to be reasonable under
proposed Sec. 1033.321(a) a denial must, at a minimum, be directly
related to a specific risk of which the data provider is aware, such as
a failure of the third party to maintain adequate data security, and
must be applied in a consistent and non-discriminatory manner. The CFPB
notes that the term ``non-discriminatory'' in this paragraph carries
its ordinary meaning and is not intended to refer to discrimination on
a prohibited basis under Federal fair lending law.\93\ For example, if
a denial were to be based on a concern about consumer-authorized data
access generally, rather than a specific risk related to the operations
or practices of the third party requesting data, it would not be
reasonable. In addition, if a data provider were to deny access to one
third party based on a certain risk but were to grant access to another
third party where the same risk is present, and all other factors were
equal, the denial would not be considered reasonable.
---------------------------------------------------------------------------
\93\ A similar requirement is found in the information blocking
provision of HHS's rule implementing the 21st Century Cures Act,
Public Law 114-255, 130 Stat. 1033 (2016). See 85 FR 25642, 25862
(May 1, 2020).
---------------------------------------------------------------------------
Proposed Sec. 1033.321(c) explains that indicia that a denial is
reasonable include whether access is denied pursuant to the terms of a
qualified industry standard related to data security or third party
risk management. If a data provider were to deny access to comply with
these requirements, the denial may be reasonable because it reflects
compliance with standards developed with the participation of a variety
of stakeholders in the open banking system, consistent with the
proposed rule's objective discussed in part I.D to develop a data
access framework that is safe and competitive. However, conformance
with an industry standard alone would not necessarily settle the
question of reasonableness.
The CFPB requests comment on additional ways to harmonize the risk
management obligations of data providers with CFPA section 1033's data
access right for consumers and authorized third parties. Risk
management may entail a variety of practices and risk management
standards could be defined through several sources, including
prudential guidance, other Federal government standards, or qualified
industry standards. The CFPB requests comment on the extent to which
CFPB rule or guidance, or other sources, should address whether a data
provider's denial of third party access to a developer interface under
Sec. 1033.321(a) would be reasonable with respect to any particular
risk management practices.
Proposed Sec. 1033.321(a) through (c) would implement CFPA section
1033 by clarifying what steps are necessary to make data available to a
consumer or authorized third party upon request. These provisions would
seek to ensure that data providers are making data available only to
authenticated consumers and authenticated authorized third parties, and
that data access does not present unreasonable risks to the security
and integrity of covered data. Depending on the facts, certain
exceptions under CFPA section 1033, set forth in proposed Sec.
1033.221, might allow a data provider to not make data available.\94\
However, the CFPB has preliminarily determined that, in most cases, it
would not be appropriate for data providers to rely on the exceptions
to address risk management concerns. The identification of risk
management concerns might involve the exercise of substantial
discretion by the data provider, and the CFPB is concerned that data
providers' strong competing incentives discussed in part I.C might
undermine the objectives of CFPA section 1033 to allow consumers to
share data with authorized third parties, in particular third parties
offering competing products or services.
---------------------------------------------------------------------------
\94\ See, e.g., 12 U.S.C. 5533(b)(2) (exception for any
information collected by the covered person for the purpose of
preventing fraud or money laundering, or detecting, or making any
report regarding other unlawful or potentially unlawful conduct),
5533(b)(3) (exception for any information required to be kept
confidential by any other provision of law).
---------------------------------------------------------------------------
Denials Related to Lack of Information--Evidence of Data Security
Practices (Sec. 1033.321(d)(1))
The CFPB is proposing that a data provider would have a reasonable
basis for denying a third party access to a developer interface under
proposed Sec. 1033.321(a) if a third party does not present evidence
that its data security practices are adequate to safeguard the covered
data.
As noted in the discussion of proposed Sec. 1033.321(a) through
(c), data providers are subject to various legal obligations related to
data security, and safety and soundness. Consistent with these
obligations, data providers in the market today typically conduct due
diligence of a third party before granting the third party access to
the data provider's interface. This diligence is typically either
performed by the data provider itself or by another entity, such as a
data aggregator, a core banking provider, or a third party assessment
firm.
[[Page 74821]]
If the CFPB finalizes the rule as proposed, data providers that
currently have developer interfaces could experience an increased
volume of requests. In addition, some data providers will be
establishing interfaces for the first time. The CFPB is concerned that,
particularly for smaller data providers, the volume of requests from
third parties to access these data providers' interfaces could outstrip
these data providers' resources for vetting third parties. In addition
to being burdensome for individual data providers, the CFPB is also
concerned that duplicative vetting--i.e., several different data
providers conducting similar due diligence of a particular third
party--could be a source of inefficiency in the open banking system.
In some other open banking regimes, a governmental or quasi-
governmental body addresses these potential problems by serving an
accreditation function. The governmental or quasi-governmental body
independently evaluates third parties and issues credentials endorsing
the third party's fitness to receive consumer-authorized data.\95\ The
CFPB is proposing a different approach to standard-setting. Although a
private accreditation system does not yet exist in the United States,
there are various certifications in existence today that represent
compliance with certain data security standards.
---------------------------------------------------------------------------
\95\ See, e.g., Australian Gov't, Become an Accredited Data
Recipient, https://www.cdr.gov.au/for-providers/become-accredited-data-recipient (noting that the Australian Competition and Consumer
Commission ``manages the accreditation process'') (last visited Aug.
19, 2023).
---------------------------------------------------------------------------
Proposed Sec. 1033.321(d)(1) would seek to alleviate the concerns
described above related to the potential burden of vetting on smaller
data providers and the potential inefficiency resulting from
duplicative vetting. Proposed Sec. 1033.321(d)(1) states that a data
provider has a reasonable basis for denying access to a third party
under proposed Sec. 1033.321(a) if the third party does not present
evidence that its data security practices are adequate to safeguard the
covered data. Where the third party does not present such evidence, the
data provider may deny access under proposed Sec. 1033.321(a) without
vetting the third party. Where the third party does present such
evidence, the data provider may either grant access or perform
additional due diligence on the third party as appropriate.
The CFPB requests comment on whether to specify the types of
evidence a third party would need to present about its data security
practices that would give a data provider a reasonable basis to deny
access under proposed Sec. 1033.321(d)(1), and what types of evidence
might provide such a basis. For example, the CFPB requests comment on
whether such evidence could consist of certifications or other
credentials representing compliance with data security standards, or
evidence of vetting by a third party risk assessment firm.
As the text of proposed Sec. 1033.321(d)(1) explains, any denials
of access under this provision would still be subject to the
reasonability requirement in proposed Sec. 1033.321(a). For example,
proposed Sec. 1033.321(b) states in part that, to be reasonable, a
denial on risk management grounds must be applied in a consistent and
non-discriminatory manner. Thus, a data provider could not deny access
to a third party for failing to present evidence that its data security
practices are adequate to safeguard the covered data, where it grants
access to another third party that presents similar evidence, assuming
all other factors are equal.
The CFPB encourages stakeholders in the open banking system to
engage in a fair, open, and inclusive process to develop an
accreditation system for third parties. For example, data providers,
third parties, consumer advocacy groups, and other stakeholders could
establish an independent body that performs an accreditation role, or
an existing open banking standards body could expand its remit to
include such a role. The CFPB requests comment on whether developing
such a credential could reduce diligence costs for both data providers
and third parties and increase compliance certainty for data providers
with respect to the proposed rule. The CFPB also requests comment on
the steps necessary to develop such a credential and how the CFPB or
other regulators could support such efforts.
Denials Related to Lack of Information--Certain Information About the
Third Party (Sec. 1033.321(d)(2))
The CFPB is proposing that a data provider would have a reasonable
basis for denying access under proposed Sec. 1033.321(a) if a third
party does not make public certain information about itself. The CFPB
has preliminarily determined that this provision would enable the open
banking system to function more efficiently, in two respects.
First, the information would help data providers authenticate the
identities of third parties (i.e., help data providers confirm the
third party is who they say they are). After a data provider
establishes an interface, it may receive a request from a third party
to access that interface, but it may not know who the third party is.
The identity information described in proposed Sec. 1033.321(d)(2)(i)
through (iii)--the third party's legal name and any assumed name they
are using when doing business with the consumer, a link to their
website, and their LEI--would help the data provider confirm the third
party's identity. Second, the information described in proposed Sec.
1033.321(d)(2)(iv)--contact information a data provider can use to
inquire about the third party's data security practices--would
facilitate any outreach to the third party that may be required as part
of a data provider's diligence. Furthermore, the identity information
described in proposed Sec. 1033.321(d)(2)(i) through (iii) may help
the data provider conduct research in connection with its due
diligence.
The SBREFA Panel recommended that the CFPB evaluate options that
would reduce additional costs on data providers and third parties in
authenticating a third party or verifying a third party's
authorization, such as providing data providers with a list of third
parties that make available information relevant to their
authentication.\96\ By assisting data providers with third party
authentication and due diligence, the CFPB has preliminarily determined
that proposed Sec. 1033.321(d)(2) would help further the
recommendations of the SBREFA Panel related to third party
authentication.\97\
---------------------------------------------------------------------------
\96\ SBREFA Panel Report at 44.
\97\ Id. at 43.
---------------------------------------------------------------------------
Proposed Sec. 1033.321(d)(2) would permit the data provider to
deny access if the information is not available in human-readable and
machine-readable formats. Making the data available in machine-readable
format could enable data providers and other stakeholders to use
automated processes to ingest the relevant information into their
systems for processing and review, which would make the process of
obtaining this information more efficient. Proposed Sec.
1033.321(d)(2) would also permit the data provider to deny access if
the information is not readily identifiable to members of the public,
meaning the information must be at least as available as it would be on
a public website. The CFPB seeks comment on whether it should indicate
that conformance to a specific standard or a qualified industry
standard would be relevant indicia for a third party's machine-
readability compliance.
[[Page 74822]]
The CFPB seeks comment on whether it should issue regulations or
guidance that would make it easier for data providers and other members
of the public to identify a particular third party's information. For
example, the CFPB could provide that a data provider is permitted to
deny access if the third party's information is not available on public
websites and the URL does not contain specified text in accordance with
the ``well-known Uniform Resource Identifier'' protocol. This approach
could make it easy for a person to identify the website where a
particular third party's information is available or all websites where
third parties are making such information available, which could
facilitate the creation of a directory of third parties.
Additionally, the CFPB seeks comment on whether it should provide
that a data provider is permitted to deny access if the third party
does not submit to the CFPB the link to the website on which this
information is disclosed. This would enable the CFPB to publish a
directory of links that data providers and other members of the public
could use. The CFPB also seeks comment on whether data providers should
have to provide information or notice to the CFPB regarding their
procedures and decisions to approve or deny third parties for access to
their developer interfaces. For example, data providers could be
required to regularly provide the CFPB a list of all third parties that
they have approved to access their interface. As a further example,
data providers could be required to notify the CFPB if and when they
deny a third party access to their developer interface, including
reasons for denying access (records of which proposed Sec.
1033.351(d)(2)(i) would require data providers to retain). Such
information may allow the CFPB to better monitor the data access system
and ensure that denials of access are compliant.
Under proposed Sec. 1033.321(d)(2), the information the third
party makes available would be disclosed publicly. Public disclosure of
this information--along with public disclosure of similar information
by data providers pursuant to proposed Sec. 1033.341--would facilitate
market monitoring by the CFPB and members of the public. It would also
enable standard-setting bodies to identify the data providers and third
parties that are participating in the open banking system, which could
aid efforts by standard-setting bodies to develop industry standards
related to consumer-authorized data access.
The CFPB proposes in Sec. 1033.321(d)(2) that a data provider
would have a reasonable basis for denying a third party's access to
covered data in certain situations pursuant to the CFPB's authority
under CFPA sections 1033(a) and 1022(b)(1). By requiring a third party
to make public certain identifying information about itself, the
disclosures proposed in Sec. 1033.321(d)(2) serve as a component of
the statutory requirement of CFPA section 1033(a) to make data
available. The disclosures facilitate CFPA section 1033's data
availability requirement by giving data providers an authentication
tool over third parties, while also facilitating any outreach required
by data providers to a third party as a result of the data provider's
due diligence obligations under proposed Sec. 1033.321(a) through (c).
Additionally, these disclosures would be authorized under CFPA section
1022(b)(1), which authorizes the CFPB to prescribe rules as may be
necessary or appropriate to enable the CFPB to prevent evasion of the
purposes and objectives of the Federal consumer financial laws--
including carrying out the objectives of CFPA section 1033.
The SBREFA Panel recommended that the CFPB consult with other
Federal agencies responsible for administering data security
requirements applicable to data providers to discuss the feasibility of
developing a safe harbor for authenticating third parties.\98\ Due to
the lack of an accreditation system in the United States related to
open banking--as described above in the discussion of proposed Sec.
1033.321(d)(1)--the CFPB has preliminarily determined that such a safe
harbor for the proposed rule is not feasible at this time. The CFPB
plans to engage in further coordination with the Federal agencies
responsible for administering data security requirements.
---------------------------------------------------------------------------
\98\ Id. at 44.
---------------------------------------------------------------------------
While the CFPB is not proposing a safe harbor, proposed Sec.
1033.321(a) through (c) would seek to reduce a data provider's
uncertainty about when they may deny access to an interface based on
risk management concerns. Further, proposed Sec. 1033.321(d)(1) and
(2) would seek to alleviate the potential burden of vetting on data
providers. Last, proposed Sec. 1033.321(d)(2) would help data
providers authenticate the identities of third parties. The CFPB seeks
comment on how the proposed rule could further facilitate compliance
and reduce due diligence costs for both data providers and third
parties while adequately ensuring the security of consumer data.
5. Responding to Requests for Information (Sec. 1033.331)
Proposed Sec. 1033.331 would prescribe basic conditions to
implement data providers' obligation to make data available ``upon
request'' under CFPA section 1033(a) and would clarify data providers'
ability to authenticate and manage the authorization process for third
parties. In general, under proposed Sec. 1033.331, a data provider
would need to make covered data available to the third party in
accordance with the terms of the authorization provided by the consumer
to the third party if the conditions in proposed Sec. 1033.331(b) were
satisfied, as discussed below. A data provider would not be required to
make data available if one of the exceptions listed in proposed Sec.
1033.221 applied, if the data provider reasonably denied access
pursuant to proposed Sec. 1033.321(a), if the data provider's
interface were unavailable, or if a third party's authorization was no
longer valid.
Responding to Requests--Access by Consumers (Sec. 1033.331(a))
Proposed Sec. 1033.331(a) would prescribe the conditions that
apply where consumers are seeking covered data (as opposed to where a
third party requests access to a consumer's data on the consumer's
behalf). Under proposed Sec. 1033.331(a), a data provider would be
required to make available covered data upon request to a consumer when
it receives information sufficient to (1) authenticate the consumer's
identity and (2) identify the scope of the data requested. Under
proposed Sec. 1033.331(a), the CFPB expects that these conditions
would be satisfied through procedures in use by most consumer
interfaces that automatically authenticate consumers and allow
consumers to identify covered data.
Responding to Requests--Access by Third Parties (Sec. 1033.331(b))
Proposed Sec. 1033.331(b)(1) would list four conditions that must
be satisfied to clarify when a data provider must make available
covered data to a requesting third party acting on behalf of a
consumer. Under proposed Sec. 1033.331(b)(2), data providers would be
permitted to engage in limited steps to confirm conditions are
satisfied with respect to a third party's authorization.
Stakeholders have expressed different views about whether and the
extent to which data providers, third parties, or both, should manage
the process of obtaining a consumer's authorization to grant a third
party access to the
[[Page 74823]]
consumer's data.\99\ In response to the SBREFA Outline, the CFPB
received feedback from several stakeholders expressing concern that
reliance on an authorization generated by a third party would present
risk management concerns and that they should be able to obtain the
consumer's authorization from the consumer. Stakeholders have also
suggested that this approach is necessary to protect consumer privacy
and data security. Other stakeholders have suggested that the data
provider should be able to confirm the consumer's authorization before
making data available to the third party.\100\
---------------------------------------------------------------------------
\99\ See, e.g., id. at 30.
\100\ See, e.g., id. at 54.
---------------------------------------------------------------------------
As discussed in part III, the CFPB interprets CFPA section 1033 to
authorize rules that require data providers upon request to readily
make available usable data to consumers and authorized third parties,
including third parties offering competing products and services. The
CFPB has preliminarily determined that third parties are in the best
position to determine what covered data are reasonably necessary to
provide the requested product or service. And as discussed in part I.C,
data providers may have strong incentives to limit the scope of data
available to third parties, especially those providing a competing
product or service.
The CFPB recognizes that data providers have legitimate interests
in protecting their data security and other risk management priorities.
Accordingly, the CFPB has preliminarily determined that data providers
should confirm the third party's authorization with the consumer, as
discussed below with respect to proposed Sec. 1033.331(b)(2), as well
as other provisions designed to protect legitimate security and other
risk management interests, such as those discussed with respect to
proposed Sec. 1033.321. While the CFPB is proposing to allow data
providers to reasonably deny access requests due to a risk management
concern described in proposed Sec. 1033.321(a), the CFPB does not
intend for data providers to rely on this provision to limit the scope
of a consumer's authorization. Proposed Sec. 1033.321(a) would only
allow a data provider to deny a third party access entirely to its
developer interface, and a data provider likely would not have a
reasonable basis to deny a third party access to an interface entirely
due to concerns specifically about the scope of data requested.
The CFPB also acknowledges third parties may present security and
privacy risks to consumers, as discussed in part I.C. However, the CFPB
is proposing procedures discussed in part IV.D to ensure third parties
are acting on behalf of consumers. The CFPB does not believe primary
enforcement responsibility for ensuring third parties are acting on
behalf of consumers should reside with data providers that may be
driven by their own commercial interests. For the reasons above, the
CFPB has preliminarily determined that it would best carry out the
objectives of CFPA section 1033 for data providers to confirm that the
third party has followed the authorization procedures described further
below with respect to proposed Sec. 1033.401. These procedures are
discussed in greater detail below with respect to proposed Sec.
1033.331(b)(1)(iii).
Conditions That Apply to Requests From Third Parties (Sec.
1033.331(b)(1))
Among the four conditions that would trigger a response to a third
party under proposed Sec. 1033(b)(1), a data provider would need to
receive information sufficient to authenticate the consumer's identity.
The CFPB is proposing to include this condition to mitigate the
potential for fraudulent data requests.\101\ In the market today,
before a data provider grants a third party access to covered data, the
consumer is typically redirected to the data provider's interface to
authenticate the consumer's identity, usually by providing account
credentials. Where consumers provide their credentials directly to the
data provider through such an interface, the data provider would
generally receive information sufficient to authenticate the consumer's
identity for purposes of proposed Sec. 1033.331(b)(1)(i). The CFPB
seeks comment on the potential for technology to evolve such that a
data provider could satisfy appropriate data security and other risk
management standards without receiving a consumer's account credentials
directly from the consumer.
---------------------------------------------------------------------------
\101\ This can include cases where the initial query under a
request is being given by a fraudster or another person not actually
authorized by the consumer, or cases where queries pursuant to an
earlier-given authorization are pursuant to the actions of a
fraudster or other unauthorized party that has illicitly gained
control of a consumer's account or identity.
---------------------------------------------------------------------------
In addition to authenticating the consumer's identity, under
proposed Sec. 1033.331(b)(1)(ii), the data provider would need to
receive information sufficient to authenticate the third party's
identity. An example of such information would include an access token
obtained by the third party that has been approved to access the data
provider's interface. As discussed with respect to proposed Sec.
1033.321(a), the proposed rule would not require data providers to make
data available to third parties that present legitimate risk management
concerns. The CFPB expects that, prior to responding to data requests,
most data providers would engage in some reasonable risk management
diligence in accordance with proposed Sec. 1033.321(a) as part of
approving third parties to access a developer interface. And as
discussed below with respect to proposed Sec. 1033.331(c)(2), a data
provider would not need to respond to a request from a third party if
the data provider has a proper basis to deny access pursuant to risk
management concerns described in proposed Sec. 1033.321(a).
Further, under proposed Sec. 1033.331(b)(1)(iii), a data provider
would need to receive information sufficient to confirm the third party
has followed the authorization procedures in proposed Sec. 1033.401,
discussed in greater detail in part IV.D. This step would generally be
satisfied where the data provider receives a copy of the authorization
disclosure the third party provided to the consumer and that the
consumer has signed. The CFPB requests comment on whether
clarifications are needed regarding what information would be
sufficient to confirm the third party has followed the authorization
procedures in the context of automated requests received through a
developer interface.
Finally, under proposed Sec. 1033.331(b)(1)(iv), a data provider
would need to receive information sufficient to identify the scope of
the data requested. Under proposed Sec. 1033.301(a), in response to a
request (that satisfies the conditions of proposed Sec.
1033.331(b)(1)), a data provider would be required to make available
the requested covered data. In some circumstances, however, the scope
of information requested by an authorized third party might be
ambiguous. To clarify the scope of covered data to be made available in
response to a request, a data provider could seek to clarify the scope
of an authorized third party's request with a consumer. For example,
there might be circumstances in which a data provider could seek to
clarify whether a consumer intended to consent to share information
from particular accounts or particular types of information not
specified in the consumer's third party authorization.
The CFPB requests comment on whether additional clarifications or
procedures are needed to ensure a data provider does not design its
developer interface to receive information sufficient to satisfy the
conditions set
[[Page 74824]]
forth in proposed Sec. 1033.331(b)(1) in a way that frustrates the
ability of authorized third parties to receive timely responses to
requests for covered data.
Confirmation of Third Party Authorization (Sec. 1033.331(b)(2))
Proposed Sec. 1033.331(b)(2) provides that a data provider is
permitted to confirm the scope of the third party's authorization to
access the consumer's data by asking the consumer to confirm (1) the
account(s) to which the third party is seeking access and (2) the
categories of covered data that will be accessed, by presenting that
information--as it is disclosed on the authorization disclosure--back
to the consumer. This confirmation step would enable the data provider
to confirm the account(s) to which the third party is seeking access,
which may not be clear from the authorization disclosure. For example,
a consumer might have multiple accounts with a data provider, and it
may be unclear from the authorization disclosure which account (or
accounts) the request pertains to, because the third party would not
necessarily know the names and account numbers of the consumer's
accounts. This step also would give the consumer an opportunity to
review information about what data they would be authorizing the third
party to access, and it would give data providers greater certainty
that the consumer has authorized the request. The CFPB seeks comment on
whether the final rule should instead permit data providers to confirm
this information with the consumer only where reasonably necessary.
Under this alternative approach, if technology were to evolve such that
data providers could reasonably confirm this information without asking
the consumer to confirm it, the rule might no longer permit data
providers to ask consumers to confirm this information.
Response Not Required (Sec. 1033.331(c))
Proposed Sec. 1033.331(c) would list the four circumstances under
which a data provider would not be required to make covered data
available in response to a request. For ease of reference, proposed
Sec. 1033.331(c)(1) and (2) would restate exceptions that exist
elsewhere in the proposed rule: the exceptions in proposed Sec.
1033.221, which are derived from section 1033(b) of the CFPA, and the
exception in proposed Sec. 1033.321(a) related to risk management.
Proposed Sec. 1033.331(c)(3) explains that a data provider would
not be required to make covered data available if its interface is not
available when the data provider receives a request. Under proposed
Sec. 1033.331(c)(3), if a data provider receives a request, and the
data provider's interface is unavailable, the data provider would not
violate its obligation to make covered data available where it does not
respond to the request. Proposed Sec. 1033.331(c)(3) explains,
however, that the data provider would be subject to the performance
specifications in proposed Sec. 1033.311(c). The CFPB requests comment
on any additional clarification that would reduce the opportunity for
data providers to deny requests without justification under this
provision. For example, the CFPB could clarify the meaning of
``unavailable'' in a manner similar to the ``infeasibility'' or
``health IT'' exceptions in the Information Blocking Rule issued by
HHS.\102\
---------------------------------------------------------------------------
\102\ See 45 CFR 171.204; 171.205.
---------------------------------------------------------------------------
Finally, proposed Sec. 1033.331(c)(4) explains that a data
provider would not be required to make covered data available if the
request is for access by a third party but the consumer's authorization
is not valid for one of three reasons: (1) the consumer has revoked the
third party's authorization pursuant to proposed Sec. 1033.331(e); (2)
the data provider has received notice that the consumer has revoked the
third party's authorization pursuant to proposed Sec. 1033.421(h)(2);
or (3) the consumer has not provided a new authorization to the third
party after the maximum duration period, as described in proposed Sec.
1033.421(b)(2).
Jointly Held Accounts (Sec. 1033.331(d))
The CFPB is proposing to identify a data provider's obligation to
make covered data available upon request where a consumer jointly holds
an account. Proposed Sec. 1033.331(d) would require a data provider
that receives a request for covered data from a consumer that jointly
holds an account or from an authorized third party acting on behalf of
such a consumer to provide covered data to that consumer or authorized
third party. This provision would not affect data providers' existing
obligations to provide information directly to consumers under other
Federal consumer financial laws, such as EFTA, the Truth in Savings Act
(TISA),\103\ and TILA, and their implementing regulations. Those
regulations generally permit data providers to satisfy the relevant
information disclosure requirements by providing the information to any
one of the consumers on the account.\104\ The CFPB seeks comment on
whether other account holders should receive authorization disclosures
or otherwise be notified, or should have an opportunity to object, when
an account holder authorizes access to consumer information. The CFPB
also seeks comment on whether the rule should specifically address
whether authorized users of credit cards should have similar access,
even if they are not a joint holder of the credit card account.
---------------------------------------------------------------------------
\103\ 12 U.S.C. 4301 et seq.
\104\ See 12 CFR 1005.4(c), 1030.3(d), 1026.5(d).
---------------------------------------------------------------------------
Data Provider Revocation (Sec. 1033.331(e))
The CFPB is proposing to permit a data provider to make available
to the consumer a reasonable method by which the consumer may revoke
any third party's authorization to access all of the consumer's covered
data. Under proposed Sec. 1033.331(e), to be reasonable, the
revocation method must, at a minimum, be unlikely to interfere with,
prevent, or materially discourage consumers' access to or use of the
data, including access to and use of the data by an authorized third
party. Indicia that the data provider's revocation method is reasonable
would include its conformance to a qualified industry standard.
Finally, a data provider that receives a revocation request from
consumers through a revocation method it makes available must notify
the authorized third party of the request.
This proposed provision--along with proposed Sec. 1033.421(h),
under which third parties must make available to consumers a mechanism
by which consumers may revoke third party authorization--is intended to
ensure consumers have multiple outlets and methods by which they may
revoke third party authorization to access their data. The CFPB has
preliminarily determined that requiring data providers to make
available a revocation method may create a burden on smaller entities.
The CFPB seeks to balance these competing considerations through a
proposed rule that allows, but does not require, data providers to make
available a revocation method.
The SBREFA Panel recommended the CFPB consider options that would
allow consumers to revoke third party authorizations through both the
third party and data providers.\105\ The SBREFA Panel also recommended
the CFPB continue to consider how revocation requirements could be
designed to reduce impacts on third parties and data providers.\106\
---------------------------------------------------------------------------
\105\ SBREFA Panel Report at 44.
\106\ Id. at 45.
---------------------------------------------------------------------------
Additionally, various stakeholders expressed concerns about
anticompetitive activities related to data providers making a
revocation method
[[Page 74825]]
available to consumers. As such, proposed Sec. 1033.331(e) would
permit data providers to make available a method for revoking a third
party's access to ``all of the consumer's covered data.'' Proposed
Sec. 1033.331(e) would not permit a data provider to make available a
method through which the consumer could partially revoke a third
party's access to the consumer's data, i.e., revoke access to some of
the data the consumer had authorized the third party to access, but not
other data it had authorized under the terms of the same authorization.
For example, if the consumer consented in the initial authorization to
share their deposit account and credit card data with a third party,
the data provider could not make available a revocation method through
which the consumer could revoke access to the deposit account but not
the credit card account. Such a revocation method would be inconsistent
with proposed Sec. 1033.201(a), which would require data providers to
make covered data available upon request based on the terms of the
consumer's authorization. In addition, consumers who partially revoke
access to their data could unintentionally disrupt the utility of data
access for certain use cases.
To further account for anticompetitive concerns related to data
providers making available a revocation method, proposed Sec.
1033.331(e) includes a list of non-exhaustive requirements to ensure
the optional revocation method is reasonable, including the extent to
which it is unlikely to interfere with, prevent, or materially
discourage consumers' access to or use of the data, including access to
and use of the data by an authorized third party. As noted in part
IV.B.2, this language is drawn from the definition of ``information
blocking'' set forth in section 3022(a) of the Public Health Service
Act.\107\ The CFPB preliminarily has determined that this language
would promote consumers' ability to access and share their data by
ensuring data providers do not impose obstacles that evade their
obligations to make available covered data under section 1033.
---------------------------------------------------------------------------
\107\ See 42 U.S.C. 300jj-52(a).
---------------------------------------------------------------------------
Proposed Sec. 1033.331(e) also states that one indication that a
data provider's revocation method is reasonable is that it adheres to a
qualified industry standard. The CFPB seeks comment on whether the
final rule should impose any additional requirements to ensure the
optional revocation method is reasonable and does not result in
anticompetitive outcomes. The CFPB also seeks comment on types of
conduct that could interfere with, prevent, or materially discourage
access to or use of data, and whether the CFPB would need to provide
guidance related to that conduct.
The CFPB is also proposing to require a data provider that receives
a revocation request from a consumer to notify the authorized third
party of the request. A third party whose authorization to access data
is revoked by a consumer would need to understand that the consumer has
chosen to end their authorization, and that the data provider did not
terminate the access for another permitted reason. The CFPB seeks
comment on the implementation of this notification requirement,
including, in cases where an authorized third party uses a data
aggregator to access the authorized third party's access, to which
party or parties the data provider must provide the notice.
This proposed provision would implement CFPA section 1033(a) by
clarifying that a data provider does not violate its general
obligations to make data available if it provides to consumers a
reasonable revocation request. Materially interfering with a
consumer's, and therefore an authorized third party's, ability to
access the consumer's data would not carry out the objectives of CFPA
section 1033(a)'s requirement that data providers make covered data
available to a consumer upon request.
6. Public Disclosure Requirements (Sec. 1033.341)
To facilitate the ability of third parties to request covered data
through a developer interface, the CFPB is proposing procedures under
CFPA section 1033(a) and, for certain provisions discussed below, CFPA
section 1032, to require data providers to publish in a readily
identifiable manner certain information about themselves, including
identifying information, contact information, and information about
their developer interfaces. These provisions would carry out the
objectives of CFPA section 1033 by ensuring that consumers and
authorized third parties have information necessary to make requests
and use a developer interface, which would also promote the use and
development of standardized formats available through the developer
interface.
Public disclosure of this information would reduce search costs for
third parties by giving third parties a low-cost way of identifying how
to access a data provider's interface and would facilitate market
monitoring by the CFPB and members of the public. The public disclosure
of this information would also enable standard-setting bodies to
identify the data providers and third parties that are participating in
the open banking system, which could aid efforts by standard-setting
bodies to develop qualified industry standards related to consumer-
authorized access. The CFPB seeks comment on whether data providers
should have to disclose additional information beyond the information
outlined in proposed Sec. 1033.341. The CFPB also seeks comment on
whether data providers should have to periodically provide information
exclusively to the CFPB beyond the information it must make public, to
support the CFPB's mandate to monitor consumer financial markets for
risks to consumers; for example, the CFPB seeks comment on whether data
providers should be required to provide the CFPB with annual reports
listing the third parties that accessed their systems, the volume of
requests they received from such third parties, and copies of certain
records retained pursuant to proposed Sec. 1033.351(d), which contains
record retention obligations for data providers.
Public Disclosure and Human- and Machine-Readability Requirements
(Sec. 1033.341(a))
Proposed Sec. 1033.341(a) would require data providers to make the
information described in proposed Sec. 1033.341(b) through (d) readily
identifiable to members of the public, meaning the information must be
at least as available as it would be on a public website. A data
provider would comply with proposed Sec. 1033.341(a)(1) by making the
information available on a public website. A data provider would also
be permitted to make the information readily identifiable through some
other means, as long as the information is no less available than it
would be on a public website. Under proposed Sec. 1033.341(a)(2), this
information must be available in both human- and machine-readable
formats.
Making the data available in a machine-readable format could enable
third parties and other stakeholders to use automated processes to
ingest the relevant information into their systems for processing and
review, which would make the process of obtaining this information more
efficient. The CFPB seeks comment on whether it should indicate that
conformance to a specific standard or a qualified industry standard
would be relevant indicia for a data provider's compliance with the
machine-readability requirement in proposed Sec. 1033.341(a)(2).
Additionally,
[[Page 74826]]
the CFPB seeks comment on whether it should issue rules or guidance
that would make it easier for third parties and other members of the
public to identify a particular data provider's information. For
example, the CFPB could require that the information set forth in
proposed Sec. 1033.341(b) through (d) be made available on a public
website and could require the URL to contain specified text in
accordance with the ``well-known Uniform Resource Identifier''
protocol.
Disclosure of Identity Information and Contact Information (Sec.
1033.341(b))
Proposed Sec. 1033.341(b) would require data providers to disclose
certain identifying information in the manner described in proposed
Sec. 1033.341(a). Specifically, proposed Sec. 1033.341(b)(1) through
(3) would require data providers to publicly disclose certain
identifying information: their legal name and, if applicable, any
assumed name they are using when doing business with the consumer; a
link to their website; the State in which they are incorporated; and
their LEI. This information would help third parties confirm the
identity of a particular data provider whose interface it seeks to
access. It would also help third parties link the information disclosed
by data providers pursuant to proposed Sec. 1033.341 to a particular
data provider, particularly where data providers have similar names.
Proposed Sec. 1033.341(b)(4) would require data providers to
disclose contact information that enables a consumer or third party to
receive answers to questions about accessing covered data under this
proposed rule. The CFPB understands that, in the market today, third
parties sometimes encounter challenges with accessing data providers'
interfaces for consumer-authorized data access. Requiring data
providers to disclose this kind of contact information would make it
easier for third parties and data providers to resolve such challenges.
Disclosure of Developer Interface Documentation and Access Location
(Sec. 1033.341(c))
The CFPB proposes to require in Sec. 1033.341(c) that a data
provider disclose for its developer interface, in the public and
readily identifiable manner described in proposed Sec. 1033.341(a),
documentation, including metadata describing all covered data and their
corresponding data fields, and other documentation sufficient for a
third party to access and use the interface. It is common practice
today for data providers that have built developer interfaces to
disclose such metadata and documentation for the interfaces. Where a
data provider would need to build (or enhance) its developer interface
to comply with the CFPB's proposed rule, a requirement to publicly
disclose the associated documentation and metadata would not materially
increase the data provider's cost. At the same time, public disclosure
of the information would substantially enhance the usability of the
interface.
The CFPB proposes to keep simple and high-level the proposed
requirement that data providers disclose their interfaces' metadata and
documentation, because, as noted, the industry practice of publishing
metadata and documentation for data providers' interfaces for third
parties is already common. Moreover, the specific formats of the data
fields that data providers make available through their interfaces for
third parties may continue to evolve, including through qualified
industry standards, such that a more detailed requirement could become
outdated.
Disclosure of Developer Interface Performance Metrics (Sec.
1033.341(d))
The CFPB proposes to require in Sec. 1033.341(d) that a data
provider disclose, in the public and readily identifiable manner
described in proposed Sec. 1033.341(a), the performance of its
developer interface for each month. Specifically, the CFPB proposes
that on or before the tenth calendar day of each month, the data
provider would disclose the percent of requests for covered data
received by its developer interface in the preceding calendar month for
which the interface provided a proper response, as defined in proposed
Sec. 1033.311(c)(1)(i). For example, the data provider would disclose
by September 10, 2025, the percent of requests for covered data
received by its developer interface in August 2025 for which the
interface provided a proper response.
Proposed Sec. 1033.311(c)(1)(i) would set forth the method for
calculating the response rate, which would be used for both the
substantive requirement and the disclosure requirement.
The CFPB proposes this requirement that a data provider publicly
disclose the monthly performance of its developer interface pursuant to
section 1032 of the CFPA, which authorizes the CFPB to prescribe
disclosures regarding the features of any consumer financial product or
service. Because CFPA section 1033(a) requires a data provider to make
data available to a consumer when the data ``concern[s] the consumer
financial product or service that the consumer obtained from [the data
provider],'' the CFPA section 1033(a) requirement that a data provider
make the data available to the consumer is itself a feature of the
consumer financial product or service that the data provider provided
to the consumer. Moreover, the CFPB's section 1032 authority under the
CFPA is not limited to disclosures to consumers individually; instead,
the section authorizes the CFPB to require disclosures to consumers
generally, as well as to potential consumers. Thus, pursuant to its
authority provided by CFPA section 1032, the CFPB is proposing in Sec.
1033.341(d) to require a data provider to disclose, in a public and
readily identifiable manner, the performance of its interface. The CFPB
seeks comment on whether it should require data providers to disclose
additional performance metrics, including those required to be
disclosed in other jurisdictions' open banking systems, such as the
volume of requests, the number of accounts and/or consumers with active
authorizations, uptime, planned and unplanned downtime, and response
time.\108\
---------------------------------------------------------------------------
\108\ See, e.g., Australia Consumer Data Standards, Reporting
Requirements, https://consumerdatastandardsaustralia.github.io/standards/#reporting-requirements (last visited Oct. 11, 2023); Open
Fin. Brazil, Dashboards--Registration and transactional data,
https://dashboard.openfinancebrasil.org.br/transactional-data/api-requests/evolution (last updated Sept. 15, 2023); Open Banking Ltd.,
MI Reporting Data API Specification, https://openbankinguk.github.io/mi-docs-pub/v3.1.10-aspsp/specification/mi-data-reporting-api-specification.html#_3-7-daily-volumes-obie (last
visited Oct. 11, 2023).
---------------------------------------------------------------------------
7. Policies and Procedures (Sec. 1033.351)
Reasonable Written Policies and Procedures (Sec. 1033.351(a))
Proposed Sec. 1033.351(a) would set forth the general obligation
that data providers establish and maintain written policies and
procedures that are reasonably designed to achieve the objectives set
forth in proposed subparts B and C, including proposed Sec.
1033.351(b) through (d). The CFPB proposes Sec. 1033.351(a) pursuant
to its authority provided by CFPA sections 1033(a) and 1022(b)(1). The
proposed policies and procedures in Sec. 1033.351(b) would carry out
the objectives of CFPA section 1033(a) to make available information
upon request by ensuring data providers are accountable for their
decisions to make available covered data in response to requests, and
in granting third parties access to the developer interface. The
proposed policies and procedures in Sec. 1033.351(c) would carry out
the objectives of CFPA section 1033(a) that data be made available in a
usable electronic form by ensuring developer interfaces accurately
[[Page 74827]]
transmit covered data. In addition, the CFPB is proposing recordkeeping
requirements under CFPA section 1022(b)(1) to facilitate supervision
and enforcement of the rule and to prevent evasion.
Proposed Sec. 1033.351(a) would further carry out these purposes
by requiring that data providers periodically review these policies and
procedures and update them as appropriate to ensure their continued
effectiveness. To minimize impacts on data providers, including
avoiding conflicts with any overlapping compliance obligations,
proposed Sec. 1033.351(a) would allow data providers to tailor these
policies and procedures to the size, nature, and complexity of their
activities.
Policies and Procedures for Making Covered Data Available and
Responding to Requests (Sec. 1033.351(b))
Proposed Sec. 1033.351(b) would require that the policies and
procedures required by proposed Sec. 1033.351(a) be reasonably
designed to create a record of the data fields made available according
to the covered data definition, ensure certain standards are met when
not making covered data available, ensure that the data provider
communicates certain information to the consumer or third party when
declining to provide certain covered data and to ensure reasonably
timely communication by the data provider to the consumer when
declining to provide certain information.
Making Covered Data Available (Sec. 1033.351(b)(1))
Proposed Sec. 1033.351(b)(1) would require a data provider to
create a record of the data fields that are covered data in the data
provider's control or possession. It would also require a data provider
to record what covered data are not made available through a consumer
or developer interface pursuant to an exception in Sec. 1033.221, and
the reason(s) the exception applies. A data provider is permitted to
comply with this requirement by incorporating the data fields defined
by a qualified industry standard, but exclusive reliance on data fields
defined by such a standard would not be appropriate if such data fields
failed to identify all the covered data in the data provider's control
or possession.
The CFPB is proposing these requirements to facilitate compliance
with and enforcement of the general obligation in proposed Sec.
1033.201. Documentation of the fields that are made available in
accordance with the covered data definition could help the CFPB
identify compliance gaps in what the data provider makes available,
streamline negotiations between data providers and third parties by
establishing the available data fields, and encourage the market to
adopt more consistent data sharing practices. Documentation of use of
the exceptions can help identify noncompliant use of the statutory
exceptions, while ensuring that data providers can continue to comply
with their risk management obligations by giving data providers
flexibility to design their own reasonable policies and procedures that
comply with the general framework outlined in the proposed rule. The
CFPB preliminarily concludes that allowing a data provider to cite data
fields defined by a qualified industry standard, to the extent that
standard identifies covered data in the data provider's control or
possession, could ease the compliance burden on data providers and
promote market standardization according to CFPA section 1033(d).
Denials of Requests for Developer Interface Access and Requests for
Information (Sec. 1033.351(b)(2) and (3))
Proposed Sec. 1033.351(b)(2) would require a data provider to
design its policies and procedures reasonably to ensure that any
decision to deny a third party's request for access to a developer
interface pursuant to proposed Sec. 1033.321 is substantiated in a
record and communicated to the third party, as quickly as practicable,
in an electronic or written form with the basis for denial. Proposed
Sec. 1033.351(b)(3) would require a data provider to design its
policies and procedures reasonably to ensure that any decision to deny
a consumer or third party's request for information is substantiated in
a record and communicated to the consumer or authorized third party in
a written or electronic form with the type(s) of information denied and
the basis for the denial, and communicated as quickly as practicable.
These provisions generally would enable consumers and third parties to
understand reasons for denials in a timely manner, and reduce the
potential for pretextual denials. These provisions would carry out the
objectives of CFPA section 1033 by enabling consumers and prospective
authorized third parties to understand and satisfy data provider
conditions necessary to make requests. And, as authorized under section
1022(b)(1) of the CFPA, these provisions also would prevent evasion by
ensuring data providers do not avoid their obligations under CFPA
section 1033 by denying developer interface access or information
requests for unstated impermissible reasons.
Under the proposed rule, permissible bases for a decision to deny
access to an interface would include the following: the information
requested is not covered data, the information requested is not in the
data provider's control or possession, the information requested falls
into one of the exceptions outlined in proposed Sec. 1033.221, the
request does not satisfy the conditions for access under proposed Sec.
1033.331, the data provider is reasonably denying access based on risk
management concerns for reasons described in proposed Sec. 1033.321,
or the data provider's interface is not available when received a
request, as described in proposed Sec. 1033.331(c)(3).
The provisions would give data providers flexibility to comply with
their data security or risk management obligations--a concern
identified by small entity representatives during the SBREFA process.
For example, in some cases a data provider might deny a third party's
request for interface access because of a specific risk management
issue under Sec. 1033.321. The CFPB understands that in limited cases,
the disclosure of the specific reason for a denial might present
additional risk management concerns. The proposed rule would give data
providers flexibility to design policies and procedures to reasonably
account for such issues. The CFPB requests comment on whether the final
rule should provide examples or further clarify how data providers
could reasonably design policies and procedures to account for data
security or risk management concerns.
Policies and Procedures for Ensuring Accuracy (Sec. 1033.351(c))
Proposed Sec. 1033.351(c) would require data providers to
establish and maintain policies and procedures reasonably designed to
ensure the accuracy of covered data made available through the data
provider's developer interface. The proposed rule also lists elements
that data providers would need to consider when designing their
policies and procedures. Proposed Sec. 1033.351(c) would be authorized
under CFPA section 1033(a) for the reasons stated above in the
discussion of proposed Sec. 1033.351(a) as well as under CFPA section
1033(d). Policies and procedures for accuracy would promote the use and
development of standardized formats by ensuring data providers are
taking reasonable measures to share covered data in standardized
formats.
As discussed in part I.D, one of the goals of the proposed rule is
to foster a data access framework that operates reliably. The accurate
transfer of
[[Page 74828]]
consumer financial data is important to the operation of an open
banking system and to consumers' ability to benefit from the data
access right in CFPA section 1033. If data providers fail to reliably
transfer data that accurately reflects the information they possess in
their systems, then third parties will struggle to develop innovative,
or even functional, financial products and services. And consumers will
face difficulty finding any benefit from sharing their data with
competing financial service providers. For these reasons, proposed
Sec. 1033.351(c)(1) would require data providers to establish and
maintain written policies and procedures that are reasonably designed
to ensure that covered data are accurately made available through the
data provider's developer interface.
The CFPB has preliminarily determined that a data provider's
policies and procedures should focus on the accuracy of transmission
rather than the underlying accuracy of the information in the data
provider's systems. That is, the policies and procedures should be
designed to ensure that the covered data that a data provider makes
available through its developer interface matches the information that
it possesses in its systems. The information stored in data providers'
existing systems is likely subject to several legal requirements
regarding accuracy. For example, Regulation E protects consumers
against errors, and Regulation Z protects consumers against billing
errors.\109\ In addition, the Interagency Guidelines Establishing
Standards for Safety and Soundness require operational and managerial
standards for information systems.\110\ Additionally, many small entity
representatives and other stakeholders commenting on the SBREFA Outline
cited the transfer of data from data providers to third parties as a
source of inaccuracies. Many transfer issues will be addressed by the
performance specifications for a data provider's developer interface in
proposed Sec. 1033.311(c), but policies and procedures specifically
concerning accuracy would help prevent errors not addressed by the
other proposed performance standards, as discussed below.
---------------------------------------------------------------------------
\109\ See 12 CFR part 1005; 12 CFR 1026.13.
\110\ See, e.g., 12 CFR part 208, app. D-1.
---------------------------------------------------------------------------
The flexible standard proposed would allow data providers to design
systems that are better adapted to the context of their developer
interface, including changes in technology and the size, nature, and
complexity of the data provider's activities. It would also allow data
providers to leverage any knowledge developed through designing or
administering systems for ensuring the accuracy of financial
information under existing accuracy standards. Many of the other
regulations governing the accuracy of similar financial information on
data providers' systems incorporate flexible standards.
Proposed Sec. 1033.351(c)(2) provides two elements for data
providers to consider when developing their policies and procedures
regarding accuracy: (1) implementing the format requirements of
proposed Sec. 1033.311(b); and (2) addressing information provided by
a consumer or a third party regarding inaccuracies in the covered data
made available through its developer interface. Although reasonable
policies and procedures would address many elements, the two identified
in the proposed rule seem especially relevant to an assessment of
whether a data provider's policies and procedures are reasonable.
Implementing the proposed formatting requirements would help prevent
inaccuracies that might be introduced by translating covered data
between various unstandardized formats. And addressing information from
a consumer or third party is relevant to the reasonableness of a data
provider's policies and procedures because these parties are likely to
know whether information has been accurately transferred to the
products or services they are using or providing. These elements should
help data providers design their policies and procedures without
negating the flexibility described above, because the implementation of
each element will depend on context. For example, in considering
information submitted by a consumer or third party, a data provider
might create certain policies regarding irrelevant or duplicative
requests, or certain policies regarding which requests require further
communication with the consumer or third party.
Proposed Sec. 1033.351(c)(3) states that indicia that a data
provider's policies and procedures regarding accuracy are reasonable
include whether they conform to a qualified industry standard regarding
accuracy. A qualified industry standard regarding accuracy is relevant
to the reasonableness of a data provider's policies and procedures
because it reflects the openness, balance, consensus, transparency, and
other requirements of proposed Sec. 1033.141.
The CFPB seeks comment on whether the final rule should include
additional elements bearing on the reasonableness of a third party's
policies and procedures regarding accuracy.
Policies and Procedures for Record Retention (Sec. 1033.351(d))
Proposed Sec. 1033.351(d) would require that data providers
establish and maintain policies and procedures reasonably designed to
ensure retention of records that evidence compliance with their
obligations under proposed subparts B and C. This provision would
clarify the policies and procedures data providers must maintain to
ensure the CFPB and other enforcers can verify compliance with the
proposed rule. The specific requirements proposed in Sec. 1033.351(d)
would facilitate supervision and enforcement of the proposed rule by
the CFPB, Federal and State banking regulators, State attorneys
general, and other government agencies that supervise data providers.
The CFPB has preliminarily determined the proposed retention
periods in Sec. 1033.351(d)(1), beginning once the data provider makes
the data available to the consumer or third party under CFPA section
1033(a), will provide a sufficient amount of time to supervise whether
the data was made available while not unduly burdening data providers.
Additionally, the proposed requirement to retain records for a minimum
of three years after a data provider has responded to a consumer's or
third party's request for information or a third party's request to
access a developer interface would provide sufficient time to
administer enforcement of proposed subparts B and C. All other records
that are evidence of compliance with the proposed rule would need to be
retained for a reasonable period of time. The CFPB requests comment on
proposed Sec. 1033.351(d) regarding the length of the retention period
and the date from which the retention obligation should be measured.
Proposed Sec. 1033.351(d) would provide flexibility to data
providers by establishing a minimum retention period and by not
exhaustively specifying categories of records. The proposed
requirements are unique to CFPA section 1033 and provide data providers
with flexibility to craft policies and procedures that are appropriate
to the ``size, nature, and complexity'' of the individual data
provider's activities, as required by proposed Sec. 1033.351(a),
rather than the policies and procedures that are appropriate to the
industry at large. Further, this flexibility would help data providers
avoid conflicts with other legal obligations (including record
retention and data security obligations), manage data security risks,
and minimize unnecessary impacts. To
[[Page 74829]]
mitigate the risk that this flexibility might result in the absence of
critical evidence of compliance, proposed Sec. 1033.351(d)(2) would
identify particular examples records that would need to be retained.
The CFPB requests comment as to the types of records that should be
retained to evidence compliance. This approach would be consistent with
the SBREFA Panel's recommendation that the CFPB evaluate record
retention requirements for consistency with other requirements and the
avoidance of unnecessary data security risks.\111\
---------------------------------------------------------------------------
\111\ SBREFA Panel Report at 45.
---------------------------------------------------------------------------
CFPA section 1022(b)(1) authorizes the CFPB to prescribe rules as
may be necessary or appropriate to enable the CFPB to administer and
carry out the purposes and objectives of the Federal consumer financial
laws, including carrying out the objectives of CFPA section 1033, and
to prevent evasions thereof. Proposed Sec. 1033.351(d) would assist
the CFPB with administering CFPA section 1033 by ensuring records are
available to evaluate compliance with data providers' obligations under
the proposed rule. Additionally, such requirements will also help data
providers in assessing their own compliance with the requirements of
CFPA section 1033. Further, the requirement proposed in Sec.
1033.351(d) for data providers to establish and maintain policies and
procedures to retain records of all evidence of compliance with the
applicable requirements in the proposed rule would make it more
difficult for data providers to evade the requirements of CFPA section
1033. Consequently, proposed Sec. 1033.351(d) would both allow the
CFPB and other entities with CFPA enforcement authority to enforce CFPA
section 1033, and discourage evasion by data providers, thus meeting
both requirements for CFPA section 1022(b)(1) authorization.
CFPA section 1033(c) provides that ``[n]othing in [CFPA section
1033] shall be construed to impose any duty on a covered person to
maintain or keep any information about a consumer.'' The CFPB has
preliminarily determined that proposed Sec. 1033.351(d) is consistent
with CFPA section 1033(c) because CFPA section 1033(c) merely provides
that a covered person is not required to maintain or keep additional
information on a consumer and is silent as to record retention relating
to compliance with CFPA section 1033 itself. Thus, the statute neither
precludes the CFPB from adopting retention requirements nor overrides
other authorities at the CFPB's disposal to impose reasonable record
retention obligations. Accordingly, because the authority for proposed
Sec. 1033.351(d) arises from CFPA section 1022(b)(1) and is necessary
for the CFPB and others with enforcement authority to verify data
provider's compliance with CFPA section 1033, the CFPB is authorized to
require data providers to establish and maintain policies and
procedures to ensure the retention of records that evidence compliance
with their obligations under proposed subparts B and C.
D. Subpart D--Authorized Third Parties
1. Overview
The CFPB is proposing authorization procedures for third parties
seeking to access covered data on consumers' behalf. Section 1033(a) of
the CFPA generally requires data providers to make information
available to a consumer and agents, trustees, or representatives acting
on their behalf. The proposed authorization procedures are designed to
ensure that third parties accessing covered data are acting on behalf
of the consumer. Specifically, the proposed authorization procedures
would include requirements to provide an authorization disclosure to
inform the consumer of key terms of access, certify to the consumer
that the third party will abide by certain obligations regarding the
consumer's data, and obtain the consumer's express informed consent to
the key terms of access contained in the authorization disclosure. The
CFPB is proposing specific requirements that would apply when the third
party is using a data aggregator. Proposed subpart D would also contain
requirements relating to retention of evidence of compliance with
proposed subpart D.
2. Third Party Authorization Procedures (Sec. 1033.401)
The CFPB is proposing that a third party acting on behalf of a
consumer would be able to access covered data. Proposed Sec.
1033.201(a) provides that a data provider must make covered data
available to a consumer and an authorized third party, and proposed
Sec. 1033.401 specifies what requirements a third party must satisfy
to become an authorized third party that is entitled to access covered
data on behalf of a consumer. These requirements would, among other
things, help ensure that a consumer understands and would be able to
exercise control over what covered data the third party would collect
and how it would be used. They would also help ensure that the third
party will take appropriate steps to protect the consumer's data and
that the consumer will provide express informed consent for the third
party to collect, use, and retain the covered data. These requirements
would help ensure that a third party accessing covered data is doing so
on behalf of a consumer and not for the third party's own benefit,
consistent with the definition of consumer in CFPA section 1002(4) and
used in section 1033.
The CFPB is proposing in Sec. 1033.401 that, to become an
authorized third party, the third party must seek access to covered
data from a data provider on behalf of a consumer to provide a product
or service the consumer requested. This requirement is intended to
ensure that the third party is acting on behalf of the consumer--by
accessing covered data to provide the product or service requested by
the consumer--and is not seeking access to covered data for its own
purposes.
The CFPB is also proposing in Sec. 1033.401 that a third party
would have to satisfy the prescribed authorization procedures to become
an authorized third party. Under proposed Sec. 1033.401, the three-
part authorization procedures would require a third party to: (1)
provide the consumer with an authorization disclosure as described in
proposed Sec. 1033.411; (2) provide a statement to the consumer in the
authorization disclosure certifying that the third party agrees to
certain obligations described in proposed Sec. 1033.421; and (3)
obtain the consumer's express informed consent to access covered data
on behalf of the consumer by obtaining an authorization disclosure that
is signed by the consumer electronically or in writing.
The proposed requirement in Sec. 1033.401(a) that a third party
provide an authorization disclosure to the consumer would help ensure
that the consumer understands the key terms of access and can make an
informed decision about whether to grant the third party access to the
consumer's financial data. The proposed authorization disclosure is
discussed in more detail below.
The proposed requirement in Sec. 1033.401(b) that a third party
provide a statement to the consumer certifying that the third party
will comply with certain obligations would help ensure that the third
party is acting on behalf of the consumer in accessing the covered
data. As noted below, proposed Sec. 1033.411(b)(5) would require the
third party to include the certification statement in the authorization
disclosure. Among other things, the third party would agree that it
will comply with limitations on collection, use, and retention of the
consumer's
[[Page 74830]]
data; comply with certain data privacy restrictions; take certain steps
to ensure data accuracy and security; and take certain steps to ensure
consumers are informed about the third party's access to covered data
and the consumer's ability to revoke that access. These proposed third
party obligations are set forth in proposed Sec. 1033.421 and are
discussed in more detail below.
The proposed requirement in Sec. 1033.401(c) that the third party
obtain the consumer's express informed consent to access covered data
would ensure that the consumer has agreed to allow the third party to
access that data on the consumer's behalf. Proposed Sec. 1033.401(c)
specifies that, to obtain express informed consent, the third party
must obtain an authorization disclosure that is signed by the consumer
electronically or in writing. Proposed Sec. 1033.421(g)(1) would
require the third party to provide the consumer with a copy of the
signed authorization disclosure.
The SBREFA Panel recommended that the CFPB consider how to design
authorization procedures that minimize costs on third parties while
still achieving the CFPB's objective of helping to ensure that
consumers provide express informed consent when authorizing third
parties to access their information.\112\ In the proposed rule, the
CFPB has attempted to balance these considerations in developing the
proposed authorization procedures. The SBREFA Panel also recommended
that the CFPB consider how the third party authorization procedures
interact with data providers' obligations to make information
available.\113\ As explained above, proposed Sec. 1033.331(b) provides
the circumstances in which a data provider would be required to make
available covered data to a third party, including when it has received
information sufficient to, among other things, confirm that the third
party has followed the authorization procedures in proposed Sec.
1033.401.
---------------------------------------------------------------------------
\112\ Id. at 44.
\113\ Id. at 43.
---------------------------------------------------------------------------
In addition, the SBREFA Panel recommended that the CFPB consider
how the third party authorization procedures would work in the context
of accounts with multiple owners. As discussed above in connection with
proposed Sec. 1033.331(d), the CFPB is proposing that a data provider
that receives a request for covered data from a consumer that jointly
holds an account or from an authorized third party acting on behalf of
such a consumer must provide covered data to that consumer or
authorized third party. Consistent with that proposed approach, for a
jointly held account, a third party would have to comply with the third
party authorization procedures in proposed Sec. 1033.401 for the joint
account holder on whose behalf the third party is requesting access.
The CFPB requests comment on whether other account holders should
receive authorization disclosures or otherwise be notified, or should
have an opportunity to object, when an account holder authorizes a
third party to access covered data from a jointly held account.
The CFPB requests comment on whether the authorization procedures
in proposed Sec. 1033.401 would be sufficient to ensure that a third
party is acting on behalf of a consumer in obtaining access to covered
data or whether the CFPB should consider alternative procedures. The
CFPB also requests comment on whether the authorization disclosure,
including the statement that the third party will comply with certain
third party obligations, is sufficient to ensure that the consumer
would be able provide express informed consent for the third party to
access covered data on behalf of the consumer. The CFPB requests
comment on whether the rule should include other protections or
clarifications, such as express prohibitions on false or misleading
representations or omissions to induce the consumer to consent to the
third party's access to covered data.
Additionally, proposed Sec. 1033.401 would apply a consistent set
of procedures to all third parties attempting to access covered data.
The CFPB understands, however, that the proposed authorization
procedures might not be appropriate for some third parties,
particularly smaller or non-commercial parties, that might need access
to a consumer's covered data. The CFPB requests comment about whether
there are certain third parties for whom proposed Sec. 1033.401 would
not be appropriate. Additionally, the CFPB requests comment about
whether the proposed authorization procedures described in proposed
Sec. 1033.401 should be streamlined for certain third parties. The
CFPB also requests comment on whether there are certain circumstances
involving the transmission of data to third parties for which proposed
Sec. 1033.401 would not be appropriate. Finally, to help the CFPB
assess the need for potential exemptions to proposed Sec. 1033.401,
the CFPB requests comment on how individuals who are not account owners
currently use existing legal mechanisms to directly access covered
data.
3. Authorization Disclosure (Sec. 1033.411)
The CFPB is proposing that third parties would be required to
provide consumers with authorization disclosures, as described in
proposed Sec. 1033.401, to be authorized to access covered data on
behalf of consumers. The purpose of the authorization disclosure is to
provide consumers with key terms of access so they can make informed
decisions about granting third party access to covered data and to
therefore ensure that third parties are acting on behalf of consumers.
Consistent with the SBREFA Panel recommendation that the CFPB consider
how it can reduce compliance costs for third parties in providing the
authorization disclosure by further specifying the content and
formatting principles of the disclosure, proposed Sec. 1033.411
specifies format and content requirements for the authorization
disclosure.\114\
---------------------------------------------------------------------------
\114\ Id.
---------------------------------------------------------------------------
General Requirements (Sec. 1033.411(a))
Proposed Sec. 1033.411(a) would require the third party to provide
the consumer with an authorization disclosure electronically or in
writing. Proposed Sec. 1033.411(a) also sets forth the general format
requirements for the authorization disclosure. Specifically, the CFPB
is proposing that the authorization disclosure must be clear,
conspicuous, and segregated from other material. The proposed
provisions would help ensure the authorization disclosure is provided
in a format that facilitates consumer understanding of the key terms of
access. The CFPB has preliminarily determined that these requirements,
which are consistent with standards used in other consumer financial
services laws and their implementing regulations,\115\ would facilitate
consumer understanding of the authorization disclosure. The CFPB
considered how to facilitate compliance with existing disclosure
requirements, such as disclosures required by Regulation P of the GLBA,
as recommended by the SBREFA Panel.\116\ The CFPB has preliminarily
determined that requiring the authorization
[[Page 74831]]
disclosure to appear segregated from other required disclosures would
help ensure consumers read and understand the authorization disclosure
by avoiding overwhelming consumers with extraneous information and
diluting the informational value of the authorization disclosure.
---------------------------------------------------------------------------
\115\ For example, Regulation F requires notices for validation
of debts to be clear and conspicuous, which it defines as ``readily
understandable'' and ``[i]n the case of written and electronic
disclosures, the location and type size also must be readily
noticeable and legible to consumers, although no minimum type size
is mandated.'' 12 CFR 1006.34(b)(1); Regulation Z requires both
open-end credit and closed-end credit disclosures to be clear and
conspicuous, and it requires closed-end credit disclosures to
grouped together and segregated from everything else. 12 CFR
1026.5(a)(1)(i), 1026.17(a)(1).
\116\ SBREFA Panel Report at 43.
---------------------------------------------------------------------------
The CFPB seeks comment on whether these formatting requirements
would aid consumer understanding and whether additional requirements
should be included in the rule. Specifically, the CFPB seeks comment on
whether the rule should contain more prescriptive requirements, such as
a word count or reading level, and whether additional requirements are
needed to ensure that the authorization disclosure content is provided
in a standalone format. The CFPB also seeks comment on whether the rule
should include a timing requirement, such as a requirement that the
authorization disclosure be provided close in time to when the third
party would need consumer data to provide the product or service.
Additionally, the CFPB seeks comment on whether indicia that the
authorization disclosure is clear, conspicuous, and segregated from
other material should include utilizing a format or sample form that is
set forth in a qualified industry standard.
The CFPB considered proposing specific guidance for accessibility
of the authorization disclosure for individuals with disabilities but
preliminarily determined that the Americans with Disabilities Act (ADA)
and its implementing regulations would already require that the
authorization disclosure be provided in an accessible format.\117\ The
CFPB seeks comment on whether the rule should contain requirements
relating to the accessibility of the authorization disclosure.
---------------------------------------------------------------------------
\117\ See 42 U.S.C. 12132, 12182(a); 28 CFR 35.130, 35.160(a),
36.201, 36.303(c).
---------------------------------------------------------------------------
Authorization Disclosure Content (Sec. 1033.411(b))
Proposed Sec. 1033.411(b) would require inclusion of the following
key terms of access in the authorization disclosure: (1) the name of
the third party that will be authorized to access covered data pursuant
to the third party authorization procedures in proposed Sec. 1033.401;
(2) the name of the data provider that controls or possesses the
covered data that the third party seeks to access on the consumer's
behalf; (3) a brief description of the product or service that the
consumer has requested the third party provide and a statement that the
third party will collect, use, and retain the consumer's data only for
the purpose of providing that product or service to the consumer; (4)
the categories of covered data that will be accessed; (5) the
certification statement described in proposed Sec. 1033.401(b); and
(6) a description of the revocation mechanism described in proposed
Sec. 1033.421(h)(1). In addition to the authorization disclosure
content requirements in proposed Sec. 1033.411(b), proposed Sec.
1033.431(b) would require the authorization disclosure to include the
name of any data aggregator that will assist the third party with
accessing covered data and a brief description of the services the data
aggregator will provide.
In proposing content requirements for the authorization disclosure,
the CFPB aims to strike a balance between providing consumers with
sufficient information to enable informed consent to data access and
keeping the disclosure short to increase the likelihood that consumers
will read and understand it. The CFPB preliminarily concludes that the
proposed requirements would be important for consumers to understand
the terms of data access and would help ensure that third parties
accessing covered data are acting on behalf of consumers by enabling
informed consent.
The CFPB seeks comment on any obstacles to including the proposed
authorization disclosure content and on whether additional content is
needed to ensure consumers have enough information to provide informed
consent. Specifically, the CFPB seeks comment on whether the rule
should include any additional requirements to ensure: (1) the consumer
can identify the third party and data aggregator, such as by requiring
inclusion of legal names, trade names, or both; (2) the description of
the consumer's requested product or service is narrowly tailored and
specific such that it accurately describes the particular product or
service that the consumer has requested; (3) the consumer can locate
the third party obligations, such as by requiring a link to the text of
proposed Sec. 1033.421; and (4) the consumer can readily understand
what types of data will be accessed, such as by requiring third parties
to refer to the covered data they will access using the categories in
proposed Sec. 1033.211. The CFPB also seeks comment on alternative
disclosures that would achieve the CFPB's objective, and on whether the
authorization disclosure should include additional content such as the
names of other parties with whom data may be shared, the third party's
contact information, or how frequently data will be collected from the
consumer's account(s).
Language Access (Sec. 1033.411(c))
Proposed Sec. 1033.411(c)(1) would require the authorization
disclosure to be in the same language as the communication in which the
third party conveys the authorization disclosure to the consumer and
would require any translation of the authorization disclosure to be
complete and accurate. Under proposed Sec. 1033.411(c)(2), if the
authorization disclosure is in a language other than English, it would
be required to include a link to an English-language translation and
would be permitted to include links to translations in other languages.
Additionally, if the authorization disclosure is in English, it would
be permitted to include links to translations in other languages.
Consumers with limited English proficiency may benefit from
receiving a complete and accurate translation of the authorization
disclosure, and some third parties may want to respond to the needs of
consumers with limited English proficiency using translated
disclosures. At the same time, the CFPB has preliminarily determined
that requiring third parties to identify such consumers and provide
complete and accurate translations in the myriad languages that
consumers speak may impose a significant burden on third parties.
Accordingly, proposed Sec. 1033.411(c)(1) would require the
authorization disclosure to be in the same language as the
communication in which the third party conveys the authorization
disclosure to the consumer, and proposed Sec. 1033.411(c)(2) would
permit, but not require, the authorization disclosure to include links
to translations of the authorization disclosure in languages other than
English.
Some consumers who receive translated disclosures may also want to
receive English-language disclosures, either because they are fluent in
English, or because they wish to share the disclosures with an English-
speaking family member or assistance provider. English-language
disclosures may also allow consumers to confirm the accuracy of the
translation. For these reasons, proposed Sec. 1033.411(c)(2) would
require that an authorization disclosure in a language other than
English include a link to an English-language translation.
The CFPB seeks comment on whether the proposed language access
provisions would adequately decrease the risk that consumers with
limited English proficiency may be given information in a manner that
impedes informed consent while not imposing unduly burdensome
requirements on third
[[Page 74832]]
parties. The CFPB also seeks comment on whether the rule should include
any requirements regarding consistency of the language of the
authorization disclosure and other communications related to the
product or service provided by the third party, and whether the rule
should clarify how language access requirements apply if the consumer
has not engaged with the third party electronically.
4. Third Party Obligations (Sec. 1033.421)
Proposed Sec. 1033.421 would describe the obligations to which
third parties must certify to be authorized to access covered data. The
CFPB is proposing these certification requirements to ensure that third
parties accessing covered data are acting on behalf of the consumer.
The proposal would require third parties to certify to limit their
collection, use, and retention of covered data, including limiting the
duration and frequency of collection and the provision of data to other
third parties, to what is reasonably necessary to provide the
consumer's requested product or service. Under proposed Sec. 1033.421,
third parties would certify to a maximum duration of collection of one
year after the consumer's authorization unless the consumer
reauthorizes the third party's access. Third parties would also be
required to certify to provide consumers a simple way to revoke access,
to maintain certain accuracy and data security obligations, and to
ensure consumers have access to information about the third party's
authorization to access data. Proposed Sec. 1033.421 would also
require a certification related to providing covered data to another
third party and would provide requirements that apply when the third
party is using a data aggregator.
General Standard To Limit Collection, Use, and Retention (Sec.
1033.421(a))
Under proposed Sec. 1033.421(a)(1), third parties would be
required to limit collection, use, and retention of covered data to
what is reasonably necessary to provide the consumer's requested
product or service. Proposed Sec. 1033.421(a)(2) would provide that,
for purposes of the limitation in Sec. 1033.421(a)(1), certain
activities are not part of, or reasonably necessary to provide, any
other product or service. Under the proposal, third parties would seek
and obtain consumer authorization to access covered data only as
reasonably necessary for the provision of the product or service that
the consumer requested, and not for uses that are secondary to that
purpose.
In the SBREFA Outline, the CFPB stated that it was considering
proposing that third parties limit collection, use, and retention of
covered data to what is reasonably necessary to provide the consumer's
requested product or service.\118\ The SBREFA Panel recommended the
CFPB consider options for collection, use, and retention that do not
unnecessarily restrict third parties' ability to provide consumers with
requested products or services.\119\ The SBREFA Outline also requested
feedback on potential approaches to specifically limit third parties'
use of covered data.\120\ One option would not have permitted third
parties to use covered data for purposes not reasonably necessary to
provide the consumer's requested product or service (secondary
use).\121\ Other options would have allowed third parties to ask
consumers to opt in to or opt out of secondary uses, including an
approach that would not have permitted third parties to ask consumers
to opt in to certain ``high-risk'' secondary uses.\122\ The SBREFA
Panel recommended that the CFPB consider where it can give flexibility
to third parties while still achieving its consumer protection
objectives.\123\
---------------------------------------------------------------------------
\118\ SBREFA Outline at 41.
\119\ SBREFA Panel Report at 44.
\120\ SBREFA Outline at 43.
\121\ Id.
\122\ Id.
\123\ SBREFA Panel Report at 45.
---------------------------------------------------------------------------
The proposed limit on collection, use, and retention in Sec.
1033.421(a) is designed to ensure that, consistent with carrying out
the objectives of CFPA section 1033, third parties accessing covered
data are acting on behalf of consumers, thereby ensuring that their
collection, use, and retention of covered data proceeds in alignment
with consumer control and truly informed consent. Specifically, the
proposal is aimed at ensuring that third parties access covered data
for the consumer's benefit, that consumers retain meaningful control
over their data when authorizing third party access to that data, and
that consumers are best-positioned to understand the scope of that
authorization and not reluctantly acquiescing to data collection, use,
and retention that they do not want. Further, the CFPB notes that
covered data that third parties would collect, use, and retain pursuant
to consumer authorization includes sensitive financial data that might
expose consumers to fraud or identity theft if it were exposed.\124\
The proposed limitation in Sec. 1033.421(a) is designed to ensure that
third parties act on behalf of consumers when accessing that sensitive
data. For the reasons described below, the CFPB preliminarily concludes
that proposed Sec. 1033.421(a), including the proposal to prohibit
secondary uses of covered data, would appropriately ensure that third
parties accessing covered data are acting on behalf of consumers, while
providing sufficient flexibility to third parties to provide consumers
with their requested products or services.
---------------------------------------------------------------------------
\124\ These sensitive data also could impact persons or entities
besides the consumer from whom they are sourced, especially when
collected, used, and retained in large amounts, such as where the
data are matched with other consumer data sets.
---------------------------------------------------------------------------
The CFPB seeks comment on whether there are technology-based
solutions that could apply the appropriate proposed third party
requirements automatically. For example, the CFPB seeks comment on
whether such solutions are available that could assist third parties
with automatically terminating access after the third party's
authorization has ended or with limiting the use of covered data
consistent with the limitation described in proposed Sec. 1033.421(a).
If such solutions are available, the CFPB requests comment on whether
to require third parties to integrate these capabilities.
Reasonably Necessary
Proposed Sec. 1033.421(a)(1) would provide that third parties must
limit collection, use, and retention of covered data to what is
reasonably necessary to provide the consumer's requested product or
service. The ``reasonably necessary'' standard in proposed Sec.
1033.421(a)(1) is similar to standards in several data privacy
frameworks that minimize third parties' collection, use, and retention
of data.\125\ The proposed ``reasonably necessary'' standard is
designed to ensure that the consumer is the primary beneficiary of any
authorized data access, and that accordingly the resulting collection,
use and retention of data proceeds in alignment with true consumer
control and informed consent.
---------------------------------------------------------------------------
\125\ See, e.g., Competition and Consumer (Consumer Data Right)
Rules 2020 div. 1.3 (Austl.) (minimizing consumer data requests to
what is ``reasonably needed''); Reg. 2016/679, art. 5(1)(c), 2016
O.J. (L 119) 7 (EU) (``Personal data shall be . . . limited to what
is necessary in relation to the purposes for which they are
processed.''); Colo. Rev. Stat. section 6-1-1308(4) (2021) (``A
controller shall not process personal data for purposes that are not
reasonably necessary to or compatible with the specified purposes
for which the personal data are processed, unless the controller
first obtains the consumer's consent.'')
---------------------------------------------------------------------------
Congress intended that, through CFPA section 1033, the consumer
would have the right to access their covered data for their own
benefit. As a representative acting on behalf of the consumer, a third
[[Page 74833]]
party authorized to access the consumer's covered data must ensure that
the consumer is the primary beneficiary of such access. Third parties
can benefit from access as well, but only by collecting, using and
retaining data as reasonably necessary for the primary purpose for
which the consumer entered the market. The CFPB preliminarily concludes
that collection, use, or retention of covered data beyond what is
reasonably necessary to provide the consumer's requested product or
service risks positioning the third party as the primary beneficiary of
data access and, generally, will not be consistent with meaningful
consumer control over data collection, use and retention.
Further, as a representative acting on behalf of the consumer,
third parties accessing covered data should ensure consumers are best
positioned to understand the scope of their authorizations and their
effect on third party collection, use, and retention. The CFPB
preliminarily concludes that collection, use, and retention of covered
data beyond what is reasonably necessary for the product or service the
consumer requested would undermine the consumer's understanding of the
authorizations they provided. The CFPB also preliminarily concludes
that collection, use, and retention of covered data under these
circumstances would undermine a consumer's ability to control their
data.
The CFPB considered a number of alternatives to the ``reasonably
necessary'' standard, including by evaluating data collection, use, and
retention limitations in other data privacy regimes. For example, the
CFPB considered whether data collection, use, and retention should be
limited to what is ``strictly necessary,'' ``adequate,'' ``relevant,''
or ``legitimate.'' The CFPB has preliminarily determined that, among
other standards the CFPB considered, a ``reasonable necessity''
standard would be flexible enough that third parties could use data for
a variety of purposes to provide the product or service the consumer
requested, but would still sufficiently minimize third party
collection, use, and retention to ensure third parties accessing
covered data are acting on behalf of the consumer.
Consumer's Requested Product or Service
Proposed Sec. 1033.421(a)(1) is also designed to carry out the
objectives of CFPA section 1033 by limiting collection, use, and
retention of covered data to the product or service the consumer
requested.
Consumers generally go into the market seeking the core function of
a product or service and, when authorizing data access, intend for
their data to be accessed for that purpose. However, third parties can
significantly benefit from accessing consumers' covered data, and
consumers often do not know about various data uses,\126\ do not want
companies to use their data broadly,\127\ and also generally lack
bargaining power to engage in the market while protecting their data
privacy.\128\ As a result, third parties often broadly collect, use,
and retain covered data in ways that are for their own benefit. To
ensure that entities only collect, use, and retain data on consumers'
behalf, pursuant to informed consent, the CFPB is limiting data
collection, use, and retention to what is reasonably necessary to
provide a requested product or service. To avoid circumvention of that
standard, the CFPB will treat the product or service as the core
function that the consumer sought in the market and that accrues to the
consumer's benefit. For example, the scope of the product or service is
not defined by disclosures, which could be used to create technical
loopholes by expanding the scope of the product or service the consumer
requested to include any activity the company chooses that would often
benefit the third party and not the consumer. The CFPB preliminarily
determines that the proposed approach would help ensure that third
parties act for the benefit of consumers, that consumers retain control
over their authorizations for data access, and that consumers are best
positioned to provide meaningfully informed consent to third party
collection, use, and retention of their covered data.\129\
---------------------------------------------------------------------------
\126\ See April Falcon Doss, Cyber Privacy, at 61 (BenBella
Books, Inc. 2020) (explaining that it is difficult for consumers to
understand what they are consenting to, how their data might be
collected and used, how it might be sold to others, what the impacts
of aggregation are, etc.); Ramy El-Dardiry et al., Brave New Data:
Policy Pathways for the Data Economy in an Imperfect World, CPB
Netherlands Bureau for Econ. Policy Analysis at 10 (2021), https://www.cpb.nl/sites/default/files/omnidownload/CPB-uk-Policy-Brief-Brave-new-data.pdf (``Consumers cannot see what companies are doing
with their data, nor can they read all of the data terms of use or
oversee the consequences. Companies are able to exploit their strong
informational position by manipulating the preferences of consumers
and enticing them to . . . sell more data.'')
\127\ See generally Brooke Auxier et al., Americans and Privacy:
Concerned, Confused and Feeling Lack of Control Over Their Personal
Information, Pew Rsch. Ctr. (Nov. 15, 2019), https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/ (stating that 81 percent of consumers feel the risks
outweigh the benefits of companies collecting data about them and
that 79 percent of consumers are very or somewhat concerned about
how companies use data).
\128\ See Yosuke Uno et al., The Economics of Privacy: A Primer
Especially for Policymakers, at 16, Bank of Japan Working Paper No.
21-E-11 (Aug. 2021), https://www.boj.or.jp/en/research/wps_rev/wps_2021/data/wp21e11.pdf (stating that consumers cannot
``truthfully express the degree of privacy protection they desire,''
because companies put consumers ``in a situation where it becomes
optimal for them not to choose stronger privacy protection, even
though they prefer it''); Ramy El-Dardiry et al., Brave New Data:
Policy Pathways for the Data Economy in an Imperfect World, at 10,
CPB Netherlands Bureau for Econ. Policy Analysis (2021), https://www.cpb.nl/sites/default/files/omnidownload/CPB-uk-Policy-Brief-Brave-new-data.pdf (``People are consciously, and unconsciously,
providing data, e.g., when they consume a digital service . . . but
often have limited control over or insight into how their data are
used by data processors. This unequal balance of power has several
causes: market power, information asymmetry and behavioural biases.
As a result, mainly the data processors determine, within the legal
framework, which personal data are collected and how they are used,
rather than the party supplying the data.'')
\129\ See generally Brooke Auxier et al., Americans and Privacy:
Concerned, Confused and Feeling Lack of Control Over Their Personal
Information, Pew Rsch. Ctr. (Nov. 15, 2019), https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/ (describing findings that only ``one-in-five adults
overall say they always (9%) or often (13%) read a company's privacy
policy before agreeing to it,'' and that 59 percent say ``they
understand very little or nothing about'' what companies do with
consumer data they collect''); Neil Richards & Woodrow Hartzog, The
Pathologies of Digital Consent, 96 Wash. U. L. Rev. 1461, 1479
(2019), https://openscholarship.wustl.edu/cgi/viewcontent.cgi?article=6460&context=law_lawreview (``[F]ar too
often, far too many people in the digital environment have little to
no idea about what data practices or exposure that they are
consenting to.'')
---------------------------------------------------------------------------
Targeted Advertising, Cross-Selling, and Data Sales
To further ensure that third parties accessing covered data are
collecting, using, and retaining that data only to provide the product
or service the consumer requested, proposed Sec. 1033.421(a)(2)
provides that, for purposes of proposed Sec. 1033.421(a)(1), certain
activities--targeted advertising, cross-selling of other products or
services, or the sale of covered data--are not part of, or reasonably
necessary to provide, any other product or service. The CFPB has
preliminarily determined that when the consumer goes into the market
seeking such other products or services--such as a loan, a checking
account, or a personal financial management tool--the use of data for
the purposes identified in proposed Sec. 1033.421(a)(2) is, as a
general matter, not for the primary benefit of the consumer.\130\
Therefore, the CFPB
[[Page 74834]]
preliminarily determines that it would not be consistent with carrying
out the objectives of CFPA section 1033 for a third party to consider
collection, use, or retention of data for these purposes to be within
the scope of the consumer's requested product or service for purposes
of proposed Sec. 1033.421(a).
---------------------------------------------------------------------------
\130\ Accordingly, the proposed rule would not prevent third
parties from engaging in an activity described in proposed Sec.
1033.421(a)(2) as a stand-alone product. To the extent that the core
function that the consumer seeks out in the market is such an
activity, a third party could potentially provide that core function
to the consumer consistent with, and subject to, the terms of the
proposed rule. Any such offering, of course, would also be subject
to all other applicable laws, including the CFPA's prohibition on
unfair, deceptive and abusive practices.
---------------------------------------------------------------------------
Specifically, the CFPB understands from stakeholder feedback and
research that targeted advertising, cross-selling, and data sales do
not primarily benefit consumers in most cases for various reasons.\131\
The CFPB understands that these activities are pervasive in the
market,\132\ and that consumers often lack choices about whether their
data will be used for these purposes.\133\ Stakeholder feedback
suggests that consumers often do not expect targeted advertising,
cross-selling, and data sales to be part of the product or service they
receive or understand these activities' potential for harm. In
contrast, third parties can greatly benefit from these activities.
Therefore, the CFPB has preliminarily determined that when a third
party combines targeted advertising, cross-selling, and data sales with
any other consumer-requested products or services, it is generally
doing so for its own benefit. Combining these activities with other
features of a product or service may also interfere with consumers'
ability to sufficiently control their data and understand the scope of
their authorizations.
---------------------------------------------------------------------------
\131\ See, e.g., Rodney John Garratt & Michael Junho Lee,
Monetizing Privacy, at 4, Fed. Rsrv. Bank of N.Y. Staff Rep. No. 958
(Jan. 2021), https://www.newyorkfed.org/medialibrary/media/research/staff_reports/sr958.pdf (``Most of the gains from consumer data do
not go to consumers.''); Raheel A. Chaudhry & Paul D. Berger, Ethics
in Data Collection and Advertising, at 1, 5-6, 2 GPH Int'l J. of
Bus. Mgmt. (2019), http://www.gphjournal.org/index.php/bm/article/view/240/110 (stating that targeted advertising and data
monetization allow companies to collect, use, and retain ``consumer
data without the user being any the wiser,'' and that targeted
advertising and data monetization elevate risk the data will be
breached or that malicious parties will purchase the data on the
secondary market).
\132\ See Rishbah Kirpalani & Thomas Philippon, Data Sharing and
Market Power With Two-Sided Platforms, at 2, Nat'l Bureau of Econ.
Rsch. Working Paper No. 28023 (Dec. 2020), http://www.nber.org/papers/w28023 (``Large internet platforms have changed the way
market participants interact. One reason for this is the
extraordinary ability of platforms . . . to gather and analyze large
amounts of data. Platforms use this data to enable better matching
between participants as well as for commercial purposes, including
sale to third parties.''); Daron Acemoglu et al., Too Much Data:
Prices and Inefficiencies in Data Markets, at 1, Nat'l Bureau of
Econ. Rsch. Working Paper No. 26296 (Sept. 2019), https://www.nber.org/papers/w26296 (``The data of billions of individuals
are currently being utilized for personalized advertising or other
online services. The use and transaction of individual data are set
to grow exponentially in the coming years with more extensive data
collection from new online apps and integrated technologies such as
Internet of Things and with the more widespread applications of
artificial intelligence (AI) and machine learning techniques.'')
\133\ See, e.g., Yan Lau, Economic Issues: A Brief Primer on the
Economics of Targeted Advertising, at 9-10, Bureau of Econ., Fed.
Trade Comm'n (2020), https://www.ftc.gov/system/files/documents/reports/brief-primer-economics-targeted-advertising/economic_issues_paper_-_economics_of_targeted_advertising.pdf
(describing that, while consumers can benefit from targeted
advertising, there are multiple consumer harms that result from
targeted advertising, such as: consumers underestimating the
``degree and consequence of the personal data collection websites
carry out in exchange for providing free digital goods and
services;'' consumers might feel the benefits of targeted
advertising do not outweigh the ``perceived intrusiveness of the
advertising''; and consumers might experience harms related to data
breaches or misuse of their data).
---------------------------------------------------------------------------
Proposed Sec. 1033.421(a)(2) is designed to impose a bright-line
rule with respect to targeted advertising, cross-selling of other
products or services, and the sale of covered data. However, proposed
Sec. 1033.421(a)(2) is not meant to be an exhaustive list of
activities that should not be considered part of any other requested
product or service, such as data activities described in terms and
conditions that are neither the core function that the consumer went
into the market to obtain or reasonably necessary to achieve that
function. The CFPB also seeks comment on whether activities other than
those identified in proposed Sec. 1033.421(a)(2) should be included in
the activities listed in proposed Sec. 1033.421(a)(2).
Limitations on Collection of Covered Data (Sec. 1033.421(b))
Proposed Sec. 1033.421(b) contains third party obligations related
to collection of covered data. As described below, as a condition of
being authorized to access covered data on a consumer's behalf, the
third party would be required to (1) limit its collection of covered
data, including the scope of covered data, to what is reasonably
necessary to provide the consumer's requested product or service; (2)
limit the duration of collection of covered data to the maximum
durational period; (3) obtain a new authorization from the consumer, in
a reasonable manner, to collect covered data beyond the maximum
durational period; and (4) abide by certain limitations on collection,
use, and retention of covered data beyond the maximum durational period
if the third party does not obtain a new authorization from the
consumer.
Specifically, proposed Sec. 1033.421(b)(1) would provide that,
consistent with proposed Sec. 1033.421(a)(1), third parties must limit
their collection--including the scope of covered data collected and the
duration and frequency of collection of covered data--to what is
reasonably necessary to provide the consumer's requested product or
service. The SBREFA Panel recommended that the CFPB consider options to
limit duration and frequency of third party collection of consumer data
that do not unnecessarily restrict third parties' ability to provide
products or services requested by consumers. The Panel also recommended
that the CFPB consider the option of limiting third party collection to
the duration and frequency necessary based on the product or service
requested by consumers. Third parties often obtain significantly more
consumer data, for longer periods, than is necessary to provide
requested products and services to consumers.\134\ The CFPB understands
that ongoing data collection can undermine consumer expectations or
understanding, and in some cases, can go beyond the consumer's informed
consent.\135\ The CFPB has preliminarily determined that limiting the
scope of data collected, and duration and frequency of data collection,
to what is reasonably necessary to provide the consumer's requested
product or service would reduce the potential for harm associated with
ongoing data collection.
---------------------------------------------------------------------------
\134\ See generally Itay P. Fainmesser et al., Digital Privacy,
96 Mgmt. Sci. 3157, 3158 (2022), https://pubsonline.informs.org/doi/10.1287/mnsc.2022.4513 (describing broad collection and use of
consumer data to improve digital businesses and extract increased
profits); Daron Acemoglu et al., Too Much Data: Prices and
Inefficiencies in Data Markets, at 3, Nat'l Bureau of Econ. Rsch.
Working Paper No. 26296 (2019), https://www.nber.org/papers/w26296
(describing a lack of balance in the market between what consumers
authorize and what data are collected and how data are used).
\135\ See generally April Falcon Doss, Cyber Privacy, at 50
(BenBella Books, Inc. 2020) (``First, data asymmetry is endemic.
Data subjects rarely know as much as data holders do about what's
being collected and how it's being used. Second, data subjects
seldom have complete visibility into, or a full appreciation of, the
complex interactions among the many ways that data can be used.
Third, even with that information and appreciation, consumers find
their choices are limited.'')
---------------------------------------------------------------------------
Proposed Sec. 1033.421(b)(1) is responsive to the SBREFA Panel
recommendations that the CFPB consider options to limit duration and
frequency of third party collection of consumer data that do not
unnecessarily restrict third parties' ability to provide products or
services requested by consumers, and consider the option of
[[Page 74835]]
limiting third party collection to the duration and frequency necessary
based on the product or service requested by consumers.\136\
---------------------------------------------------------------------------
\136\ SBREFA Panel Report at 44.
---------------------------------------------------------------------------
Maximum Duration
Proposed Sec. 1033.421(b)(2) would provide that third parties must
limit the duration of collection of covered data to a maximum period of
one year after the consumer's most recent reauthorization.
In the SBREFA Outline, the CFPB stated that it was considering
proposing that third party authorization to access covered data would
be limited to a maximum period.\137\ The CFPB also asked whether it
should consider other provisions related to a maximum durational
period, including a proposal that would require all authorized third
parties to obtain reauthorization on the same day or during the same
month each year, for all consumers.\138\ The CFPB received a range of
feedback related to limiting third party authorization to a maximum
durational period. Many commenters were generally supportive of the
approach but suggested variations, such as not allowing third parties
to collect consumer data longer than necessary to satisfy a legitimate
purpose, or requiring third parties to end their collection of consumer
data after a period of consumer inactivity, i.e., ``dormancy.'' Other
commenters supported a maximum duration on collection, citing concern
that limiting collection of consumer data to what is reasonably
necessary for the product or service, on its own, would not go far
enough to ensure that third parties adhere to consumer preferences
related to privacy, because third parties could wrongfully extend
collection without sufficient bases. Other commenters stated that a
maximum limitation on duration would result in undesired loss of
services for consumers or might otherwise frustrate consumer intent.
---------------------------------------------------------------------------
\137\ SBREFA Outline at 41.
\138\ Id. at 42.
---------------------------------------------------------------------------
The CFPB recognizes that some products or services, like bill pay,
overdraft prevention, or personal financial management, require long
term access. For products or services that require ongoing data
collection, the general limitation standard may not be sufficient to
ensure that third parties act on behalf of consumers when collecting
data over the longer term. For example, consumer needs or expectations
may change in ways that may not be apparent to the third party, as
could happen when a consumer stops using a product or service and
forgets that they authorized third party data access. In other cases,
consumers may have attempted to end third party access without actually
doing so, such as when a consumer deletes an application from a device
with the intent of stopping data collection, use and retention. At the
same time, there will be other cases where consumers request products
or services that require long-term data collection and want to
authorize ongoing third party data access. In those cases, it would
frustrate consumer intent and burden third parties to terminate third
party access or require frequent reauthorizations.
The CFPB has preliminarily determined that requiring third parties
to limit data collection to a maximum durational period would
effectively account for the concern that long-term data collection may
not align with consumer expectations in some cases. Under proposed
Sec. 1033.421(b)(2), even if consumers do not request revocation as
described in proposed Sec. 1033.421(h), third party authorization
would end after the maximum period ends and the consumer does not
reauthorize. The CFPB has also preliminarily determined that one year
is an appropriate period for the maximum duration of collection. This
approach could provide an effective check against data collection that
consumers no longer need or want, while avoiding burdens associated
with shorter maximum durational periods, such as frequent requests for
reauthorization.
The CFPB considered whether to propose an explicit limit on
duration related to dormancy, as suggested by some commenters. The CFPB
has preliminarily determined that a dormancy approach could be
burdensome for third parties to operationalize as they may not have a
clear view into a consumer's activity, and that some of the benefits of
a dormancy period could be achieved by a maximum durational period. The
CFPB seeks comment on dormancy, including about how a dormancy
limitation might work in comparison to a uniform maximum duration, and
how dormancy might be operationalized.
Reauthorization
Proposed Sec. 1033.421(b)(3) would require that, to collect
covered data beyond the one-year maximum period, the third party will
obtain a new authorization from the consumer pursuant to proposed Sec.
1033.401 no later than the anniversary of the most recent authorization
from the consumer. Under that proposal, the third party would be
permitted to ask the consumer for a new authorization pursuant to
proposed Sec. 1033.401 in a reasonable manner. Under the proposal,
indicia that the new authorization request is reasonable include its
conformance to a qualified industry standard.
In the SBREFA Outline, the CFPB described an approach in which,
after the maximum durational period ends, third parties would need to
seek reauthorization for continued access, and many commenters
supported that approach.\139\ The SBREFA Panel recommended the CFPB
consider options for reauthorization requirements after the expiration
of any durational limitations.\140\
---------------------------------------------------------------------------
\139\ Id. at 41.
\140\ SBREFA Panel Report at 44.
---------------------------------------------------------------------------
The CFPB has preliminarily determined that consumers would benefit
from the ability to provide annual authorizations for third party data
access. Annual authorizations would provide a yearly check-in for
consumers to take or leave third party data access for products or
services they have previously authorized. As such, proposed Sec.
1033.421(b)(3) would allow third parties to seek from consumers new
authorizations before the maximum durational period ends to avoid
service interruptions or added friction in consumers' user experience
with the third party.
Further, the CFPB has preliminarily determined that third parties
might need to seek new authorizations multiple times or otherwise
explain to consumers why they are seeking new authorizations. The CFPB
understands, however, that third parties might unnecessarily burden
consumers with many requests for authorization or otherwise attempt to
obtain consumer authorizations for third party data access that
consumers no longer want. To account for both of these concerns,
proposed Sec. 1033.421(b)(3) would allow third parties to seek new
authorizations, in a reasonable manner, no later than the anniversary
of the consumer's initial authorization. The CFPB has also
preliminarily determined that additional guidelines related to
reauthorization requests may facilitate compliance for third parties.
As such, proposed Sec. 1033.421(b)(3) would provide that indicia that
a new authorization request is reasonable include conformance with a
qualified industry standard on the subject.
Effects of Maximum Duration (Sec. 1033.421(b)(4))
Finally, proposed Sec. 1033.421(b)(4) provides that, if the
consumer does not provide a new authorization before the maximum
durational period ends, third
[[Page 74836]]
parties will (1) no longer collect covered data pursuant to the most
recent authorization and (2) no longer use or retain covered data that
was previously collected pursuant to the most recent authorization
unless use or retention of that covered data remains reasonably
necessary to provide the consumer's requested product or service. As
noted above, proposed Sec. 1033.421(b)(2) would impose a maximum
durational period of one year as a check against data collection that
consumers no longer need or want. Consistent with proposed Sec.
1033.421(b)(2), proposed Sec. 1033.421(b)(4)(i) specifies that, once
the maximum durational period ends and the consumer does not provide a
new authorization, the third party may no longer collect covered data
pursuant to the consumer's authorization.
Proposed Sec. 1033.421(b)(4)(ii) specifies, consistent with the
general limitation in proposed Sec. 1033.421(a), that when the maximum
durational period ends and the consumer does not provide a new
authorization, the third party may no longer use or retain covered data
that was previously collected unless use or retention remains
reasonably necessary to provide the consumer's requested product or
service under proposed Sec. 1033.421(a). In the current market, third
parties use and retain consumer data for reasons unrelated to providing
a consumer-requested product or service, including after a consumer no
longer receives the product or service from the third party. Such
residual use and retention, which seldom occurs with consumer
awareness, can result in significant privacy and security risks to
consumers and can undermine the consumer's ability to control access to
their covered data. Proposed Sec. 1033.421(b)(4)(ii) would address
this concern by making clear that the general limitation on use and
retention contained in proposed Sec. 1033.421(a) applies to use and
retention of covered data after a one-year maximum durational period
ends and the consumer does not provide a new authorization.
Proposed Sec. 1033.421(b)(4)(ii) recognizes that, while use and
retention of covered data will not be reasonably necessary for most
purposes after the maximum durational period ends and the consumer does
not provide a new authorization, it may continue in some circumstances.
The consumer's failure to reauthorize access beyond the maximum period
of one year, all other things being equal, indicates that the existing
authorization, without more, no longer supports use or retention of
data collected under its terms. In the normal course, therefore,
application of the general standard in proposed Sec. 1033.421(a) will
call for the third party, after its failure to secure reauthorization,
to stop using and retaining data collected pursuant to the earlier
authorization. However, specific circumstances may justify continued
use and or retention of some or all such data under that standard, even
as new collection, use and retention stops. For example, a subpoena
could require the retention, beyond the maximum period, of specific
data collected in that period; meeting such legal requirements can
continue to remain reasonably necessary even if only in connection with
providing the product prior to the expiration of the maximum period.
Similarly, the consumer could provide a clear, affirmative indication
that they want to continue to use the product beyond the maximum period
in a manner supported by the use and retention of data collected prior
to expiration of that period. In that context, use and retention of
some or all of the data could meet the general standard in proposed
Sec. 1033.421(b)(4)(ii) even as the consumer no longer makes use of
the product in any manner that would require continued data collection.
The CFPB has preliminarily determined that proposed Sec.
1033.421(b)(4)(ii) provides third parties with sufficient flexibility
to address circumstances in which continued use or retention of
previously collected data might be justified under the general standard
in proposed Sec. 1033.421(a), while ensuring that consumer data are
not used and retained, beyond the expiration of the maximum period
without reauthorization, in a manner that does not properly reflect the
control afforded the consumer under that same general standard. The
CFPB seeks comment about these circumstances and whether, following the
end of a maximum durational period, additional protections for
consumers or flexibilities for third parties are warranted.
Limitations on Use of Covered Data (Sec. 1033.421(c))
Under proposed Sec. 1033.421(a), use of covered data that is not
reasonably necessary to provide the consumer's requested product or
service--i.e., secondary uses--would not be permitted as part of the
third party's authorization to access the consumer's covered data.
Proposed Sec. 1033.421(c) specifies that, in addition to limiting the
third party's own use of covered data, third parties would not be able
to provide covered data to other third parties unless doing so is
reasonably necessary to provide the consumer's requested product or
service. For clarity, proposed Sec. 1033.421(c) would include the
following examples of uses of covered data that would be permitted as
reasonably necessary: (1) uses that are specifically required under
other provisions of law, including to comply with a properly authorized
subpoena or summons or to respond to a judicial process or government
regulatory authority; (2) uses that are reasonably necessary to protect
against or prevent actual or potential fraud, unauthorized
transactions, claims, or other liability; and (3) servicing or
processing the product or service the consumer requested.
As described above, the SBREFA Panel recommended that the CFPB
consider how the secondary use limitation would apply in certain use
cases and with respect to certain business activities.\141\ For
example, the Panel recommended that the CFPB consider options that
would permit uses of data (including de-identified or anonymized data,
as discussed below) for product maintenance or improvement, if
appropriate consumer protections can be put in place.\142\ The SBREFA
Panel also recommended that the CFPB consider where it can give
flexibility to third parties while still achieving its consumer
protection objectives.\143\
---------------------------------------------------------------------------
\141\ Id. at 44-45.
\142\ Id. at 44.
\143\ Id. at 44-45.
---------------------------------------------------------------------------
The CFPB is proposing the examples in Sec. 1033.421(c) to provide
third parties with additional clarity on how the limitation standard
would apply with respect to certain business activities. The CFPB
requests feedback on whether the final rule should include other
examples of business activities that are reasonably necessary to
provide consumer requested products and services.
The CFPB also requests feedback on whether the final rule should
permit third parties to solicit consumers' opt-in consent to some
secondary uses of consumer data to provide flexibility to third parties
while maintaining important consumer protections. For example, the CFPB
requests feedback on whether the final rule should permit third parties
to solicit consumers' opt-in consent to secondary uses as part of a
third party's authorization to access data, while requiring third
parties to certify not to use covered data for certain higher-risk
secondary uses. In addition, the CFPB requests feedback on whether the
final rule should permit third parties to solicit a consumer's opt-
[[Page 74837]]
in consent to engage in secondary uses with de-identified data, and if
so, what de-identification standard the rule should provide.\144\ The
CFPB also requests feedback on how any opt-in approach could be
structured to ensure that consumers are providing express informed
consent to any secondary data uses, and whether the CFPB's proposed
authorization disclosure is an appropriate vehicle for soliciting
granular consumer choices about data use, such as through a secondary
use opt-in mechanism. Finally, the CFPB requests feedback on how opt-in
mechanisms could be implemented to prevent third parties from using
``dark patterns'' or deceptive practices aimed at soliciting consumer
consent.
---------------------------------------------------------------------------
\144\ For example, one standard suggested by SBREFA commenters,
articulated in a 2012 FTC privacy report, and codified in several
State laws describes de-identified information as data for which a
business has (1) taken reasonable measures to ensure that the
information cannot be linked to an individual; (2) publicly
committed not to attempt to re-identify the information; and (3)
contractually obligated any recipients not to attempt to re-identify
the information. See Fed. Trade Comm'n, Protecting Consumer Privacy
in an Era of Rapid Change: Recommendations for Businesses and
Policymakers, at 20-21 (2012), https://www.ftc.gov/reports/protecting-consumer-privacy-era-rapid-change-recommendations-businesses-policymakers; Cal. Civ. Code section 1798.140(m); Colo.
Rev. Stat. section 6-1-1303(11); Va. Code sections 59.1-575, 59.1-
581; Utah Code Ann. 13-61-101(14).
---------------------------------------------------------------------------
Accuracy (Sec. 1033.421(d))
Proposed Sec. 1033.421(d) would require third parties to establish
and maintain written policies and procedures that are reasonably
designed to ensure that covered data are accurately received from a
data provider and accurately provided to another third party, if
applicable. Under proposed Sec. 1033.421(d), a third party would have
flexibility to determine its policies and procedures in light of the
size, nature, and complexity of its activities, but the third party
would be required to commit to periodically reviewing its policies and
procedures and updating them as appropriate to ensure their continued
effectiveness. Proposed Sec. 1033.421(d)(3) provides two elements that
third parties should consider when developing their policies and
procedures: (1) accepting covered data in the format required by Sec.
1033.311(b), and (2) addressing information provided by a consumer,
data provider, or another third party regarding inaccuracies in the
covered data. Finally, proposed Sec. 1033.421(d)(4) states that
indicia that a third party's policies and procedures are reasonable
include whether the policies and procedures conform to a qualified
industry standard regarding accuracy.
The CFPB has preliminarily determined that consumers would benefit
from accuracy requirements for third parties. Third parties that fail
to accurately receive data from a data provider, or fail to accurately
provide data to another third party, would limit the effectiveness of
the data access right fundamental to CFPA section 1033. Such
inaccuracies would also impair the development of an innovative,
competitive market for alternative consumer financial products and
services. Third party accuracy requirements would also benefit third
parties that rely on intermediaries to facilitate consumer-authorized
access.
Proposed Sec. 1033.421(d) would limit the scope of a third party's
required policies and procedures to the accuracy of transmission--
receiving covered data from a data provider and, if applicable,
subsequently providing it to another third party. The CFPB has several
reasons for proposing this scope. First, existing Federal law already
protects consumers against some of the most harmful inaccuracies in the
use of financial data. For example, FCRA imposes accuracy requirements
on the information provided by consumer reporting agencies; Regulation
E protects consumers against unauthorized electronic fund transfers and
other errors; and Regulation Z protects consumers against certain
billing and servicing errors.\145\ Second, most SBREFA comments
addressing accuracy focused on transmission of data from data providers
to third parties as the source of accuracy issues. In adopting a
similar focus, proposed Sec. 1033.421(d) would reflect this feedback.
Finally, the CFPB understands that many third parties are small
entities, and accuracy requirements covering all aspects of the
collection, use, and provision of consumer data might be overly
burdensome.
---------------------------------------------------------------------------
\145\ See 12 CFR part 1022; 12 CFR part 1005; 12 CFR part 1026.
---------------------------------------------------------------------------
By requiring flexible standards rather than prescriptive rules,
proposed Sec. 1033.421(d) is designed to adapt to changing conditions
and minimize the burden on third parties. Proposed Sec. 1033.421(d)(1)
would provide that a third party has flexibility to determine its
policies and procedures in light of the size, nature, and complexity of
its activities. Proposed Sec. 1033.421(d)(3) would offer elements that
a third party should consider when designing its policies and
procedures. Although reasonable policies and procedures would address
many elements, the two identified in the proposal are especially
relevant to an assessment of whether a third party's policies and
procedures are reasonable. First, given the SBREFA feedback identifying
transfer of data from a data provider as the primary source of
inaccuracies, policies and procedures would likely be unreasonable if
they failed to ensure that a third party could accept data in the
format in which data providers made it available. And addressing
information, such a dispute or notice of inaccuracy, from a consumer,
data provider, or another third party is relevant to the reasonableness
of a third party's policies and procedures because these other parties
are likely to have information about whether data has been accurately
transferred to or from the products or services they are using or
providing. The implementation of these elements would vary according to
a third party's size or market environment. For example, a data
aggregator that supports a large number of additional third parties
might require more extensive policies and procedures to reasonably
ensure accuracy than a third party that acts only as a data recipient.
Proposed Sec. 1033.421(d)(4) states that indicia that a third
party's policies and procedures are reasonable include whether the
policies and procedures conform to a qualified industry standard
regarding accuracy. A qualified industry standard regarding accuracy is
relevant to the reasonableness of a third party's policies and
procedures because it reflects the openness, balance, consensus,
transparency, and other requirements of proposed Sec. 1033.141.
Flexible standards also facilitate consistency with existing
accuracy requirements. For example, third parties might have
obligations under existing law for investigating and responding to
consumer disputes. By forgoing prescriptive dispute requirements, the
proposal avoids conflicting with the format, substance, and timing
requirements of the dispute provisions in other laws. The proposal's
policies-and-procedures requirement would also allow third parties to
leverage existing systems for addressing disputes to the extent that
such disputes also relate to the transfer of covered data.
The CFPB seeks comment on proposed Sec. 1033.421(d), including on
whether any additional elements bearing on the reasonableness of a
third party's policies and procedures regarding accuracy should be
included.
Data Security (Sec. 1033.421(e))
Proposed Sec. 1033.421(e)(1) would require third parties to
certify to consumers that they will apply an information security
program that
[[Page 74838]]
satisfies the applicable rules issued pursuant to the GLBA (GLBA
Safeguards Framework) to their systems for the collection, use, and
retention of covered data. Proposed Sec. 1033.421(e)(2) would require
a third party that is not a GLBA financial institution to apply the
information security program required by the FTC's GLBA Safeguards Rule
(16 CFR part 314).
As explained in part IV.C above, covered data includes sensitive
financial data that might expose consumers to fraud or identity theft
if it were exposed. The GLBA Safeguards Framework provides a familiar
risk-based process for addressing data security that allows for
adaptation to changing technology and emerging threats. Therefore, the
CFPB has preliminarily determined that the GLBA Safeguards Framework
can be used by third parties to appropriately protect consumer-
authorized financial data.
The SBREFA Panel recommended that the CFPB consider options for
ensuring that consistent minimum data security standards apply to third
parties and data providers, and several commenters echoed this
recommendation.\146\ Requiring third parties to certify that they
follow the GLBA Safeguards Framework helps ensure consistency in
protection as a covered data moves from a data provider to one or more
third parties because all or substantially all data providers are
already subject to the GLBA Safeguards Framework, most likely the
Interagency Guidelines Establishing Information Security Standards
issued by the Federal functional regulators. However, a few commenters
asserted that the FTC's Safeguards Rule may be insufficient because,
unlike the Interagency Guidelines, it was not supported by regulator
supervision. The CFPB understands this point but notes that the FTC has
designed its rule to account for a different supervisory context. The
FTC's Safeguards Rule includes slightly more prescriptive requirements,
such as encryption, for certain elements, because the Safeguards Rule
must be usable by a financial institution to determine appropriate data
security measures without regular interaction with an examiner from a
supervising agency.\147\
---------------------------------------------------------------------------
\146\ SBREFA Panel Report at 44.
\147\ 86 FR 70272, 70287 (Dec. 9, 2021).
---------------------------------------------------------------------------
Proposed Sec. 1033.421(e)(1) would also limit burden on third
parties and avoid duplicative regulation. As with data providers, third
parties are already subject to data security requirements. The CFPB
understands that all or most third parties that would access covered
data through a developer interface are regulated by the GLBA Safeguards
Framework, most commonly the FTC's Safeguards Rule.\148\ As the CFPB
discussed in a recent circular, inadequate data security can also
constitute an unfair practice in violation of the CFPA.\149\ However,
the CFPA's unfairness prohibition articulates a general standard that
is not specific to data security, and gaps in GLBA coverage might exist
given the diversity of third parties that the proposal would cover. A
few SBREFA commenters stated that they had observed third parties
either denying or expressing uncertainty over their status as GLBA
financial institutions. Requiring third parties that are not GLBA
financial institutions to certify that they comply with the FTC's
Safeguards Rule would remove any uncertainty and prevent any attempts
to evade coverage.
---------------------------------------------------------------------------
\148\ The CFPB is seeking comment in part IV.D about whether
certain third parties, such as natural person third parties not
covered by GLBA, should not be subject to the authorization
procedures under proposed Sec. 1033.401.
\149\ Consumer Fin. Prot. Bureau, Consumer Financial Protection
Circular 2022-04 (Aug. 11, 2022), https://www.consumerfinance.gov/compliance/circulars/circular-2022-04-insufficient-data-protection-or-security-for-sensitive-consumer-information/.
---------------------------------------------------------------------------
Provision of Covered Data to Other Third Parties (Sec. 1033.421(f))
The CFPB is proposing in Sec. 1033.421(f) to require the third
party to certify that, before providing covered data to another third
party, it will require the other third party by contract to comply with
certain obligations.
In some circumstances, third parties that are authorized to access
covered data from a data provider on behalf of a consumer may need to
share that data with another third party. The authorized third party's
ability to share covered data would be limited by the conditions in
proposed Sec. 1033.421(a) and (c), under which the authorized third
party would limit its use of covered data, including sharing data with
other third parties, to what is reasonably necessary to provide the
consumer's requested product or service. Subject to that limitation,
the authorized third party would be permitted to provide the data to
another third party.
The CFPB has preliminarily determined that the consumer protections
provided by the third party obligations in proposed Sec. 1033.421
generally should continue to apply when the covered data are provided
by the authorized third party to another third party. Otherwise, the
third party that receives the data from the authorized third party
would not be subject to, for example, the limitations on use or the
requirements for data privacy and data security that apply to the
authorized third party, and the consumer would lose these important
protections for the covered data.
For this reason, proposed Sec. 1033.421(f) would obligate the
third party to certify that, before providing the covered data to
another third party, it will require the other third party by contract
to comply with certain third party obligations in proposed Sec.
1033.421. Proposed Sec. 1033.421(f) states that any provision of
covered data to another third party would be subject to the restriction
in proposed Sec. 1033.421(c), which specifies that provision of data
is a type of use of covered data that would be limited by proposed
Sec. 1033.421(a) to what is reasonably necessary to provide the
consumer's requested product or service requested.
Proposed Sec. 1033.421(f) would not require the authorized third
party to bind the other third party by contract to comply with all of
the third party obligations in proposed Sec. 1033.421. The CFPB has
preliminarily determined that certain of the third party obligations
would be of limited applicability to the other third party, including
the obligation to provide certain information to the consumer in
proposed Sec. 1033.421(g) and the revocation obligation in proposed
Sec. 1033.421(h).
The CFPB requests comment on whether the approach in proposed Sec.
1033.421(f) would provide sufficient protection to consumers and their
covered data when an authorized third party provides that data to
another third party. The CFPB also requests comment on which third
party obligations in proposed Sec. 1033.421 should be included in this
approach.
Ensuring Consumers Are Informed (Sec. 1033.421(g))
The CFPB is proposing in Sec. 1033.421(g) to require a third party
to certify that it agrees to certain obligations designed to ensure
that consumers are able to obtain information about the third party's
access to their data.
As described above, to be authorized to access covered data on
behalf of the consumer, a third party would be required to provide the
consumer with an authorization disclosure.\150\ The authorization
disclosure would include, among other things, a brief description of
the product or service that the
[[Page 74839]]
consumer requested and the categories of covered data the third party
would access.\151\ The CFPB has preliminarily determined that consumers
would benefit from being able to access authorization disclosures they
have previously signed. For example, the consumer may not recall which
third parties are accessing their data, what data are being accessed,
and for what reasons. Without this information, it would be difficult
for a consumer to decide whether to continue authorizing data access.
---------------------------------------------------------------------------
\150\ See proposed Sec. 1033.401(a).
\151\ See id. Sec. 1033.411(b)(1) through (6) (content of the
authorization disclosure).
---------------------------------------------------------------------------
For this reason, under proposed Sec. 1033.421(g)(1), a third party
would be required to certify that it will provide the consumer with a
copy of the consumer's authorization disclosure by delivering a copy to
the consumer or making it available in a location that is readily
accessible to the consumer, such as the third party's interface. The
proposed rule specifies that, if the third party makes the
authorization disclosure available in such a location, the third party
also certifies that it will ensure it is accessible to the consumer
until the third party's access to the consumer's data terminates. The
CFPB seeks comment on whether this is the right time period.
In addition, the CFPB has preliminarily determined that the
consumer should be able to contact the third party to receive answers
to questions about the third party's access to the consumer's covered
data. The authorization disclosure would contain a limited amount of
information pursuant to proposed Sec. 1033.411(b), so it may not
address every question the consumer has about the third party's data
access.
For this reason, under proposed Sec. 1033.421(g)(2), a third party
would be required to certify that it will provide readily identifiable
contact information that enables a consumer to receive answers to
questions about the third party's access to the consumer's covered
data. A third party could satisfy proposed Sec. 1033.421(g)(2) through
its existing customer service functions, provided that this function is
equipped to handle the relevant questions. The CFPB seeks comment on
additional requirements regarding the nature of the contact that the
consumer can access through the contact information provided by the
third party, such as whether the consumer must be able to access a
human contact or whether the consumer must receive a response within a
specified timeframe.
The CFPB also has preliminarily determined that, at any time during
the third party's access to the consumer's data, the consumer should be
able to obtain certain information from the third party. For this
reason, under proposed Sec. 1033.421(g)(3), third parties would be
required to certify that they will establish policies and procedures
designed to ensure that, upon the consumer's request, the third party
will provide certain information to the consumer.
Under this provision, the consumer would be able to obtain
information about additional parties with which the covered data was
shared and reasons for sharing the covered data.\152\ The CFPB has
preliminarily determined that this information would be valuable for
consumers to know to protect their privacy, exercise control over which
parties are accessing their covered data, and evaluate whether to
continue sharing data with the third party.
---------------------------------------------------------------------------
\152\ See id. Sec. 1033.421(g)(3)(iii) and (iv).
---------------------------------------------------------------------------
The consumer would also be able to obtain information about the
status of the third party's authorization.\153\ Under the proposed
rule, the third party would certify that it will limit its collection
of data to what is reasonably necessary to provide the consumer's
requested product or service. However, it may not be apparent to the
consumer whether the third party's authorization is still active or
whether the third party is currently collecting data. The CFPB's
proposal would enable consumers to obtain this information.
---------------------------------------------------------------------------
\153\ See id. Sec. 1033.421(g)(3)(v).
---------------------------------------------------------------------------
The consumer would also be able to obtain certain information that
is similar to the information listed on the authorization disclosure:
the categories of covered data the third party is collecting; the
reasons for collecting the covered data; and information about how the
consumer can revoke the third party's access to the consumer's
data.\154\ Some consumers may want to obtain this information, but
rather than seeking out a copy of their authorization disclosure, they
may simply contact the third party. These provisions would enable
consumers to obtain this information in this manner. The CFPB has
preliminarily determined that it would be appropriate to require the
third party to certify that it will provide this information on request
given that the third party originally provided this information on the
authorization disclosure.
---------------------------------------------------------------------------
\154\ See id. Sec. 1033.421(g)(3)(i), (ii), and (vi).
---------------------------------------------------------------------------
The CFPB seeks comment on whether the list in proposed Sec.
1033.421(g)(3) should be modified, including whether additional
categories of information should be added.
Revocation of Authorization (Sec. 1033.421(h))
Proposed Sec. 1033.421(h) would contain third party obligations
related to consumers' revocation of authorization for third parties to
access their covered data. As described below, as a condition of being
authorized to access covered data on a consumer's behalf, the third
party must certify to: (1) provide the consumer with an easily
accessible and operable revocation mechanism; (2) notify the data
provider, data aggregator, and certain other third parties when a
consumer revokes the third party's authorization; and (3) abide by
certain limitations on collection, use, and retention of covered data
when a consumer revokes the third party's authorization.
Proposed Sec. 1033.421(h)(1) would require third parties to
certify to provide the consumer with a mechanism to revoke the third
party's authorization to access the consumer's covered data. Under
proposed Sec. 1033.421(h)(1), the third party would be required to
certify that such revocation mechanism will be as easy to access and
operate as the initial authorization. Proposed Sec. 1033.421(h)(1)
would also require the third party to certify that the consumer will
not be subject to costs or penalties for revoking the third party's
authorization.
In the SBREFA Outline, the CFPB described an approach in which
third parties would certify to providing consumers with a simple way to
revoke third party authorization to access data at any point.\155\ In
the SBREFA Outline, the CFPB defined revocation as a consumer
withdrawing consent to third party data access that they previously
authorized under the rule.\156\ Commenters supported giving consumers
the right to revoke third party consent at any time and made varying
suggestions about the appropriate method for revocation. The following
are some specific comments related to revocation: consumers should have
the right to revoke consent in a manner that is consistent with initial
consent; and revocation should be easy, readily accessible, clear,
accessible via toggle on dashboard, free of cost/penalties, and/or
salient. Many commenters supported the idea that third parties that
receive revocation requests should notify the other parties of the
request. The SBREFA Panel recommended that the CFPB explore
[[Page 74840]]
options that enable consumers to revoke third party access and clarify
the kind of revocation mechanisms third parties would be required to
provide to consumers.\157\ The SBREFA Panel also recommended that the
CFPB continue to consider how revocation requirements could be designed
to reduce impacts on third parties.\158\
---------------------------------------------------------------------------
\155\ SBREFA Outline at 42.
\156\ Id.
\157\ SBREFA Panel Report at 45.
\158\ Id.
---------------------------------------------------------------------------
The CFPB has preliminarily determined that for the consumer's
authorization for third party data access to be meaningful, consumers
need to be able revoke that authorization at any time. For this reason,
the CFPB has preliminarily determined that consumers need sufficient,
clear opportunities to revoke their consents to third party access to
covered data under this proposed rule. As such, proposed Sec.
1033.421(h)(3) is designed to achieve the goal of ensuring consumers
can provide meaningful authorization to third party data access and
easily and effectively revoke that authorization whenever they choose.
The CFPB has preliminarily determined that revocation should be as easy
as the initial authorization to ensure third parties do not bury the
revocation mechanism or otherwise obfuscate consumers' ability to
utilize it.
Additionally, for revocation of authorization to be free of cost or
penalties to the consumer, the CFPB has preliminarily determined that
consumers should be able to revoke their authorization to data access
for purposes of one product or service but maintain that same third
party's data access for purposes of another product or service. Third
parties conditioning the provision of one product or service on the
consumer providing consent to data access for another product or
service is a cost or penalty on the consumer. Therefore, as part of
proposed Sec. 1033.421(h)(1), third parties must allow consumers to
revoke consent to data access for a particular product or service and
maintain consent to data access for any others.
Further, proposed Sec. 1033.421(h)(2) would require the third
party to certify that it will notify the data provider, any data
aggregator, and other third parties to whom the third party has
provided the consumer's covered data when the third party receives a
revocation request from the consumer. As noted above, in some
circumstances, third parties that are authorized to access covered data
from a data provider on behalf of a consumer may want to share that
data with another third party. The CFPB is proposing in Sec.
1033.421(f) to obligate the third party to certify that, before
providing covered data to another third party, it will require the
other third party by contract to comply with certain third party
obligations in proposed Sec. 1033.421. In addition, proposed Sec.
1033.431(c), discussed below, would require that, when a third party
uses a data aggregator to assist with accessing covered data on behalf
of a consumer, the data aggregator certify to the consumer that it
agrees to the conditions on accessing the consumer's data in proposed
Sec. 1033.421(a) through (f) and (h)(3). The CFPB is proposing in
Sec. 1033.421(h)(2) to require authorized third parties to notify
other third parties of the consumer's revocation to ensure that those
third parties that receive covered data from the authorized third party
are aware of the status of the consumer's authorization and can,
accordingly, meet applicable certifications related to use and
retention of that data. The CFPB is also proposing in Sec.
1033.421(h)(2) to require authorized third parties to notify data
providers of the consumer's revocation to ensure data providers are
aware of the status of the consumer's authorization.
Finally, proposed Sec. 1033.421(h)(3) would require the third
party to certify that, upon receipt of a consumer's revocation request
or notice of a revocation request pursuant to proposed Sec.
1033.321(3), the third party will (1) no longer collect covered data
pursuant to the most recent authorization, and (2) no longer user or
retain covered data that was previously collected pursuant to the most
recent authorization unless use or retention of that covered data
remains reasonably necessary to provide the consumer's requested
product or service under proposed Sec. 1033.421(a).
Proposed Sec. 1033.421(h)(3)(i) specifies the effect of a
consumer's revocation request on the third party's collection of
covered data. As noted above, the CFPB is proposing in Sec.
1033.421(h)(1) to require third parties to certify to provide consumers
with a mechanism by which they can revoke the third party's
authorization. Consistent with that provision, proposed Sec.
1033.421(h)(3)(i) specifies that, once a consumer requests revocation,
the third party may no longer collect covered data pursuant to the
consumer's authorization.
Proposed Sec. 1033.421(h)(3)(ii) specifies the effect of a
consumer's revocation request on the third party's use and retention of
covered data collected prior to that request. Consistent with the
general limitation in proposed 1033.421(a), proposed Sec.
1033.421(h)(3)(ii) specifies that, when a consumer requests revocation
of third party authorization, the third party may no longer use or
retain covered data that was previously collected unless use or
retention remains reasonably necessary to provide the consumer's
requested product or service.
This provision mirrors proposed Sec. 1033.421(b)(4)(ii), which
addresses the effects of the maximum durational period on use and
retention of previously collected data. As where a consumer does not
reauthorize third party access before the maximum durational period
expires, revocation of the consumer's existing authorization to access,
all other things being equal, covered data indicates that such
authorization no longer supports use or retention of data collected
under its terms. In the normal course, therefore, application of the
general standard in proposed Sec. 1033.421(a) will call for the third
party to stop using and retaining data collected pursuant to that
authorization. However, as noted above with respect to proposed Sec.
1033.421(b)(4)(ii), exceptional circumstances may justify continued use
and or retention of some or all such data under that standard, even as
new collection, use, and retention stops. For example, a subpoena could
require the retention, post-revocation, of specific data collected pre-
revocation; meeting such legal requirements can continue to remain
reasonably necessary even if only in connection with providing the
product prior to revocation. Similarly, the consumer could provide a
clear, affirmative indication that they want to continue to use the
product, post-revocation, in a manner supported by the use and
retention of data collected prior to revocation. In that context, use
and retention of some or all of the data could meet the general
standard in proposed Sec. 1033.421(b)(4)(ii) even as the consumer no
longer makes use of the product in any manner that would require
continued data collection.
The CFPB has preliminarily determined that proposed Sec.
1033.403(h)(3)(ii), like proposed Sec. 1033.421(b)(4)(ii), provides
third parties with sufficient flexibility to address circumstances in
which continued use or retention of previously collected data might be
justified under the general standard in proposed Sec. 1033.421(a),
while ensuring that consumer data are not used and retained, post-
revocation, in a manner that does not properly reflect the control
afforded the consumer under that same general standard. The CFPB seeks
comment about these circumstances and whether, following revocation,
additional protections for consumers or flexibilities for third parties
are warranted.
[[Page 74841]]
5. Use of Data Aggregator (Sec. 1033.431)
The CFPB is proposing to adopt certain requirements for the third
party authorization procedures when a third party will use a data
aggregator to assist with accessing covered data on behalf of a
consumer. Currently, many third parties rely on data aggregators to
assist with accessing and processing consumer financial data. Proposed
Sec. 1033.431 would assign certain responsibilities for the
authorization procedures and impose certain conditions on the third
party and the data aggregator.
Responsibility for Authorization Procedures
Proposed Sec. 1033.431(a) would allow, but not require, a data
aggregator to perform the third party authorization procedures on
behalf of the third party. Proposed Sec. 1033.431(a) also provides
that the third party remains responsible for compliance with the third
party authorization procedures and that data aggregators must comply
with the data aggregator certification requirements in proposed Sec.
1033.431(c).
The CFPB has preliminarily determined that the third party should
be responsible for compliance with the third party authorization
procedures. The third party is providing a product or service to the
consumer and is likely to have the primary relationship with the
consumer, so the consumer may be more comfortable receiving and
responding to communications from the third party. The third party also
likely would be more involved in using and retaining covered data and
therefore may play a greater role than the data aggregator. Moreover,
the data aggregator is assisting the third party in accessing covered
data, so the CFPB has preliminarily determined that it is appropriate
for the third party to have responsibility for compliance with the
third party authorization procedures.
The CFPB recognizes, however, that some third parties may want to
rely on data aggregators to perform the authorization procedures on
their behalf and that, in some circumstances, it may be more efficient
for data aggregators to do so. Therefore, the CFPB is proposing to
allow, but not require, a data aggregator to perform the authorization
procedures on behalf of a third party. If a data aggregator performs
the authorization procedures on behalf of the third party, the
consumer's authorization would grant authority to the third party to
access covered data on behalf of the consumer. The third party would
retain the flexibility to discontinue using the data aggregator or
switch to a different aggregator.
The CFPB considered proposing a requirement that the data
aggregator be responsible for the authorization procedures. However, a
consumer may not be familiar with the data aggregator or the role that
the data aggregator may play in accessing covered data. The CFPB also
considered allowing data aggregators or third parties to decide which
party would be responsible for compliance with the authorization
procedures or allowing or requiring both third parties and data
aggregators to perform the authorization procedures but has
preliminarily determined that the clearest and least confusing approach
for consumers would be to have the third party seeking access to
covered data be responsible for compliance with the authorization
procedures.
Disclosure of the Name of the Aggregator
Proposed Sec. 1033.431(b) would require that the authorization
disclosure include the name of any data aggregator that will assist the
third party seeking authorization under proposed Sec. 1033.401 with
accessing covered data and a brief description of the services the data
aggregator will provide. Unlike other downstream parties that may
access a consumer's covered data after they have completed the
authorization procedures, a data aggregator is typically known to the
third party at the time of authorization and a consumer may directly
interact with a data aggregator when a data aggregator performs the
authorization procedures on behalf of a third party. Therefore, the
CFPB has preliminarily determined that identifying and describing the
services of a data aggregator would reduce consumer confusion and
better equip consumers to provide informed consent when authorizing
data access. The CFPB seeks comment on any obstacles to including a
data aggregator's name in the authorization disclosure.
Aggregator Certification
Proposed Sec. 1033.431(c) would require that, when a third party
uses a data aggregator to assist with accessing covered data on behalf
of a consumer, the data aggregator must certify to the consumer that it
agrees to the conditions on accessing the consumer's data in proposed
Sec. 1033.421(a) through (f) and the condition in Sec. 1033.421(h)(3)
upon receipt of the notice described in Sec. 1033.421(h)(2) before
accessing the consumer's data.
The CFPB is proposing to require data aggregators to certify that
they agree to these conditions because, when a third party uses a data
aggregator, the aggregator may play a significant role in accessing the
consumer's data. Data aggregators may, among other things, process the
consumer's login credentials, obtain the consumer's data from the data
provider, and transmit the consumer's data to the third party. If data
aggregators were not required to agree to the conditions in proposed
Sec. 1033.421, there could be a significant gap in the protections
afforded to consumers under the proposed rule. In addition, as with the
third party's certification statement,\159\ the CFPB wants the consumer
to receive a clear statement of the conditions that the data aggregator
must follow, and this certification would be helpful in allowing a
consumer and the CFPB and other regulators to enforce these obligations
if the data aggregator breaches these obligations. These considerations
are equally applicable to data aggregators that are retained by the
authorized third party after the consumer has completed the
authorization procedures, so proposed Sec. 1033.431(c) would require
those data aggregators to also provide a certification.
---------------------------------------------------------------------------
\159\ See discussion of proposed Sec. 1033.401(b).
---------------------------------------------------------------------------
Proposed Sec. 1033.431(c) provides that, for this aggregator
certification requirement to be satisfied, either (1) the third party
must include this aggregator certification in the authorization
disclosure it provides the consumer, or (2) the data aggregator must
provide to the consumer a separate certification. For example, the
aggregator certification requirement in proposed Sec. 1033.431(c)
would be satisfied where the authorization disclosure includes a
statement that both the third party and the data aggregator agree to
the third party obligations described in proposed Sec. 1033.421. The
requirement would also be satisfied where the data aggregator provides
the certification to the consumer in a separate communication. When a
data aggregator is retained by the authorized third party after the
consumer has completed the authorization procedures, proposed Sec.
1033.431(c) would not require the consumer to receive a new
authorization disclosure or provide consent. The CFPB seeks comment on
whether to include formatting or language access requirements for an
aggregator certification that is provided in a separate communication
from the authorization disclosure.
6. Policies and Procedures for Third Party Record Retention (Sec.
1033.441)
The CFPB is proposing in Sec. 1033.441, generally, to require a
third party that is
[[Page 74842]]
a covered person or service provider, as defined in 12 U.S.C. 5481(6)
and (26), to establish and maintain policies and procedures reasonably
designed to ensure retention of records that evidence compliance with
proposed subpart D. Proposed Sec. 1033.441 would be authorized under
CFPA section 1022(b)(1) because it would enable the CFPB and others to
evaluate a third party's compliance with proposed subpart D and would
prevent evasion. To the extent that proposed Sec. 1033.441 would apply
to CFPB-supervised nondepository covered persons, it would additionally
be authorized by CFPA section 1024(b)(7) because it would facilitate
supervision of such persons and enable the CFPB to assess and detect
risks to consumers.
Proposed Sec. 1033.441 generally would require third parties to
establish and maintain policies and procedures to retain records for a
reasonable period, not less than three years after a third party
obtains the consumer's most recent authorization under Sec.
1033.401(a). Proposed Sec. 1033.441(b) bases the retention period on
the date of the consumer's most recent authorization because that event
would determine when compliance with proposed subpart D would begin to
be required. The minimum three-year period should be sufficient for the
CFPB and others to evaluate compliance with respect to any given
authorization because proposed Sec. 1033.421(b)(3) would require third
parties to obtain a new authorization each year. The CFPB requests
comment on the proposed length of the retention period and whether it
should be based on another event, such as the termination of a third
party's authorization or a third party's request for information from a
data provider. Proposed Sec. 1033.441 sets forth a flexible approach
by establishing a minimum retention period and by not exhaustively
specifying categories of records, which likely would be infeasible
given the wide range of activities subject to proposed subpart D. Under
proposed Sec. 1033.441(c), a third party would have flexibility to
determine its policies and procedures in light of the size, nature, and
complexity of its activities. This flexibility would help third parties
avoid conflicts with other legal obligations (including other record
retention and data security obligations), manage data security risks,
and minimize unnecessary impacts. To mitigate the risk that the
flexibility of proposed Sec. 1033.441(c) might result in the absence
of critical evidence, proposed Sec. 1033.441(e)(1) and (2) identifies
examples of records that would need to be retained. Further, proposed
Sec. 1033.441(d) would require a third party to commit to periodically
reviewing its policies and procedures and updating them as appropriate
to ensure their continued effectiveness. The flexible policies and
procedures approach of proposed Sec. 1033.441 would be consistent with
the SBREFA Panel's recommendation that the CFPB evaluate record
retention requirements for consistency with other requirements and the
avoidance of unnecessary data security risks, while still ensuring all
evidence of compliance by a third party is retained.\160\ The CFPB
requests comment on whether the final rule should identify other
examples of records to be retained.
---------------------------------------------------------------------------
\160\ SBREFA Panel Report at 45.
---------------------------------------------------------------------------
As described above related to Sec. 1033.421(b) and (h), the CFPB
is proposing to require a third party to no longer retain covered data
following a maximum durational period ending or upon a consumer's
request for revocation, unless retention remains reasonably necessary.
Proposed Sec. 1033.421(b)(4) and (h)(3) are not designed to impact the
requirement of proposed Sec. 1033.441 for a third party to maintain
policies and procedures to retain records for a reasonable period
proposed in Sec. 1033.441, as proposed Sec. 1033.441 covers records
that evidence compliance with proposed subpart D. In contrast, Sec.
1033.421(b)(4) and (h)(3) cover data collected from data providers to
provide a requested product or service. The CFPB seeks comment on
whether additional guidance might be needed on the potential
intersections of the record retention requirements in proposed Sec.
1033.441 and limitations on retention in Sec. 1033.421(b)(4) and
(h)(3).
12 CFR Part 1001
Providing Financial Data Processing Products or Services (Sec.
1001.2(b))
The proposed rule would add Sec. 1001.2(b) to part 1001 to define
providing financial data processing products or services by any
technological means, including processing, storing, aggregating, or
transmitting financial or banking data, alone or in connection with
another product or service, as a financial product or service under the
CFPA. The CFPB preliminarily concludes that the activities in proposed
Sec. 1001.2(b) are already within scope of the CFPA's definition of
financial product or service. Nevertheless, the CFPB is proposing to
use its rulemaking authority to provide even greater certainty on this
issue.
Under CFPA section 1002(15)(A)(xi)(II), the CFPB may issue a
regulation to define as a financial product or service, for carrying
out the objectives of CFPA section 1033, ``such other financial product
or service'' that the CFPB finds is ``permissible for a bank or for a
financial holding company to offer or to provide under any provision of
a Federal law or regulation applicable to a bank or a financial holding
company, and has, or likely will have, a material impact on
consumers.'' The CFPB is proposing Sec. 1001.2(b) pursuant to this
authority.
As noted above, the CFPB's preliminary view is that the activities
in proposed Sec. 1001.2(b) are already within scope of the CFPA's
definition of financial product or service. Specifically, CFPA section
1002(15)(A)(vii) defines as a financial product or service ``providing
payments and other financial data processing to a consumer by any
technological means.'' The language of this provision extends beyond
payment processing to broadly include other forms of financial data
processing, including where the financial data are processed in
connection with other financial or non-financial products or services.
Accordingly, consumers already receive the protections of the CFPA when
entities process their potentially sensitive data, whether payments or
any other category of financial or banking data.\161\
---------------------------------------------------------------------------
\161\ Many of these activities could also fall within other
categories of financial product or service. E.g., CFPA section
1002(15)(A)(ix), 12 U.S.C. 5481(15)(A)(ix) (``collecting, analyzing,
maintaining, or providing consumer report information or other
account information'' under specified circumstances).
---------------------------------------------------------------------------
However, the CFPB is proposing to use its rulemaking authority to
provide even greater certainty on this issue. By conferring authority
on the CFPB to define additional financial products or services, the
CFPA accounts for the possibility that the enumerated list of financial
products and services in CFPA section 1002(15)(A)(i) through (x) may
not completely capture the markets for financial products or services
that are significant for consumers, especially as market developments
lead to emerging concerns for consumers. As already noted, this
proposed rule has the potential to greatly expand access to personal
financial data and subject such data to a wider variety of data
processing activities. The CFPB is thus proposing to add to the
definition of financial product or service the category of ``providing
data processing product or services'' to ensure that activities
involving consumers' potentially
[[Page 74843]]
sensitive personal financial information are subject to the CFPA and
its prohibition on unfair, deceptive, or abusive acts or practices to
the full extent authorized by Congress.\162\ The proposed definition
includes examples to illustrate the breadth of activities that fall
within the term financial data processing. The reference to financial
data processing in connection with another product or service, as
discussed above with respect to CFPA section 1002(15)(A)(vii),
comprises both financial and non-financial products or services.
---------------------------------------------------------------------------
\162\ 12 U.S.C. 5531, 5536.
---------------------------------------------------------------------------
The CFPB preliminarily finds that proposed Sec. 1001.2(b) meets
the two factors set forth in CFPA section 1002(15)(A)(xi)(II). First,
the activities in proposed Sec. 1001.2(b) are permissible for
financial holding companies under the Federal Reserve Board's
Regulation Y and for national banks under OCC regulations. Both
financial holding companies and national banks are permitted to engage,
among other things, in data processing, data storage, and data
transmission services by any technological means, so long as the data
to be processed are financial, banking, or economic.\163\
---------------------------------------------------------------------------
\163\ 12 CFR 225.28(b)(14), 7.5006(a); see also 68 FR 68493,
68495-96 (Dec. 9, 2003) (explaining that 12 CFR 225.28(b)(14)
permits bank holding companies to engage in a ``wide range'' of data
processing activities, including bill pay services, financial data
processing for marketing purposes, and delivering financial products
or services over the internet, among other activities).
---------------------------------------------------------------------------
Second, processing of personal financial information has, or is
likely to have, a material impact on consumers. As already discussed
above in part I, use of personal financial data has become an even more
important part of consumer finance than it was at the time that the
CFPA was enacted in 2010. The processing of this personal financial
data, including storing, aggregating, and transmitting such data, has
the potential to provide benefits to consumers but also expose them to
a number of substantial risks. Financial data processing activities
that are provided to consumers, to the extent they are not already
included within the definition of a financial product or service under
CFPA section 1002(15)(A)(vii), would raise the same type of consumer
protection concerns as activities that do fall within this definition.
Proposed Sec. 1001.2(b) states that it does not apply where the
financial data processing is offered or provided by a person who, by
operation of 12 U.S.C. 5481(15)(A)(vii)(I) or (II), is not a covered
person. CFPA section 1002(15)(A)(vii) provides that a person shall not
be deemed to be a covered person with respect to financial data
processing solely because the person engages in certain narrowly
proscribed processing activities. CFPA section 1002(15)(A)(vii)(I)
excludes as covered persons certain merchants, retailers or sellers of
non-financial products or services that are solely engaged in certain
activities related to initiating payment instructions, whereas CFPA
section 1002(15)(A)(vii)(II) excludes persons that solely provide
access to a host server for websites. The CFPB proposes to parallel
these exclusions in proposed Sec. 1001.2(b).
V. Proposed Effective Date
The CFPB proposes that the establishment of part 1033 and the
amendment to part 1001 shall take effect 60 days after the date of the
final rule's publication in the Federal Register. In the case of part
1033, proposed Sec. 1033.121 provides for staggered compliance dates
for data providers. In the case of the amendment to part 1001, the CFPB
has preliminarily determined that the activities covered by the
amendment are already within the scope of the CFPA's definition of
financial product or service, as explained in part IV, and so no
compliance date is necessary.
VI. CFPA Section 1022(b) Analysis
The CFPB is considering the potential benefits, costs, and impacts
of the proposed rule. The CFPB requests comment on the analysis
presented below, as well as submissions of additional data that could
inform its consideration of the benefits, costs, and impacts of the
proposed rule.
A. Statement of Need
In section 1033 of the CFPA, Congress directed the CFPB to adopt
regulations governing consumers' data access rights. The CFPB is
issuing this proposed rule primarily to begin implementing the CFPA
section 1033 mandate, although the CFPB is also relying on other CFPA
authorities for specific aspects of the proposed rule.
Because the primary purpose of this proposed rule is to implement
section 1033 of the CFPA, the role of this CFPA section 1022(b)
analysis is to evaluate the benefits, costs, and impacts of the
specific policies within the proposed rule and potential alternatives
to those policies. This Statement of Need summarizes the CFPB's
understanding of the gaps between Congress's intended outcome for
consumers' financial data rights and current practices, and describes
the overall goals of the proposed rule in closing those gaps. The
remainder of the CFPA section 1022(b) analysis discusses the benefits,
costs, and impacts of the specific provisions to address these gaps,
and potential alternatives.
Consumers should have control over their financial data, including
accessing their data when desired, and controlling who else can access
their data and for what purposes. When consumers access their financial
data today, they often do not have this control. Consumer financial
data are often accessed through methods that raise data security and
privacy risks and consumers have little to no control over how the data
are used by third parties that have access to it. In addition, there is
a lack of secure, efficient methods for sharing data with third
parties, and data providers may not be motivated to provide in a timely
and readily usable manner all the data fields that consumers want to
access. The result is that access to consumer financial data can be
unreliable, or that financial data held by some providers may be
unavailable to some consumers or their authorized third parties.
When data are made available, there is a general lack of
consistency across data providers in the terms and conditions for
access, and the data formats used. This creates inefficiencies for
market participants, as every connection between a third party and a
data provider requires many detailed terms and conditions to be
negotiated. This often entails substantial levels of cost. This
proposed rule aims to (1) expand access for consumers across a wide
range of financial institutions, (2) ensure privacy and data security
for consumers by limiting the collection, use, and retention of data
that is not needed to provide the consumer's requested service, and (3)
push for greater efficiency and reliability of data access across the
industry to reduce industry costs, facilitate greater competition, and
support the development of beneficial products and services.
B. Data and Evidence
The CFPB's analysis of costs, benefits, and impacts is informed by
data from a range of sources. These include data collected in the
Provider Collection and Aggregator Collection,\164\ as well as data
[[Page 74844]]
obtained from other regulatory agencies \165\ and publicly available
sources.\166\
---------------------------------------------------------------------------
\164\ For information about the data collected in the Provider
Collection and Aggregator Collection, respectively, see Generic
Order for Data Providers, https://files.consumerfinance.gov/f/documents/cfpb_generic-1022-order-data-provider_2023-01.pdf, and
Consumer Fin. Prot. Bureau, Generic Order for Data Aggregators,
https://files.consumerfinance.gov/f/documents/cfpb_generic-1022-order-data-aggregator_2023-01.pdf (both last visited Aug. 28, 2023).
Because data providers and data aggregators vary substantially in
size and business practices, the data from these collections are
likely not representative of the market as a whole. The data are
informative about the practices of some large data providers and a
selection of data aggregators and similar third parties.
\165\ In particular, these include entity-level FFIEC and NCUA
data on characteristics of depository institutions.
\166\ The analysis is informed by academic research papers,
reports on research by industry and trade groups, practitioner
studies, and comment letters received by the CFPB. Where used, these
specific sources are cited in this analysis.
---------------------------------------------------------------------------
In 2016, the CFPB released and received comments on a Request for
Information on consumer rights to access financial data. In 2020, the
CFPB held a symposium titled ``Consumer Access to Financial Records''
and released a summary of the proceedings. Later in 2020, the CFPB
released and received comments on an ANPR. In 2022, the CFPB convened a
SBREFA Panel to gather input from small businesses and in 2023 the
Panel issued the SBREFA Panel Report.\167\ The CFPB also solicited and
received comments from other industry participants on the SBREFA
Outline.\168\ In addition to these sources of information, these impact
analyses are informed by consultations with other regulatory agencies,
industry, and researchers. The CFPB's outreach is described in detail
in part II.
---------------------------------------------------------------------------
\167\ Consumer Fin. Prot. Bureau, Final Report of the Small
Business Review Panel on the CFPB's Proposals and Alternatives Under
Consideration for the Required Rulemaking on Personal Financial Data
Rights (Mar. 30, 2023), https://files.consumerfinance.gov/f/documents/cfpb_1033-data-rights-rule-sbrefa-panel-report_2023-03.pdf.
\168\ Consumer Fin. Prot. Bureau, CFPB Kicks Off Personal
Financial Data Rights Rulemaking (Oct. 7, 2022), https://www.consumerfinance.gov/about-us/newsroom/cfpb-kicks-off-personal-financial-data-rights-rulemaking/.
---------------------------------------------------------------------------
For the types of financial data and access generally covered by
this proposed rule, the information obtained through the Provider
Collection and Aggregator Collection allow the CFPB to estimate: the
number of data providers consumer-authorized data are accessed from;
the number of third parties accessing or using consumer-authorized
data; the number of consumers granting third parties permission to
access data on their behalf; the total number of permissioned access
attempts; as well as information about the technologies used and the
purposes of the permissioned data access. The Provider Collection and
Aggregator Collection also allow the CFPB to estimate the operational
costs of providing direct and third party data access, and the costs of
establishing data access agreements. To maintain the confidentiality of
the respondents to these data collections, the CFPB provides
approximate or bounded estimates derived from these data, rather than
precise totals or figures specific to any one respondent.\169\ The CFPB
seeks additional information or data that could refine these estimates.
---------------------------------------------------------------------------
\169\ The CFPB treats the information received in the Provider
Collection and the Aggregator Collection in accordance with its
confidentiality regulations at 12 CFR 1070.40 et seq.
---------------------------------------------------------------------------
For data on the number and characteristics of covered depository
institutions, the CFPB relies on data from FFIEC and NCUA Call
Reports.\170\ These sources provide quarterly information on the number
of institutions, dollar amount of institution-level assets, number of
deposit accounts, dollar volume of credit card lending, and other
characteristics. Notably, these data provide information on the number
of FDIC- or NCUA-insured deposit accounts, which are an imperfect, but
nonetheless the best available proxy for the number of covered
financial accounts held by depositories. While this measure includes
covered depository accounts, it also includes business accounts and
other accounts that are not covered by the proposal. It also does not
include certain covered financial accounts, such as credit card
accounts and non-bank products. The FFIEC data also provide information
on the websites and digital banking capabilities for banks. The CFPB
supplemented this information with comparable information in NCUA
Profile (Form 4501A) data for credit unions.\171\
---------------------------------------------------------------------------
\170\ See Fed. Fin. Insts. Examination Council, Central Data
Repository's Public Data Distribution, https://cdr.ffiec.gov/ (last
visited Sept. 12, 2023), and Nat'l Credit Union Admin., Credit Union
and Corporate Call Report Data, https://ncua.gov/analysis/credit-union-corporate-call-report-data (last updated Sept. 7, 2023).
\171\ See Nat'l Credit Union Admin., CUOnline, https://ncua.gov/regulation-supervision/regulatory-reporting/cuonline (last visited
Oct. 5, 2023).
---------------------------------------------------------------------------
To estimate costs to small entities of the provisions, the CFPB
relies on information gathered from the SBREFA process. This includes
both written feedback submitted by small entity representatives and the
discussions at the SBREFA Panel summarized in the SBREFA Panel
Report.\172\
---------------------------------------------------------------------------
\172\ Consumer Fin. Prot. Bureau, Final Report of the Small
Business Review Panel on the CFPB's Proposals and Alternatives Under
Consideration for the Required Rulemaking on Personal Financial Data
Rights (Mar. 30, 2023), https://files.consumerfinance.gov/f/documents/cfpb_1033-data-rights-rule-sbrefa-panel-report_2023-03.pdf.
---------------------------------------------------------------------------
C. Coverage of the Proposed Rule
Part VII.B.3 provides a discussion of the number and types of
entities affected by the proposed rule.
D. Baseline for Consideration of Costs and Benefits
In evaluating the proposal's benefits, costs, and impacts, the CFPB
considers the impacts against a baseline in which the CFPB takes no
regulatory action. This baseline includes existing regulations, State
laws, and the current state of the market. In addition, because the
market is still developing rapidly, the analysis assumes that the
market trends toward greater data access and increased adoption of
developer interfaces would continue under the baseline, but assumes no
change in the State laws and regulations currently in effect that are
related to consumers' data access rights for either direct access or
access through third parties.
A large and growing number of consumers currently access their
financial data through consumer-authorized third parties. This access
is provided by a range of technologies, including credential-free APIs,
APIs that require third parties to retain consumer credentials
(credential-based APIs), and credential-based access through consumer-
facing digital banking interfaces such as online banking websites or
mobile applications (screen scraping). As discussed in part I.B, State
of the open banking system, the CFPB estimates that more than 100
million consumers have used consumer-authorized data access,
authorizing thousands of third parties to access their financial data
at thousands of data providers, often through intermediaries such as
data aggregators.\173\
---------------------------------------------------------------------------
\173\ Unless described otherwise, the estimates in this part
VI.D are derived from the total numbers of consumers, connections,
and access attempts reported by data providers in the Provider
Collection and third parties in the Aggregator Collection. These
estimates are necessarily approximate, as the CFPB aims to protect
the confidentiality of the respondents, account for the substantial
share of consumer-authorized data sharing that is not captured by
the respondents, and account for the likely potential overlap in
counts for consumers, connections, and access attempts that involve
respondents to both the Provider Collection and the Aggregator
Collection.
---------------------------------------------------------------------------
In total, the CFPB estimates that there were between 50 billion and
100 billion total consumer-authorized access attempts in 2022.\174\
Usage has grown substantially over the last four years, as the annual
number of consumer-authorized access attempts approximately doubled
from 2019 to 2022.
---------------------------------------------------------------------------
\174\ An access attempt is defined here as an individual
instance in which a single consumer-authorized third party requests
or attempts to pull data about a single consumer's accounts from a
single data provider's systems. Not all attempts will lead to a
successful data transfer, but the number of access attempts is used
as an indicator for the overall size and growth of the open banking
system.
---------------------------------------------------------------------------
[[Page 74845]]
This third party financial data access enables numerous use cases
for consumers. In 2022, data available to the CFPB show that there were
more than two billion access attempts to facilitate payment services,
more than one billion access attempts for the purpose of identity
verification (typically for opening new accounts), tens of billions of
access attempts for account monitoring and personal financial
management use cases, and over one billion access attempts facilitating
other use cases, including fraud risk assessments, loan underwriting,
and asset and income verification.
While the share of consumer-authorized data accessed through
dedicated credential-free APIs has grown sharply, currently most access
attempts rely on either credential-based APIs or screen scraping. As a
share of all access attempts made by firms in the Aggregator
Collection, the use of credential-free APIs has grown from less than 1
percent in 2019 and 2020 to 9 percent in 2021 and 24 percent in 2022.
At the same time, the share of access attempts using screen scraping
has declined from 80 percent in 2019 to 50 percent in 2022. Credential-
based APIs have seen a slight increase from 20 percent in 2019 to 27
percent in 2022.
The recent growth in traffic through credential-free APIs reflects
the adoption of this technology by some of the largest data providers,
covering tens of millions of covered accounts. The CFPB understands
that all depository data providers with more than $500 billion in
assets have established, or in the near future will establish, a
credential-free API. However, despite recent growth, the total share of
data providers offering credential-free access methods remains limited.
The CFPB estimates that at the end of 2022, between 5 and 10 percent of
all data providers offered credential-free APIs, up from less than 1
percent in 2021. The CFPB understands that the adoption of credential-
free APIs by core banking service providers and other vendors that
serve hundreds of smaller depository institutions contributed to this
growth.\175\ While adoption is relatively high for the largest
depository data providers, the CFPB estimates that only between 10 and
20 percent of depositories with more than $10 billion in assets had
credential-free APIs at the end of 2022.
---------------------------------------------------------------------------
\175\ For example, see Press Release, Jack Henry Partners with
Open Banking Providers to Enhance Digital Platform (Oct. 12, 2021),
https://ir.jackhenry.com/news-releases/news-release-details/jack-henry-partners-open-banking-providers-enhance-digital.
---------------------------------------------------------------------------
The future evolution of the marketplace enabled by the exchange of
consumer financial data is, of course, uncertain. However, based on the
data and market trends available, the CFPB makes the following
assumptions for the baseline in this impact analysis. First, most of
the very largest data providers have adopted or likely would in the
near future adopt credential-free APIs, which would meet many--but
possibly not all--requirements contained in the proposal. Awareness of
CFPA section 1033 may have contributed to these outcomes, though
adoption is also influenced by data providers' desire to shift third
party access away from screen scraping and towards more secure and
efficient technologies, as well as the demand for third party access
from data providers' customers. Some share of smaller institutions
would adopt credential-free APIs, depending on their technology and
business models, over a longer-term horizon. Based on past trends,
larger institutions would be more likely to adopt such interfaces
sooner. However, adoption may be easier for (1) depositories whose
systems are already well integrated with large core banking or online
banking service providers and (2) nondepositories and newer
depositories that do not have complex legacy systems, irrespective of
the sizes of these types of institutions. In addition, in the current
market some data providers block screen scraping access under certain
circumstances, including for third party risk management, and the CFPB
expects this would continue under the baseline.
The CFPB understands that all or most data providers and third
parties seeking to access consumer-authorized information are subject
to the GLBA, specifically either the FTC's Safeguards Rule or the
Federal functional regulators' Interagency Guidelines. Additionally,
third parties that operate in one of the 11 States with consumer data
privacy legislation may be subject to other data security requirements
and data usage restrictions. These State laws have all been passed
since 2018. As described in part I.E.2, some third parties have
obligations under the FCRA. Depository data providers also have third
party risk management obligations required by their prudential
regulators, which will impose data security requirements on third
parties seeking to access consumer-authorized data. As a result, at
baseline, the CFPB expects that many third parties are already subject
to statutory and regulatory data privacy and security obligations, and
third parties have adopted or would adopt some basic standards related
to risk management, data security, and data use. These standards likely
have some degree of overlap with the requirements in the proposed rule,
though individual company systems or policies will depend on the size,
location, practices, and other circumstances of each third party.
The impact analysis generally includes the major elements of costs
to firms of complying with the proposed rule. It also includes a
discussion of how some of these costs likely would have been borne
under the baseline as data providers either would have adopted or
already have adopted systems or policies similar to those required by
the proposed rule. For example, where data providers have adopted some
form of credential-free third party access under the baseline, the
analysis discusses how the proposal would impact the terms, costs, and
features of those interfaces.
Finally, in the context of direct access, all non-exempt data
providers offer some digital banking interface and the CFPB assumes for
its baseline that these interfaces typically provide all or nearly all
data fields required to be made available by the provisions. The
analysis considers how the provisions would impact the costs and
features of those digital banking interfaces. Those covered entities
that do not offer any form of digital banking would be exempt from the
proposed rule's requirements.
E. Potential Benefits and Costs to Consumers and Covered Persons
The analysis below describes the potential benefits and costs to
consumers and covered persons in the following order: costs to data
providers, costs to third parties, costs to consumers, benefits to data
providers, benefits to third parties, benefits to consumers, and
alternatives considered.
Individual provisions of the proposed rule may have costs for some
groups and benefits for others. And some provisions interact with one
another, preventing them from being analyzed in isolation. As a result,
the discussion of costs for one group will not provide the net impacts
of a particular provision or of the proposed rule as a whole. The net
impacts depend on the combination of costs and benefits across data
providers, third parties, and consumers.
1. Costs to Covered Persons
Costs to Data Providers
As a result of the proposed rule, data providers may face increased
costs
[[Page 74846]]
related to maintaining consumer interfaces and establishing and
maintaining developer interfaces, including modifying their existing
systems to comply with the proposed rule. The CFPB expects the largest
costs to data providers to come from establishing and maintaining
compliant developer interfaces. Covered data providers would also incur
costs related to developing and implementing policies and procedures
governing those systems. The proposed rule may have additional costs to
covered data providers related to changes in the frequency, scope, or
method of consumer-authorized data access relative to the baseline.
These changes may have secondary effects on the profitability of
certain business models or practices, including by facilitating
competition and enabling new products and services.
Maintaining an Interface for Direct Consumer Access
The proposed rule would require data providers to make covered data
available through consumer interfaces and to allow consumers to export
the information in machine-readable formats. Data providers that do not
offer a consumer interface would be exempt from the requirements of the
proposed rule. During the SBREFA Panel meetings, the CFPB received
feedback that certain categories of information under consideration in
the SBREFA Outline are not typically made available directly to
consumers, and thus would be costly to provide.\176\ Based on this
feedback, the proposed rule would cover a more limited set of
information, which the CFPB understands is currently provided through
existing consumer interfaces by all or nearly all data providers.
Therefore, for most data providers, the CFPB expects limited additional
costs due to the proposed rule's direct consumer access requirements.
For those data providers that do not provide all required information
under the baseline, the CFPB expects that such information could be
added at relatively low cost because the required information is
generally already necessary for compliance with other regulatory
requirements, like account opening disclosures. The CFPB does not have
sufficient data to quantify the levels of these costs. The CFPB
requests data or information on whether any of the required data fields
are not provided through consumer interfaces, as well as on the costs
of adding such fields to consumer interfaces.
---------------------------------------------------------------------------
\176\ SBREFA Panel Report at 24.
---------------------------------------------------------------------------
Establishing and Maintaining an Interface for Third Party Access
The proposed rule would require data providers to establish and
maintain a compliant developer interface. Although many data providers
already maintain developer interfaces, others would need to establish
new interfaces, likely integrated with existing infrastructure that
supports their consumer interfaces. The CFPB expects that the costs of
modifying an existing developer interface to ensure compliance with the
proposed rule would depend on the scope and nature of the necessary
modifications but would generally be lower than the cost of
establishing a new interface.\177\
---------------------------------------------------------------------------
\177\ For example, some data providers with existing interfaces
may need to provide additional data fields, change the way their
data are formatted, or make additional investments to ensure their
interfaces meet the performance specifications required by the
proposed rule.
---------------------------------------------------------------------------
In general, data providers must either contract with a vendor for
their developer interfaces or develop and maintain such interfaces in-
house. The analysis below estimates compliance costs under these two
approaches. Some data providers may comply with the proposed rule
through a combination of contracted services and in-house development.
Because data providers will generally choose the lowest-cost approach,
their costs will generally be at or below the lower of the two feasible
alternatives analyzed here.
The CFPB understands that data providers' costs depend on many
factors and the extent to which they vary is impossible to fully
capture. To produce cost estimates that are practical, meaningful, and
transparent, where feasible, the CFPB estimates initial upfront costs
and annual costs that generally scale with the size of the data
provider for each of the contracted services and in-house approaches.
All else equal, a data provider's annual cost per account or per
customer is likely to decrease with a greater number of accounts or
customers due to economies of scale. During the SBREFA process and in
the Provider Collection, some data providers provided cost estimates
per account while others estimated costs per customer. Therefore, the
analysis below discusses estimates of the annual cost per account or
per customer of operating a compliant developer interface that are
likely to be appropriate for data providers of different sizes.
Under the contracted services approach, data providers would
primarily contract with a vendor for their developer interface. At
baseline, many covered data providers contract with core banking
providers or other vendors for transaction processing, online banking
systems, or other key banking functions. Some core banking providers
currently offer services to enable developer interfaces for data
providers. The CFPB understands that some large core banking providers
provide their clients with a basic developer interface at no additional
cost.\178\ Based on comments received during the SBREFA process and
market research, the CFPB understands that other core banking providers
charge flat monthly fees or per-account fees.\179\ The CFPB understands
that these fees vary but generally estimates that fees can be up to $24
per account per year.\180\ The CFPB requests information related to the
developer interfaces offered by core banking providers and other
vendors and how such interfaces are priced.
---------------------------------------------------------------------------
\178\ For example, see Jack Henry & Assocs., Inc., Secure Data
Connection: take back control of account connection, https://banno.com/data-aggregators/ (last visited Aug. 7, 2023).
\179\ SBREFA Panel Report at 37.
\180\ Id. at 38.
---------------------------------------------------------------------------
Data providers taking this approach will generally have minimal
upfront costs to deploy a developer interface. However, some data
providers use service providers that do not currently offer a developer
interface. Although other options exist and the CFPB expects service
providers would face strong competitive pressure to offer compliant
developer interfaces to their clients, the lowest cost option for some
data providers may involve changing their core banking provider. The
fixed costs of changing core banking providers can be high. Several
small entity representatives stated that the upfront costs at a new
core banking provider can range from $50,000 to $350,000 depending on
the scale and complexity of the system, with up to $200,000 in
additional decommissioning costs to retrieve information from the old
core banking provider. Based on its market research, the CFPB
understands that core banking providers that offer a developer
interface have a combined market share exceeding 67 percent.\181\
Therefore, at most, 33 percent of depository data providers would need
to change core banking providers to obtain a compliant interface that
is bundled with their other core banking services. However,
[[Page 74847]]
the CFPB expects that the true share of depository data providers that
pay these costs will be much lower than 33 percent. Data aggregators
and other software vendors offer developer interfaces and the CFPB
expects that some data providers will obtain their interfaces through
these channels and will not need to change their core banking provider.
Furthermore, core banking providers will face strong competitive
pressure to offer compliant developer interfaces to retain their
clients and potentially capture additional market share. The CFPB
expects that these forces are likely to cause the cost of obtaining
compliant interfaces to decline over time, which may reduce compliance
costs most substantially for small depository data providers, given
that they have the latest compliance date.
---------------------------------------------------------------------------
\181\ See Fiserv, Finicity and Fiserv Offer More Consumer Choice
Through Secure Data Access (Mar. 30, 2022), https://newsroom.fiserv.com/news-releases/news-release-details/finicity-and-fiserv-offer-more-consumer-choice-through-secure.
---------------------------------------------------------------------------
Under the in-house approach, data providers would primarily employ
software developers or similar staff to build and operate their
developer interfaces. The estimates below are based on a fully in-house
development of a compliant developer interface. Some data providers may
instead contract with software providers for the initial development of
their in-house developer interface. The CFPB anticipates that data
providers would purchase their systems only if they could do so at a
lower cost than the estimate provided here.
The CFPB expects that most data providers that already develop and
maintain consumer interfaces in-house would also develop and maintain
their developer interface in-house.\182\ In the SBREFA Outline, the
CFPB estimated that developing a compliant developer interface would
likely require between 2,600 and 5,200 hours of work by software
developers or similar staff, equivalent to five full-time employees
over a period of three to six months, resulting in an estimated total
upfront staffing cost of $216,000 to $432,000, updated to $237,000 to
$475,000 based on more recent labor cost data.\183\ However, these
estimates strongly depend on the needs and capabilities of specific
entities. For example, based on feedback from nondepository small
entity representatives, the CFPB estimates that nondepository data
providers may require only 480 hours of work by software developers at
a total cost of $44,000.\184\ In addition to these upfront costs, the
CFPB estimates that data providers taking the in-house approach incur
ongoing costs of $3 to $5 per account per year to maintain a compliant
developer interface in-house, based on evidence from the Provider
Collection described below.
---------------------------------------------------------------------------
\182\ As discussed below, data providers have generally
indicated that the resources required to maintain a developer
interface in-house are a small fraction of the resources required
for consumer interfaces. Therefore, the CFPB expects that data
providers that have already invested in the capacity to operate a
consumer interface in-house will take a similar approach to
developer interfaces. However, it is likely that some data providers
will find it less costly to contract with service providers. As the
industry develops, it is possible that it will become more common
for data providers to obtain developer interfaces from service
providers.
\183\ This estimate was derived from BLS data showing a mean
hourly wage for software developers of $63.91. BLS data also show
that wages account for 70 percent of total compensation for private
industry workers, leading to a $91.30 estimate for total hourly
compensation, which was multiplied by the expected total number of
hours of work required.
\184\ Costs for depository and nondepository data providers are
likely to differ for several reasons, including that depository data
providers are generally more likely to have multiple legacy
information technology systems that are more technically difficult
to integrate with a developer interface.
---------------------------------------------------------------------------
During the SBREFA Panel meetings, data provider small entity
representatives stated that establishing a compliant developer
interface would require developing multiple internal APIs because their
data are stored on three to eight separate information technology
systems, most of which are not currently connected to their core
banking system.\185\ Depository small entity representatives estimated
that each of these internal APIs could cost approximately $60,000 in
upfront staffing costs and $20,000 in ongoing technology costs.\186\
Nondepository small entity representatives estimated lower upfront
staffing costs, of 240 to 480 hours, or $22,000 to $44,000. Although
nondepository small entity representatives did not estimate ongoing
technology costs, the CFPB expects these costs will generally also be
smaller than costs for depository small entity representatives.\187\
Based on this feedback, the proposed rule would require a more limited
set of information to be provided, relative to those under
consideration in the SBREFA Outline. The proposed rule's approach
should significantly reduce the need for new internal APIs,
particularly since the categories of information included in the
proposed rule largely align with those available through consumer
interfaces at most data providers.
---------------------------------------------------------------------------
\185\ SBREFA Panel Report at 37.
\186\ Id.
\187\ One data provider small entity representative that
recently implemented an API explained that it and its vendors had
spent approximately 50-60 hours understanding the requirements and
planning, 50-60 hours creating the database, 80 hours prototyping
for optimization and security, and 40 hours testing and documenting,
or roughly 220-240 hours to develop and implement the API, in
addition to ongoing hardware and cloud hosting expenses. Two
nondepository data provider small entity representatives estimated
that it would take one internal staff member approximately 12 weeks
to comply with the proposed rule. Other small entity representatives
stated that implementation would likely be less difficult for
nondepository data providers because they do not have as many
vendors or separate information technology systems.
---------------------------------------------------------------------------
Some small entity representatives stated that the CFPB's original
estimate in the SBREFA Outline of $216,000 to $432,000 was too low, and
one small entity representative estimated that the cost was likely to
be above $500,000.\188\ However, changes in the proposed rule should
significantly reduce the need for new internal APIs, which was a
primary component of these higher estimated costs. Therefore, the CFPB
estimates a total upfront cost of $250,000 to $500,000 for small
depository data providers that choose to build their developer
interface in-house. Small nondepository data providers are likely to
have somewhat smaller upfront costs. Based on small entity
representative feedback, the CFPB estimates that small data providers
choosing to build their developer interface in-house will incur ongoing
annual technology costs of $20,000 as well as ongoing staffing costs of
$45,000 to $91,000.\189\
---------------------------------------------------------------------------
\188\ SBREFA Panel Report at 37-38.
\189\ The CFPB estimates that small data providers choosing the
in-house approach would require 500 to 1,000 hours per year of staff
time by software developers. BLS data from May 2022 shows a mean
hourly wage for software developers of $63.91. BLS data also show
that wages account for 70 percent of total compensation for private
industry workers, leading to a $91.30 estimate for total hourly
compensation, which was multiplied by the expected total number of
hours of work required.
---------------------------------------------------------------------------
The Provider Collection contains information on costs for a sample
of large depository data providers. This complements the information on
costs for small data providers gathered through the SBREFA process. For
context, data provider small entity representatives generally may have
up to a few tens of thousands of accounts, while data providers in the
Provider Collection have millions of accounts.
In the Provider Collection, several data providers stated that it
was difficult to disaggregate the costs of developer interfaces from
their consumer interfaces and other information technology systems.
These data providers also generally provided estimates of ongoing
annual costs or total costs since the deployment of their developer
interfaces, rather than upfront costs to build an interface. Reported
estimates of the cost of establishing and maintaining a developer
interface varied widely, from $2 million to $47 million per year, with
a median of $21 million
[[Page 74848]]
per year. Of the data providers providing disaggregated estimates, the
median cost of developer interfaces as a share of the cost of their
consumer interfaces was 2.3 percent. An additional data provider did
not provide a disaggregated estimate but reported their developer
interface constituted a ``small portion of the total consumer-portal
costs.''
These data providers are larger and more complex than most data
providers. Therefore, the CFPB adopts the cost of a compliant developer
interface per account as the relevant metric for estimating the costs
for data providers generally. The reported cost of an in-house
developer interface per customer or account ranges from $0.25 to $8 per
year, with a median of $3.37 per year, substantially lower than the $24
per year reported by small entity representatives as the potential cost
for the contracted services approach. Within the sample, the per
account cost generally declined as the number of accounts
increased.\190\ Based on this evidence, the CFPB estimates that annual
costs per account to maintain an in-house developer interface are
likely to be approximately $3 for large depository data providers and
$5 for medium-sized depository data providers. Although the Provider
Collection sample is relatively limited, the pattern of per-account
costs declining with the number of accounts suggests that--relative to
the alternative of contracting for a developer interface--data
providers developing and maintaining interfaces in-house likely have
larger upfront fixed costs but smaller ongoing per account costs. These
estimated costs are generally for depository institutions rather than
nondepositories. Given feedback from small entity representatives of
nondepository institutions that would qualify as data providers under
the proposed rule, the CFPB expects that nondepository data providers
would generally have less need to integrate across multiple systems and
would be less likely to have legacy software that is difficult to
update, resulting in lower costs on average. The CFPB requests
additional data on the cost of developing and maintaining compliant
developer interfaces compared to contracting with a service provider.
---------------------------------------------------------------------------
\190\ For the data providers in the Provider Collection that
provided both cost estimates and numbers of accounts, there was a
negative correlation coefficient of approximately -0.6 between per
account costs and number of accounts.
---------------------------------------------------------------------------
The estimates above relate to the costs of developing and
maintaining a developer interface for data providers without such
existing interfaces. Covered data providers with existing developer
interfaces that are not fully compliant with the proposed rule would
incur smaller costs to modify their interfaces and existing third party
access agreements to align with the requirements of the proposed rule.
The cost for such covered data providers would depend on the extent to
which their developer interfaces do not comply with the requirements of
the proposed rule. Without granular data on the nature of partially
compliant interfaces, the CFPB cannot provide a precise estimate of the
cost of bringing such systems into compliance with the proposed rule.
However, that cost would generally be a fraction of the cost of
developing and maintaining a new interface, as described above.
The CFPB seeks comment or additional data on the extent to which
existing developer interfaces will need to be modified to meet the
requirements of the proposed rule and the cost of required
modifications relative to the cost of establishing a new compliant
developer interface.
Developing and Implementing Policies and Procedures
The proposed rule would include disclosure and recordkeeping
requirements for all covered data providers related to consumer-
authorized data access. The proposed rule would require data providers
to tally and disclose the number of proper responses divided by the
total number of queries to their developer interface (the ``response
rate'') on a monthly basis. The CFPB understands that a variety of
performance metrics, including the response rate, may be calculated in
the normal course of operating an API or other digital interface for
diagnostic purposes. Therefore, the cost of this provision is included
in the cost of developing and maintaining a compliant developer
interface estimated above. Data providers may incur an additional
upfront cost of developing and testing a system to regularly disclose
required performance metrics on their website. The CFPB estimates that
this process would take less than 80 hours of staff time at an
estimated cost of $7,300 per data provider.\191\ The CFPB expects that
once the disclosure system is implemented it would be maintained at
minimal incremental cost as part of the overall cost of operating data
providers' websites.
---------------------------------------------------------------------------
\191\ This estimate was derived from BLS data showing a mean
hourly wage for software developers of $63.91. BLS data also show
that wages account for 70 percent of total compensation for private
industry workers, leading to a $91.30 estimate for total hourly
compensation, which was multiplied by the expected total number of
hours of work required.
---------------------------------------------------------------------------
The proposed rule would require data providers to have policies and
procedures such that the developer interface is reasonably designed to
ensure that data are accurately transferred to third parties. The CFPB
expects that data providers would comply with this requirement as part
of establishing and maintaining a compliant developer interface.
Therefore, the costs of ensuring that the developer interface is
reasonably designed to transfer data accurately are included in the
analysis above.
The proposed rule would also require data providers to have
policies and procedures reasonably designed to ensure that the reason
for the decision to decline a third party's request to access its
developer interface is communicated to the third party. The
requirements to inform third parties when and why access was not
permitted would likely be built into a data provider's developer
interface, as automated responses to third party data access requests.
Similarly, the requirements to retain records to demonstrate compliance
with certain requirements of the proposal would likely be built into a
data provider's developer interface. As a result, the CFPB considers
the costs of complying with these requirements as part of the overall
costs of implementing a compliant developer interface, as described
above. The CFPB has previously estimated that developing policies and
procedures to comply with a rule of similar complexity would require a
one-time cost of $2,500 to $4,300 per data provider, as well as a one-
time cost of $3,000 to $7,600 for a legal and compliance review.\192\
Therefore, the CFPB estimates a total one-time cost of developing and
implementing policies and procedures as required by the proposed rule
of $5,500 to $11,900 per data provider.
---------------------------------------------------------------------------
\192\ 86 FR 56356, 56556 (Oct. 8, 2021).
---------------------------------------------------------------------------
Indirect Costs
In addition to the direct costs described above, data providers are
likely to incur indirect costs as a result of the proposed rule. The
CFPB expects costs related to negotiating additional agreements with
third parties relative to baseline as well as changes in the frequency,
scope, or method of consumer-authorized data access relative to the
baseline. These changes may have secondary effects on the profitability
of certain business models or practices, including by facilitating
[[Page 74849]]
competition and enabling new products and services.
Increased Number of Agreements Between Data Providers and Third Parties
The proposed rule generally would require data providers to grant
access to their developer interface, except for reasonable denials
related to risk management or insufficient information. Although the
proposed rule does not require formal data access agreements, the CFPB
expects the proposed rule to lead to more third parties requesting and
being granted access to data providers' developer interfaces relative
to the baseline and that this is likely to require data providers to
negotiate more agreements with third parties. In the Aggregator
Collection responses, aggregators reported that negotiating a data
access agreement with a data provider could take between 50 and 4,950
staff hours for business relationship managers, software developers,
lawyers, compliance professionals, and senior management, depending on
the complexity of the negotiation. The median estimated time was 385
staff hours per agreement. The CFPB expects that data providers
currently spend roughly equivalent time and resources negotiating and
signing data access agreements at baseline.
These costs are likely to decrease under the proposed rule relative
to the baseline because many features of data access agreements would
be regulated by the proposed rule and not subject to negotiation,
including requirements for interface reliability, the scope of data
accessible via the interface, authorization procedures, and the
duration of access to consumers' covered data. One firm in the
Aggregator Collection stated that in cases where data providers agree
to use existing industry-defined standards there is essentially no need
for negotiation. The CFPB expects that under the proposed rule nearly
all data providers will use standardized agreements and the costs of
establishing data access will generally be limited to ensuring third
party risk management standards are satisfied and reviewing the
agreements. The CFPB expects that this process will require 80 staff
hours on average, representing approximately $6,800.\193\ These costs
may be further reduced if industry accreditations or standards develop
which streamline data providers' required efforts on third party risk
management. While some data providers and third parties may choose to
negotiate customized data access agreements, they will generally only
do so when the perceived benefits exceed the costs described here.
Because the choice to negotiate a costly but more customized data
access agreement is a business decision not required by the proposed
rule, the additional costs of doing so are outside the scope of this
analysis.
---------------------------------------------------------------------------
\193\ This estimate was derived from BLS data showing a mean
hourly wage for compliance officers ($37.01), general and operations
managers ($59.07), lawyers ($78.74), and software developers
($63.91), for an average hourly wage of $59.68. BLS data also show
that wages account for 70 percent of total compensation for private
industry workers, leading to an $85.26 estimate for total hourly
compensation, which was multiplied by the expected total number of
hours of work required.
---------------------------------------------------------------------------
The total cost of negotiating additional agreements will depend on
the difference between the number of agreements that would be
negotiated under the baseline and the number that would be negotiated
under the proposed rule. Because the consumer-authorized data system is
developing rapidly, it is not possible to precisely estimate the number
of additional connections that would be caused by the proposed rule.
However, in the near term, the CFPB anticipates that most data
providers will continue to offer third parties access to consumer-
authorized data through specialized intermediaries, as they would have
under the baseline. As a result, the CFPB expects that, on average,
large data providers will need to negotiate 10 or fewer additional data
access agreements in the years immediately following implementation of
the proposed rule, at a maximum cost of $68,000 per large data
provider. In contrast, smaller entities are likely to rely on core
banking providers or other vendors to negotiate aspects of the
agreements on their behalf at minimal incremental cost. Over time, data
providers are likely to negotiate additional data access agreements due
to entry by new third parties and other changes in the market.\194\ The
CFPB requests comment on how the proposed rule is likely to change both
the cost of establishing data access agreements and the number of data
access agreements negotiated by data providers.
---------------------------------------------------------------------------
\194\ For example, the proposed rule aims to accelerate the
development and adoption of qualified industry standards covering
myriad aspects of open banking. This would likely reduce the
frictions and costs associated with establishing and maintaining
connections between data providers and third parties, potentially
increasing the number of access agreements negotiated by data
providers.
---------------------------------------------------------------------------
Prohibition on Fees for Access
The proposed rule would not permit data providers to charge fees
for the required interfaces or for access to covered data through their
interfaces. To the extent that data providers are currently charging
such fees, the proposed rule would eliminate these revenues. Based on
the Aggregator Collection, the Provider Collection, and its market
research, the CFPB understands that fees for consumer and third party
access are currently rare.
The CFPB understands that third parties have in some cases made
payments to data providers to incentivize data providers that are
reluctant or unable to provide a developer interface of sufficient
quality sufficiently quickly. While rare in the current market, the
proposed rule would eliminate such fees that may have been charged in
the future under the baseline.
The CFPB does not have representative data on the prevalence or
size of payments to data providers and therefore cannot precisely
estimate the cost of eliminating them. However, as described above, the
information available to the CFPB indicates that few data providers
currently charge third parties for access to their interfaces and that
the total cost to data providers of eliminating such charges would be
minimal.
More Frequent Access--Third Parties Allowed To Make More Frequent Data
Queries
Based on responses to the Provider Collection, the CFPB is aware
that covered data providers sometimes impose access caps, such as
limiting the number of allowable data requests or the frequency with
which authorized third parties can access consumer data. For example,
the CFPB understands that data providers cap the number of data
requests per day per connection. The proposed rule would generally
prohibit a data provider from unreasonably restricting the frequency
with which it receives and responds to requests for covered data from
an authorized third party through its developer interface. All else
equal, this is likely to increase total data requests and may therefore
increase digital infrastructure costs for covered data providers
relative to baseline.\195\ This increase is likely to be larger for
data providers with more restrictive access caps at baseline. The CFPB
expects that for most data providers, the increase in traffic due to
such increases in the number of data requests will generally be more
than offset by declines in screen scraping, which the CFPB understands
to typically involve heavier traffic loads
[[Page 74850]]
per request than requests through a developer interface. A small number
of large data providers have already restricted screen scraping and may
experience net increases in developer interface traffic. In general,
the CFPB expects that incremental costs from increased data requests
are likely to be minimal on a per-account basis. The CFPB requests data
or other information that would inform its estimates of the cost of
additional data requests through a developer interface.
---------------------------------------------------------------------------
\195\ As discussed in the Benefits to data providers section,
other features of the proposed rule are likely to decrease the
frequency and scope of data requests and therefore digital
infrastructure costs for covered data providers.
---------------------------------------------------------------------------
Reduced Information Advantages
Through their role in providing financial products and services,
data providers possess ``first party'' data on the accounts held by
their customers. These data are a valuable source of information for
data providers in developing, pricing, and marketing products and
services, but authorized data access may reduce this information
advantage. The proposed rule would generally increase third party
access relative to the baseline and thus diminish data providers'
informational advantages from first party data. This may enable third
parties to more effectively compete with products or services offered
by data providers, potentially limiting the prices data providers can
charge for their own products and services or reducing data providers'
market shares or data providers' profits. For example, the CFPB
understands that an important use case for consumer-authorized
financial data is transaction-based underwriting. At baseline, many
data providers sell credit products to their depositors. To the extent
that the proposed rule facilitates entry into the lending market or
improves the quality of the products and services offered by
nondepository lenders or other depository lenders that use consumer-
authorized data, data providers may lose market share and therefore
profits. As another example, consumer-authorized data sharing is likely
to facilitate faster new account openings. As it becomes easier for
consumers to compare account terms, transfer recurring payments, move
funds, and have their identity verified, depository data providers may
face pressure to pay higher deposit rates or make costly investments in
service quality in order to retain deposits, as discussed in the
Benefits to Consumers section.
In general, accurately predicting how changes in the availability
of consumer-authorized financial data will change the structure of the
market for consumer financial services or how changes in market
structure will impact the profitability of individual firms or
industries is very difficult, in large part because firms that are data
providers in some cases also operate as third parties accessing data
from other data providers, and the CFPB expects more data providers to
act as third parties over time. As a result, the CFPB is not able to
quantify the impacts of reduced informational advantages that stem from
the proposal. The CFPB requests additional data or information that
would inform this analysis.
The proposed rule is likely to increase the quality of services
that use consumer-authorized financial data to facilitate competition,
including by comparing or recommending products or services to
consumers. This may impact data providers. For example, a consumer
might use a comparison shopping service that would recommend credit
cards likely to minimize their costs from interest and fees or maximize
their benefits from rewards programs given their historical spending
patterns. The CFPB is not able to accurately predict how many firms
would develop services that facilitate competition in this way, how
many consumers would opt in to such services, or how the availability
of such services would impact individual firms or industries. The CFPB
requests any additional data or information that would inform its
analysis of this impact on data providers.
Costs to Third Parties
Third parties would be required to modify existing procedures, so
they are consistent with the proposal's authorization procedures for
accessing covered data on behalf of a consumer, such as providing the
authorization disclosure; implementing the limitations on data
collection, use, and retention; developing mechanisms for revocation of
authorization; providing the annual reauthorization of access; and
executing record retention requirements. In addition to these upfront
and ongoing compliance costs, the proposed rule may impose further
costs on third parties through the transition away from screen scraping
access and restrictions on data use and retention. Potential effects of
the new financial data processing products or services definition are
also discussed.
Implementing Mechanisms for Revocation of Authorization
The proposed rule would require third parties to establish and
maintain systems that could receive data access revocation requests,
track duration-limited authorizations, and delete data when required
due to revoked authorizations, lapsed authorizations, or because
retaining the data is no longer reasonably necessary. Third parties
would also need to retain records as required by the proposed rule.
Many of these requirements overlap with the requirements of other State
or international data privacy laws. For example, third parties that
operate in the State of California and have gross annual revenues
greater than $25 million may already have similar systems if they are
subject to the California Consumer Privacy Act (CCPA),\196\ which
requires that businesses delete consumer personal data upon consumer
request. These third parties would likely need to modify their systems,
incorporate authorization duration limits, and process more revocation
requests, but they would likely have lower costs than third parties
that must establish such a system from scratch. The CFPB estimated in
the SBREFA Panel Report that establishing and maintaining an
appropriate data system would cost up to $75,000 based on analysis of
the Standardized Regulatory Impact Assessment for the CCPA.\197\
---------------------------------------------------------------------------
\196\ Cal. Civ. Code section 1798.198(a) (2018).
\197\ The Standardized Regulatory Impact Assessment for the CCPA
estimated that the average technology cost would be $75,000.
However, the CFPB estimates that the cost for many third parties
would be lower, as the CCPA figure was based on a survey of the top
one percent of California businesses by size (those with more than
500 employees), and the CCPA has more requirements than the proposed
rule. See Off. of the Att'y Gen., Cal. Dep't of Just., Standardized
Regulatory Impact Assessment: California Consumer Privacy Act of
2018 Regulations (Aug. 2019), https://dof.ca.gov/wp-content/uploads/sites/352/Forecasting/Economics/Documents/CCPA_Regulations-SRIA-DOF.pdf.
---------------------------------------------------------------------------
As described in the SBREFA Panel Report, several small entity
representatives provided cost estimates of implementing deletion
requirements. At the low end, one third party small entity
representative that had implemented deidentification and deletion
systems stated that it took between 240 and 480 hours,\198\ and another
third party small entity representative stated that it developed a
system to comply with the CCPA in about 480 hours. At the high end, one
third party small entity representative estimated that building a
system for information deletion would take 1,000 hours. If a third
party chose not to establish a system to implement the deletion
requirements of the proposed rule and instead chose to manually delete
data, the CFPB understands that the time cost would be substantially
[[Page 74851]]
higher: one third party small entity representative explained that, as
an organization of fewer than 50 people, complying with a single
deletion request could require 480 hours. Based on this feedback, the
CFPB estimates that the cost of implementing deletion requirements
would be between $21,900 and $91,300.\199\ The CFPB expects that the
cost would be lower for third parties that already comply with existing
data privacy laws. The CFPB requests additional data or other
information to further refine this estimate. Third parties that do not
retain any consumer-authorized data would be unaffected by these
requirements.
---------------------------------------------------------------------------
\198\ The small entity representative reported that the task
took its team two to four weeks. Based on other small entity
representative team sizes, the CFPB assumes that the team included
three people.
\199\ The CFPB assumes that implementing deletion requirements
would require between 240 and 1,000 hours of work by a software
developer. The cost estimate was derived from BLS data showing a
mean hourly wage for software developers of $63.91. BLS data also
show that wages account for 70 percent of total compensation for
private industry workers, leading to a $91.30 estimate for total
hourly compensation.
---------------------------------------------------------------------------
Annual Reauthorization Process
The proposed rule would limit the duration of third party
collection of covered data to no more than one year after a consumer's
most recent authorization. Third parties would be required to obtain a
new authorization from the consumer before the first anniversary of the
consumer's most recent authorization to continue to collect the
consumer's covered data without disruption. Because the new
authorization would have the same legal requirements as the first
authorization, most of its implementation costs would be captured by
the costs described above for the initial authorization and data
retention systems. The CFPB expects that reauthorization reminders will
typically be delivered electronically--such as a within-app
notification or an email--at minimal additional direct cost.
The reauthorization and retention requirements may limit the
quality of data available for product improvement or other permissible
uses of data. Some third parties may experience indirect costs due to
service disruptions if they do not obtain a new authorization from the
consumer before the anniversary of the consumer's most recent
authorization, as they would not be able to request the consumer's data
from data providers until the new authorization was obtained if more
than one year has passed since the most recent authorization. Any gaps
in the third party's collection of consumer data would likely be filled
once it obtains the new authorization, as the third party could then
access two years of retrospective data.
The costs associated with the reauthorization requirement will
depend on the third party's business model. Two small entity
representatives suggested that periodic reauthorization requirements on
third parties could lead to reduced customer retention. One small
entity representative stated that this would ``frustrate'' consumers,
and another stated that only 0.32 percent of its users prompted to
reconnect to their bank account ever did so. Reauthorization
requirements created frictions for third parties in the United
Kingdom's open banking regime after the implementation of a 90-day
reauthorization requirement. One UK trade association estimated an
attrition rate between 20 percent and 40 percent, while another trade
association found an attrition rate between 35 percent and 87
percent.\200\ These attrition rates may be different than those
expected under the proposed rule because, on the one hand, a 90-day
reauthorization requirement is more burdensome than an annual
reauthorization requirement, but on the other hand, more consumers may
still be actively using a product or service after 90 days than after
one year and so may be more likely to reauthorize access. The CFPB
expects that, while some third parties would incur costs from consumer
attrition, third parties will be more likely to obtain a new
authorization from a customer when that relationship is more valuable,
and the reauthorization process will be relatively easy for consumers
who wish to continue the relationship. These factors will generally
limit the cost of disruptions due to the reauthorization requirements,
particularly for third parties providing the most valuable services.
The CFPB does not have data to estimate the costs to third parties of
lost customers due to the annual reauthorization requirements.
---------------------------------------------------------------------------
\200\ See Fin. Conduct Auth., Changes to the SCA-RTS and to the
guidance in `Payment Services and Electronic Money--Our Approach'
and the Perimeter Guidance Manual (Nov. 2021), https://www.fca.org.uk/publication/policy/ps21-19.pdf.
---------------------------------------------------------------------------
Providing Authorization Disclosure and Certification Statement
The proposed rule would require third parties to provide the
authorization disclosure and certification statement when seeking to
access covered data. When a third party seeking authorization uses a
data aggregator to assist with accessing covered data on behalf of a
consumer, the proposed rule would require the data aggregator to make
its own certification statement to the consumer, though both the
aggregator and third party certifications would be permitted to be made
in the same disclosure. The CFPB expects that, in many cases in the
market today, data aggregators would provide the required authorization
disclosure and certification statement on behalf of third parties
seeking authorization. However, some third parties seeking
authorization, including those that do not partner with data
aggregators, may instead provide the authorization disclosure and
certification statement through their own systems.
For data aggregators and other third parties that choose to provide
the authorization disclosure and certification statement through their
own systems, the CFPB estimates that building such a system would
require approximately 1,000 hours of work by software developers or
similar staff. This estimate is based on cost estimates in other
consumer financial markets related to requirements for tailored
disclosures provided at service initiation.\201\ The CFPB estimates
that this would result in a one-time cost for a third party of $91,300.
However, if third parties already provide disclosures at authorization
under the baseline, the costs of modifying these disclosures to satisfy
the proposal's requirements may be reduced. One data aggregator
stakeholder stated that modifying the content of its existing
disclosures would involve 30 to 40 hours of employee time, representing
an equivalent cost for a third party of between $2,700 and $3,700.\202\
---------------------------------------------------------------------------
\201\ 82 FR 54472, 54823 (Nov. 17, 2017).
\202\ This estimate was derived from BLS data showing a mean
hourly wage for software developers of $63.91. BLS data also show
that wages account for 70 percent of total compensation for private
industry workers, leading to a $91.30 estimate for total hourly
compensation, which was multiplied by the expected total number of
hours of work required.
---------------------------------------------------------------------------
Data aggregators may pass through these costs to third parties that
contract with them. One data aggregator stated in its response to the
Aggregator Collection that disclosures for third parties that contract
with data aggregators would be largely uniform and easily adapted, and
the CFPB anticipates that this will be the case under the proposed
rule. The CFPB does not have data to estimate these costs. However,
because data aggregators' costs would be spread across many third
parties, the CFPB expects the burden of these requirements on any
single third party that contracts with data aggregators to be small.
[[Page 74852]]
Record Retention
The CFPB understands that many third parties already retain records
related to consumer data access requests. The proposed rule would
require third parties to retain records that demonstrate compliance
with the proposed rule, including a copy of the authorization
disclosure and, if a data aggregator accessed consumer-authorized data,
a copy of the certification statement. The costs of satisfying these
requirements would be captured by the one-time costs to implement the
revocation, use, and retention requirements. The three-year record
retention requirement of the proposed rule would impose limited
additional electronic storage costs.
Policies and Procedures
To implement the requirements of the proposed rule, third parties
would need to develop and maintain policies and procedures in several
distinct areas to ensure compliance with the proposed rule. These
include (1) applying existing information security programs to their
systems for the collection, use, and retention of covered data, (2)
ensuring the accuracy of the information that they collect, (3)
governing the limits on collection, use, and retention of consumer-
authorized information, and (4) record retention requirements. The CFPB
understands that all or most authorized third parties and data
aggregators are currently subject to the GLBA Safeguards Framework and
so they already have policies and procedures regarding information
security programs and would have lower costs for developing and
maintaining similar requirements of the proposed rule. However, a small
portion of third parties may need to develop new GLBA-compliant systems
and would face greater costs. In other consumer financial markets, the
CFPB has estimated that nondepository institutions would face a one-
time cost of $4,300 to develop new policies and procedures and a one-
time cost of $3,900 for a legal/compliance review.\203\ Assuming
comparable costs for the requirements of the proposed rule yields a
total cost of roughly $8,200 for developing and implementing policies
and procedures. Maintaining these policies and procedures once they are
implemented is likely to involve limited ongoing costs for third
parties.\204\
---------------------------------------------------------------------------
\203\ 86 FR 56356, 56556 (Oct. 8, 2021).
\204\ SBREFA Panel Report at 12.
---------------------------------------------------------------------------
Transition Away From Screen Scraping
The CFPB expects that third parties may face indirect costs from
the transition away from screen scraping under the proposed rule. At
baseline, screen scraping is a frequently used method of accessing
consumer data: in 2022, roughly half of data access attempts by third
parties in the Aggregator Collection were made through screen scraping.
However, the share of access attempts made through screen scraping has
declined by approximately one-third since 2019. The CFPB expects that
screen scraping would continue to decline for non-covered financial
products as data providers and third parties generally transition to
developer interfaces for third parties. The CFPB expects that third
parties would no longer use screen scraping to access covered financial
data once data providers have compliant interfaces for third parties.
While the CFPB expects data access volumes and the number of
connections between third parties and data providers to increase as a
result of the proposed rule, relative to the baseline third parties may
incur additional costs related to contracting with data providers, as
well as costs related to demonstrating to data providers the
sufficiency of their risk management practices.
In the SBREFA process, multiple small entity representatives
expressed that the transition away from screen scraping would limit
data accessibility. The proposed rule would not apply to non-covered
data. Relative to the baseline, the CFPB does not expect the transition
away from screen scraping to negatively impact data availability. The
CFPB requests comment on any specific data fields that may be less
available due to the transition away from screen scraping, and the
specific impacts of those changes.
At baseline, some third parties use screen scraping as a back-up
access method when other data access systems are inoperable. The need
for a back-up access method would be reduced under the proposed rule
because the proposed rule would improve the reliability of data access
systems, but in the current system at least one small entity
representative stated that customers lose access to the small entity
representative's services when access to data providers' interfaces is
unavailable. The value of screen scraping as an alternative option may
be limited by its relatively low success rates: in the Aggregator
Collection, 40 percent of initial account connection attempts made
through screen scraping were successful in 2022, compared to 51 percent
of initial account connection attempts made through interfaces for
third parties. The CFPB does not have data to quantify any net change
in data access reliability stemming from the combination of reduced
screen scraping and increased availability and reliability of
interfaces for third parties. The CFPB requests data or evidence to
quantify these potential effects.
Third parties that previously accessed covered data through screen
scraping without negotiating the terms of their access with data
providers would negotiate these terms under the proposed rule. The CFPB
expects that many of these negotiations would occur between data
aggregators and data providers, though some negotiations would occur
between authorized third parties that do not contract with data
aggregators and data providers. As described in the Costs to Data
Providers section, the CFPB estimates that the cost of negotiations
between data aggregators and data providers would be $6,800. One data
aggregator suggested in its response to the Aggregator Collection that
the cost of negotiation could fall by 80 percent under the proposed
rule, as 60 percent of work hours for employees involved in
negotiations are spent on topics that would be regulated by the
proposed rule and nonnegotiable, and another 20 percent of work hours
are spent on topics that would be covered by industry standards.
Third parties may be denied data access based on risk management
concerns or other permissible grounds. The CFPB expects that third
parties that comply with the data security requirements of the proposed
rule or the GLBA Safeguards Framework would not be denied access to
data providers' interfaces, and so very few third parties would incur
costs related to this provision of the proposed rule.
Restrictions on Use and Retention
Under the proposed rule, third parties would be required to limit
their collection, use, and retention of covered data to what is
reasonably necessary to provide the consumer's requested product or
service. These limitations could reduce some existing uses of both
identifiable and deidentified consumer data by third parties, including
the sale of covered data and targeted advertising using covered data.
The proposed deletion requirements would also reduce the value of data
available for product improvement. Several third party small entity
representatives highlighted how consumer data can enable the
development of new products and services and can inform research and
public policy, even when only deidentified data are used for these
secondary purposes. Furthermore, firms in the Aggregator Collection
reported using consumer data for functions other
[[Page 74853]]
than transmitting data to data recipients, including the improvement of
existing products, the development of new products, and risk management
assessments. The proposed rule may limit third parties' use of
consumer-authorized covered data for some of these purposes, though
third parties can continue to use data that they generated in providing
their products and services for these purposes.
The reduction in available data may eliminate or lessen the
profitability of certain business models. Third parties that generate
revenue from sharing covered data with fourth parties--such as firms
with no authorization to access data from the consumer--would lose that
source of revenue. Though the CFPB does not have data on the number of
third parties that share covered data or the amount of revenue
generated by sharing consumer data, the CFPB notes that a survey of
German app developers after the European General Data Protection
Regulation (GDPR) was implemented found that while the share of app
developers selling data was small, nearly all of the developers that
sold data experienced a decline in revenue post-GDPR.\205\ Third
parties that use covered data for internal marketing of other products
and services may also lose a source of revenue. The CFPB does not have
data to quantify this impact.
---------------------------------------------------------------------------
\205\ Rebecca Jan[szlig]en et al., GDPR and the Lost Generation
of Innovative Apps, Nat'l Bureau of Econ. Rsch. Working Paper No.
30028 (May 2022), https://www.nber.org/papers/w30028.
---------------------------------------------------------------------------
New Financial Data Processing Products or Services Definition
The CFPB's preliminary view is that the activities covered by the
proposed new financial data processing products or services definition
in 12 CFR part 1001 are already within the scope of the CFPA's
definition of financial product or service. As a result, the CFPB does
not expect the new definition to impose costs on covered persons.
However, to the extent that there are firms offering products or
services that are within the new definition but outside of the existing
financial product or service definition, the new definition could
impose some potential costs. Such firms would be subject to the CFPA
and its prohibition on unfair, deceptive, or abusive acts or practices,
including potential enforcement by the CFPB. Under the baseline, the
CFPB expects that such firms would already be subject to a prohibition
on unfair or deceptive acts or practices under section 5 the Federal
Trade Commission Act.\206\ Relative to the baseline, the new definition
would add potential enforcement against unfair and deceptive acts or
practices by the CFPB and require firms to be compliant with the
prohibition on abusive acts or practices. Given the overlap with
existing prohibitions, the CFPB expects the potential costs would be
limited, and would include developing and maintaining policies and
procedures to ensure compliance with the prohibition on abusive
practices for firms that are not compliant with the CFPA at baseline.
The CFPB does not have data to quantify these potential costs. The CFPB
requests comment on whether any firms offer products or services that
would be covered by the new definition but fall outside the definition
of financial product or service, and if so, what potential costs those
firms may face.
---------------------------------------------------------------------------
\206\ 15 U.S.C. 45.
---------------------------------------------------------------------------
2. Costs to Consumers
The proposed rule may increase costs for data providers and third
parties, potentially leading to higher prices for consumers or reduced
access to certain products or services. The proposed rule is likely to
increase the availability of consumer-authorized data overall. While
this may benefit many consumers, it could lead to higher credit costs
for some consumers with data indicative of higher risk if the use of
this data becomes standard for underwriting purposes. The proposed rule
would also require consumers to reauthorize access to their financial
data annually, which involves relatively minor costs. In addition,
consumers may incur costs because of unintentional lapses in
authorization. Finally, restrictions on secondary use of data may
reduce revenues for some third parties, leading to changes in product
offerings or pricing.
Changes in Industry Structure
Data providers would face additional compliance costs as a result
of the proposed rule. Some of these costs may be passed on to consumers
in the form of higher prices for credit, lower deposit rates, or higher
account fees. The CFPB does not have the data necessary to determine
the extent to which additional compliance costs may be passed through
to consumers, which depends on a number of factors including market
competition.\207\
---------------------------------------------------------------------------
\207\ To the extent that the costs incurred by data providers
and third parties as a result of the proposal are fixed costs, the
CFPB expects that those costs would not be passed on to consumers in
the form of higher prices. The CFPB does not have information to
estimate what proportion of these costs will be fixed or variable;
for example, while some providers may incur a fixed cost of building
an interface themselves, others may pay a service provider for use
of an interface on a per-account basis.
---------------------------------------------------------------------------
The proposed rule would exempt depository data providers that have
not established a consumer interface. While it is possible that some
institutions may choose to cease operations of or decide against
establishing a consumer interface rather than bringing their interfaces
into compliance with the proposed rule, the CFPB expects that this
would be very rare. Ceasing to operate an existing interface for
consumers would likely be highly disruptive to customers or may
increase other customer service costs for data providers by more than
the potential costs of complying with the proposal. The CFPB does not
have the data to determine how many data providers might decide not to
operate a consumer interface as a result of the proposal.
Many of the largest depository data providers either already offer
developer interfaces that meet many of the requirements of the proposal
or are developing such interfaces, and thus their additional costs of
complying with the proposed rule would be limited. While the CFPB does
not have information to precisely estimate the number of consumers with
accounts at such data providers, the available data suggest that the
number is large. The Provider Collection indicates that at least 51
million consumers have connected accounts to third parties through
credential-free developer interfaces. This count of 51 million
consumers likely understates the true number of consumers who have
access to credential-free interfaces for two reasons. First, it does
not include the consumers at institutions in the Provider Collection
who have access to, but have not yet connected to a developer
interface. Second, it does not include consumers at other
institutions--not included in the Provider Collection--that have
established developer interfaces that meet many of the requirements of
the proposal. It could, however, count consumers more than once if they
have an account at more than one institution included in the Provider
Collection. Overall, the CFPB expects that substantially more than 51
million consumers already have accounts at institutions that would face
more limited costs of complying with the provisions. Consumers who only
have accounts at these institutions are likely to incur minimal costs
passed on by data providers due to the proposed rule because the
institutions where they have accounts will face limited costs.
[[Page 74854]]
Effects of Greater Information Sharing
If finalized, the proposed rule would enhance third party access to
consumers' financial data, which could be used in third parties' credit
underwriting decisions. The ability for firms to screen customers using
information generally increases total value in the market but may
transfer value from some consumers to firms. Some consumers would
likely benefit, but other consumers may be worse off. While the CFPB
understands that the use of cash-flow data for underwriting to identify
consumers who are a higher risk than traditional credit scores would
predict is not common, it is possible that the market will evolve to
use cash-flow data in this way as it becomes more accessible. As a
benefit, increased information about consumers could lead to some
consumers being offered cheaper credit, if, for example, the
information accessed from data providers is viewed by third parties as
indicating that the consumer is a lower credit risk than a traditional
credit report would reveal. More information, however, could result in
some consumers being charged higher prices or not being offered credit
if the information reveals what a lender views as a signal that a
consumer is a higher credit risk than it would have assessed without
the consumer-authorized information.\208\ Even though it would be the
consumer's choice whether to authorize access to their covered data, it
is possible that a creditor would view a consumer's decision not to
authorize the sharing of their data as a negative signal of credit risk
and raise the price of credit or refuse to offer a loan.\209\
---------------------------------------------------------------------------
\208\ For example, Jansen et al. (2023) study an opposite
shock--the removal of information, instead of the addition--and find
that removing bankruptcy information from credit reports
redistributes consumer surplus from consumers who have never
experienced bankruptcy to consumers with a previous bankruptcy. Mark
Jansen et al., Data and Welfare in Credit Markets (June 15, 2023),
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4015958. Nelson
(2023) finds that limiting the information that credit card issuers
were able to use decreased prices for some high-risk borrowers and
increased prices for some low-risk borrowers, but on aggregate
raised consumer surplus. These are two examples of how the removal
of information that can be used in crediting decisions may shift
surplus towards consumers who appear to have lower repayment risk
after the information removal. Scott Nelson, Private Information and
Price Regulation in the US Credit Card Market, Univ. of Chic. Booth
Sch. of Bus. (Aug. 4, 2023), https://faculty.chicagobooth.edu/-/media/faculty/scott-nelson/research/private-information-and-price-regulation-in-the-us.pdf. The CFPB expects that the following
effects would occur under the proposed rule: third parties would
have access to more information which would increase total surplus
and would likely increase surplus for those who appear to have lower
repayment risk with the additional information relative to those who
appear to have higher repayment risk with the additional
information.
\209\ He, Huang and Zhou (2023) develop a model in which
consumers who choose not to share data are worse off under an open
banking system due to lenders taking opting out of data sharing as a
sign that a consumer is a high credit risk. Zhiguo He et al., Open
banking: Credit market competition when borrowers own the data,
147(2) J. Fin. Econ. at 449-74 (2023), https://doi.org/10.1016/j.jfineco.2022.12.003. Similarly, Babina, Buchak and Gornall (2023)
develop a model showing that when open banking policies enable the
addition of banking data to screening or pricing decisions, higher-
cost consumers are worse off even if they opt out of sharing
information because opting out sends a negative signal to lenders.
Tania Babina et al., Customer Data Access and Fintech Entry: Early
Evidence from Open Banking, Stanford Univ. Graduate Sch. of Bus.
Rsch. Paper (May 12, 2023), https://dx.doi.org/10.2139/ssrn.4071214.
---------------------------------------------------------------------------
Overall, the availability of consumer-authorized data would allow
lenders to underwrite and price more efficiently. This would likely
lead to greater credit access overall, with relatively greater access
or lower prices for lower risk borrowers who share data, but relatively
less credit access or higher prices for borrowers who are higher risk
or choose not to share data. The CFPB does not have the data necessary
to quantify these effects.
Time Cost of Reauthorizing Third Party Access Annually
Under the proposed rule, a third party would need to limit the
duration of collection of covered data to a maximum period of one year
after the consumer's most recent authorization. To collect covered data
beyond the one-year period, the third party would need to obtain a new
authorization from the consumer no later than the anniversary of the
consumer's most recent authorization. The reauthorization process
should not be more burdensome than the initial authorization
certification, but consumers would incur a small time cost to
reauthorize the collection of their data. As discussed in the Costs to
third parties section, existing evidence suggests that many consumers
may choose not to reauthorize a third party's access to their covered
data. The CFPB interprets this evidence as suggesting that many
consumers do not value the continued use of the third party product or
service enough to continue authorizing the sharing of their covered
data to a third party or that, given the quickly evolving market of
third party products and services, consumers decide to use a different
app.
Potential Changes in Pricing Models Due to Use and Retention
Limitations
Changes that third parties make to their business models as a
result of the proposal may be passed on to consumers through higher
prices for services provided by third parties. For example, the CFPB
understands that some third parties obtain revenue by sharing data that
consumers provide to them with other third parties or, more commonly,
sharing marketing information derived from such data. This may allow
third parties to provide services to consumers free of charge. As
discussed in the Costs to third parties section, there is evidence that
firms in Europe that were sharing customers' data experienced a decline
in revenue after data protection laws were enacted, suggesting that
they may need to seek alternative sources of revenue.\210\ To the
extent that the proposal leads to third parties changing their business
models, it is possible that some third parties will charge consumers
directly for services that used to be free. The CFPB does not have data
to estimate the share of consumers impacted or the magnitude of any
corresponding price increases.
---------------------------------------------------------------------------
\210\ Rebecca Jan[szlig]en et al., GDPR and the Lost Generation
of Innovative Apps, Nat'l Bureau of Econ. Rsch. Working Paper No.
30028 (May 2022), https://www.nber.org/papers/w30028.
---------------------------------------------------------------------------
3. Benefits to Covered Persons
Benefits to Data Providers
At baseline, many third parties use screen scraping to access
consumer data. The CFPB expects that third parties would reduce their
use of screen scraping under the proposed rule. This is likely to
benefit covered data providers because screen scraping involves
security risks and heavy web traffic. By standardizing the terms of
access and reducing the scope of negotiation, the proposed rule is also
likely to decrease the per-agreement cost of negotiating data access
agreements.
Reduced Screen Scraping
The CFPB understands that credential-based screen scraping creates
data security, fraud, and liability risks for data providers,
particularly because the credentials shared to facilitate data access
also typically can be used to move funds. Furthermore, screen scraping
can be used to gather data without data providers establishing a
relationship with third parties or assessing data security risks. The
CFPB cannot disaggregate fraud costs resulting from credential-based
screen scraping from general costs of fraud, including measures to
prevent fraud or insure against fraud-related damages. However,
depository data providers have reported extensive costs related to
preventing fraud and unauthorized transactions generally, and
reimbursing consumers when such fraud occurs. During the
[[Page 74855]]
SBREFA process, one small depository institution reported debit card
fraud losses of 28 percent of their total revenue. Small entity
representatives also noted that data providers typically pay premiums
for insurance against catastrophic fraud losses, with plans typically
covering losses in excess of $25,000, subject to certain restrictions.
Through conversations with industry participants, the CFPB understands
that ATO fraud is the most likely fraud risk that could be exacerbated
by credential-based data access methods such as screen scraping.\211\
In ATO fraud, the fraudster gains access to the consumer's account and
transfers funds, makes purchases, or opens accounts without
authorization. The CFPB expects that the reduction in credential-based
access due to the proposed rule would lower the risk of ATO fraud,
providing a benefit to data providers through reductions in direct
liability and decreased fraud insurance premiums, although it is
unclear how much ATO fraud is attributed to credential-based screen
scraping. The CFPB does not have sufficient data to estimate how much
the proposed rule would lower ATO fraud risk and requests comment on
the potential benefit for data providers. However, even a small
reduction in ATO fraud risk would have large benefits for data
providers.\212\
---------------------------------------------------------------------------
\211\ For example, consumers' account credentials may not be
securely stored by third parties or fraudsters may induce consumers
to share their credentials by impersonating a legitimate third
party.
\212\ For example, based on the Javelin Strategy 2022 Identity
Fraud Study, a 3 percent reduction in ATO fraud risks would generate
an expected annual benefit of $340 million for data providers. See
Javelin Strategy, 2022 Identity Fraud Study: The Virtual
Battleground (Mar. 29, 2022), https://javelinstrategy.com/2022-Identity-fraud-scams-report.
---------------------------------------------------------------------------
Along with the proposed requirements to access only the data fields
necessary to provide the specific product or service, the shift from
credential-based screen scraping to developer interfaces would also
tend to reduce overall traffic loads on the consumer-facing system and
may reduce traffic loads overall. The CFPB does not have systematic
data with which to estimate the net change in web traffic and the
resulting decrease in necessary expenditures on digital infrastructure.
As discussed above, the CFPB understands that the incremental cost of
additional web traffic is small, and that reasonably anticipated
reductions in traffic are likely to provide minimal benefits to data
providers.
Reduced Per-Agreement Negotiation Costs and More Standardized Terms of
Access
The CFPB understands that negotiating access agreements with third
parties is often resource intensive for data providers. In the
Aggregator Collection responses, aggregators reported that negotiating
an access agreement with a data provider could take between 50 and
4,950 staff hours of business relationship managers, software
developers, lawyers, compliance professionals, and senior management,
depending on the complexity of the negotiation. The median estimated
time was 385 staff hours per agreement. Based on these responses, the
CFPB estimates a total cost of between $4,260 and $422,000 which varies
depending on the complexity of the negotiation, with a median cost of
around $32,825.\213\ Although these estimates were provided by data
aggregators, the CFPB expects that these costs are also representative
for data providers at baseline.
---------------------------------------------------------------------------
\213\ This estimate was derived from BLS data showing mean
hourly wages for compliance officers ($37.01), general and
operations managers ($59.07), lawyers ($78.74), and software
developers ($63.91), which, assuming an equal division of hours
across these occupations, yields an average composite hourly wage of
$59.68. BLS data also show that wages account for 70 percent of
total compensation for private industry workers, leading to an
$85.26 estimate for total hourly compensation, which was multiplied
by the expected total number of hours of work required.
---------------------------------------------------------------------------
For contract negotiations that would have occurred under the
baseline, the CFPB expects that negotiation costs would decrease under
the proposed rule because many features of access agreements would be
regulated by the proposed rule and not subject to negotiation,
including requirements for interface reliability, interface queries,
and the scope of data accessible via the interface. One market
participant stated that in cases where data providers agree to use
existing industry-defined standards there is essentially no need for
negotiation and data providers can immediately begin updating their
developer interfaces in line with the standard specifications. The CFPB
expects that under the proposed rule nearly all data providers will use
standardized agreements and the costs of establishing data access will
be limited to ensuring third party risk management standards are
satisfied and reviewing the agreements. A non-small entity
representative third party commenter stated that the negotiation of
these elements represents approximately 20 percent of total negotiation
time.\214\ Based on this, the CFPB estimates that negotiations under
the proposal would require roughly 80 staff hours. The required time
may decline substantially over time as market participants and other
stakeholders develop standards for certifying compliance with third
party risk management standards. While some data providers and third
parties may choose to negotiate customized access agreements with third
parties, they will generally only do so when the perceived benefits
exceed the costs described here. Therefore, the CFPB has preliminarily
determined that the proposed rule is likely to reduce the cost of
negotiating and signing an access agreement by $26,000 on average.\215\
Under the baseline, data providers would have continued to negotiate
access agreements with third parties and these benefits would not have
applied to those agreements. As discussed in the Costs to data
providers section, the CFPB expects that the proposed rule will cause
data providers to negotiate additional agreements relative to baseline.
The cost of additional negotiations is analyzed above.
---------------------------------------------------------------------------
\214\ See https://www.regulations.gov/comment/CFPB-2023-0011-0042 (last visited Oct. 5, 2023).
\215\ This estimate is based on estimated total hourly
compensation of $85.26 multiplied by the difference between the
median expected hours required at baseline, 385 hours, and the
expected hours required under the proposed rule, 80 hours.
---------------------------------------------------------------------------
Restrictions on Third Parties' Use and Retention of Data
The proposed rule would also have some indirect effects on the
value of first party data held by data providers. Under the baseline,
third and first party data are both used for marketing and new product
development.\216\ The proposed rule would limit third party collection
of consumer-authorized data to what is reasonably necessary to provide
the consumer's requested product or service. Third party use and
retention of covered data would also be subject to that limitation,
which would limit the availability of covered data for marketing and
for the development of new products outside the scope of the original
authorization. While the CFPB does not have data to quantify the
benefits to data providers, all else equal, this is likely to increase
the value of first party covered data held by data providers, which
generally does not have these restrictions.
---------------------------------------------------------------------------
\216\ For example, a firm might target advertising towards
consumers who qualify for a particular credit product or who are
likely to be particularly profitable customers or develop new
products based on insights from a dataset of consumer transaction
histories.
---------------------------------------------------------------------------
[[Page 74856]]
Required Data Security Representations by Third Parties
The proposed rule would require authorized third parties to
represent that they have reasonable security practices, in particular
by representing that they implement the GLBA Safeguards Framework.
These practices are likely to benefit data providers by increasing
certainty regarding their potential third party risks, and generally
would require minimum data security standards among third parties. The
CFPB expects this to generally reduce the likelihood of data security
breaches or other incidents, but the CFPB does not have data to
quantify the size of this benefit.
Benefits to Third Parties
Right To Access Data Through Third Parties
Under the proposed rule, data providers that have consumer
interfaces are required to provide data to authorized third parties.
Third parties would be able to access data from new data providers that
had not made data available under the baseline. Further, the proposal's
data reliability requirements would ensure that data access is
consistently available across all data providers. The CFPB understands
that, at baseline, connectivity failure rates between third parties and
data providers are high, in part because many data providers do not
facilitate data sharing with many third parties, so these requirements
may lead to large increases in the proportion of consumers who are
successfully able to share their data under the proposed rule. Firms in
the Aggregator Collection reported initial connectivity failure rates
ranging from 28 percent up to 60 percent. The CFPB understands that
some of these initial connectivity failure rates occur because the data
provider denies the third party's request for data access, rather than
because of low interface reliability, and so third parties would be
able to reach more consumers under the proposed rule's requirement that
authorized third parties have access to covered data.
Prohibition on Data Access Fees
The proposed rule prohibits data providers from imposing fees on
third parties for costs associated with covered data provision. Firms
in the Aggregator Collection generally did not report paying fees to
data providers for access to covered data per customer or per interface
call, though a small number of annual or one-time payments were
reported. Though these costs are currently limited, the provisions
would ensure that the absence of fees under the baseline continues in
the future, providing more certainty to third parties about their costs
of accessing covered data. The CFPB does not have data to estimate the
benefit to third parties of this prohibition on fees because of the
uncertainty in how fees may have evolved under the baseline.
Reduced Negotiation Costs
As described in the Benefits to data providers part, based on data
and comments provided by third parties, the CFPB estimates that
negotiation costs would fall by 80 percent under the proposed rule, or
an average savings of $26,000 per negotiated connection agreement. This
would bring about substantial savings for third parties, particularly
data aggregators. The reduction in negotiation costs could also allow
additional third parties to enter into access agreements with data
providers directly, potentially saving on expenses paid to aggregators
under the baseline.
More Frequent Access to Data
The proposed rule prohibits covered data providers from
unreasonably limiting the frequency of third party requests for covered
data and from delaying responses to those requests. Based on responses
to the Provider Collection and conversations with industry
participants, the CFPB is aware that some large covered data providers
that offer developer interfaces currently impose access caps. Third
parties would benefit from the ability to access consumer data as often
as is reasonably necessary to provide the requested service. One firm
in the Aggregator Collection reported spending ``significant
resources'' to manage its traffic in order to avoid access cap limits.
Additionally, an aggregator in the Aggregator Collection reported
spending resources to persuade large financial institutions to raise or
eliminate access caps.
In addition to reducing costs associated with managing and limiting
traffic, third party services may become more valuable to consumers
when third parties can access consumer data more often.\217\ As
discussed below, the CFPB expects that third party revenue would
increase from the removal of unreasonable access caps under the
proposed rule. The CFPB does not have data to quantify these benefits
for third parties.
---------------------------------------------------------------------------
\217\ For example, an app that warns consumers when the funds in
their checking account fall below a predetermined threshold is
generally more valuable to consumers when it can access their
checking accounts more often.
---------------------------------------------------------------------------
Improved Accuracy of Data
The proposed rule would require that data providers have policies
and procedures reasonably designed to ensure the accuracy of data
transmitted through its interface. In addition, the proposed rule
provides clarifying standards for several factors that third party
small entity representatives reported as reducing accuracy, including
data access reliability, inconsistencies in data field availability and
formatting, and inaccuracies in screen scraped data.
The CFPB understands from the Aggregator Collection that access
caps can prevent consumers from obtaining their most up-to-date data
when a third party has surpassed its data limit. The removal of
unreasonable access caps under the proposed rule would reduce such
issues. The proposed rule would also require that a data provider make
available the most recently updated covered data that it has in its
control or possession at the time of a request, further ensuring that
third parties would be more likely to have up-to-date data than under
the baseline.
The transition away from screen scraping may lead to a reduction in
the number of data fields that third parties can access, as described
in the Costs to third parties section. However, it would lead to more
consistency in the data fields that are available across all data
providers and in data field formatting, and would reduce costs
associated with ensuring that consumer data are accurate. One
aggregator reported more frequent inaccuracies for data accessed
through screen scraping, as well as the need to allocate more resources
to meet accuracy standards for screen scraped data. The CFPB expects
that once compliant developer interfaces are established, third parties
would not screen scrape covered financial data under the proposed rule
which would reduce the costs associated with maintaining accuracy in
screen scraped data.
Costs associated with maintaining accuracy in consumer data will
not be eliminated altogether, as the proposed rule would require that
third parties ensure that covered data are accurately received from
data providers, and accurately provided to other third parties, if
applicable. The CFPB expects that the increased accuracy of data
received from data providers would simplify third party procedures for
meeting data accuracy standards. Third party products and services are
likely to become more valuable to consumers when data received from
data providers is more accurate and reliable. As
[[Page 74857]]
discussed below, the CFPB expects that this would increase third party
revenue.
Improved Service Quality Due to Improved Data Access
As discussed in the Benefits to third parties: Prohibition on data
access fees section, the proposed rule would prevent data providers
from charging fees to consumers or third parties for access to covered
data, guarantee access to data from all non-exempted covered data
providers through compliant developer interfaces that meet reliability
standards, eliminate unreasonable access caps, and improve the accuracy
of received data. These effects reduce third party costs of providing
services to consumers and improve the quality of the services that they
can provide. The CFPB expects that the ability to provide more valuable
services to consumers at a lower cost would increase profits for
existing third parties and lead to increased entry into the market for
third party services.\218\
---------------------------------------------------------------------------
\218\ Third parties may experience an increase in investment
under the proposed rule, in addition to a reduction in costs and
improvement in service quality. Babina, Buchak, and Gornall (2022)
study open banking polices adopted across 49 countries and find that
fintechs, which include third party recipients of data, raised
significantly more funding from venture capital following the
implementation of open banking policies that require banks to share
data with third parties. See Tania Babina et al., Customer Data
Access and Fintech Entry: Early Evidence from Open Banking, Stanford
Univ. Graduate Sch. of Bus. Rsch. Paper (rev. May 2023), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4071214.
---------------------------------------------------------------------------
The proposed rule is likely to enhance third party access to
consumers' financial data, which could be used in third parties' credit
underwriting decisions. Access to this data is likely to allow lenders
to better differentiate between borrowers with different likelihoods of
repayment and charge prices that are more aligned with potential
borrowers' repayment risk, increasing underwriting profitability. As an
example, the CFPB understands that access to consumer financial data
enables some third party lenders to incorporate information about
consumers' cash flow (i.e., depository account inflows and outflows)
into their underwriting models. Industry research has shown that cash
flow is predictive of serious delinquency, and that models including
cash flow can distinguish between the repayment risks of consumers with
similar traditional credit profiles.\219\ The CFPB expects that some
third party lenders would be able to identify and reach more consumers
with low repayment risk under the proposed rule, and may therefore
experience an increase in profits. The CFPB does not have data to
quantify these benefits for third parties.
---------------------------------------------------------------------------
\219\ One credit scoring company found that adding cash flow
data to its traditional model improved predictiveness by 5 percent
for consumers with thin or new credit profiles. Supporting this
finding, FinRegLab studied six non-bank lenders in the current
system and found the cash flow variables in their underwriting
models were predictive of serious delinquency. See Can Arkali, Icing
on the Cake: How the FICO Score and alternative data work best
together, FICO Blog (June 2023), https://www.fico.com/blogs/icing-cake-how-fico-score-and-alternative-data-work-best-together;
FinRegLab, The Use of Cash-Flow Data in Underwriting Credit:
Empirical Research Findings (July 2019), https://finreglab.org/wp-content/uploads/2019/07/FRL_Research-Report_Final.pdf.
---------------------------------------------------------------------------
Reduced Costs of Establishing and Maintaining Screen Scraping Systems
The CFPB expects that third parties would generally cease screen
scraping for covered financial data under the proposed rule. Based on
the Aggregator Collection, the CFPB understands that maintaining screen
scraping systems is more costly than maintaining developer interface
connections. The reported ratio of staff hours spent on maintaining
screen scraping data access to staff hours spent on maintaining
interface data access ranged between 2.5 and 12. For aggregators that
separately reported costs of maintaining data provider connections
through screen scraping and interfaces, the dollar cost of screen
scraping ranged between $1.6 million and $7 million, or between $0.0005
and $0.0216 per access attempt; for interfaces, the reported dollar
cost was between $1.5 million and $1.6 million, or between $0.0001 and
$0.0194 per access attempt. Each request made through a developer
interface rather than through screen scraping leads to expected savings
between $0.0004 and $0.0022. The firms in the Aggregator Collection
reported nearly 16 billion screen scraping attempts in 2022. Under the
proposed rule, these screen scraping attempts would instead be made
through requests to developer interfaces, leading to at least $6.4
million to $35.9 million worth of annual savings for data aggregators,
based only on firms in the Aggregator Collection. Aggregators' savings
may be passed on to data recipient third parties through lower prices
for aggregator services. The CFPB expects that third parties' cost per
access attempt would fall under the proposed rule because screen
scraping is more costly for third parties than accessing data through
developer interfaces, and most third parties would transition to only
accessing covered financial data through interfaces.
Increased Standardization
The CFPB expects that the cost of accessing customer data would
decrease not only through reductions in negotiation costs and costs per
data access attempt, but also because the proposal would incentivize
the industry to coalesce around uniform standards for data access. The
increased standardization of data access may reduce the costs for third
parties integrating with data providers and allow some third parties
that provide services to consumers to bypass data aggregators. An
increase in the share of third parties accessing data under access
agreements with data providers would tend to reduce any degree of
market power that data aggregators would enjoy under the baseline and
will tend to reduce access prices for third parties.
One small entity representative shared that aggregator costs
represent its single largest budgetary line item, at approximately 10
percent of monthly expenditures. Data aggregators in the Aggregator
Collection reported a wide range in fees charged to data recipient
third parties depending on the recipient's size, minimum commitments,
and access volume. Reported median annualized fees ranged between
$2,000 and $6,000. Average annualized fees ranged between $40,000 and
$70,000, demonstrating that in the long right tail of the fee
distribution a small number of data recipients pay substantially more
fees than average.\220\
---------------------------------------------------------------------------
\220\ For example, responses in the Aggregator Collection
suggested that a smaller number of data recipients may pay
annualized fees totaling several million dollars.
---------------------------------------------------------------------------
The proposed rule may make it comparatively less expensive for
third parties to connect directly with data providers, rather than
contracting with one or more data aggregators. Because a direct
connection with a data provider is a substitute for aggregator
services, a decrease in the cost of direct connections would likely
decrease the price of aggregator services. However, because aggregators
spread the costs of establishing data access agreements with each data
provider across many authorized third parties, aggregators are likely
to retain an advantage from scale in providing access. This advantage
may decline over time if the proposed rule accelerates technological
standard development by non-governmental groups. This would reduce
frictions and costs from establishing and maintaining bespoke
connections to each data provider. The CFPB does not have data to
estimate the net benefits to data aggregators or data recipients due to
increased standardization of data access.
[[Page 74858]]
4. Benefits to Consumers
The proposed rule would likely increase consumers' ability to
access their data through third parties as desired. This increase may
result in more third party products and services that consumers find
useful in the marketplace. The use of credential-free data access would
make this sharing possible without consumers revealing their
credentials to third parties, reducing the potential harms that
consumers may experience due to a data breach. Consumers would also
have increased control over how third parties use their data, since
third parties would no longer have indefinite authorization to use a
consumer's data or use it for reasons other than the primary purpose.
The proposal would likely have important secondary benefits for
consumers as well, for example through new underwriting methods or
increasing competition among data providers or third parties. Finally,
the potential effects of the new financial data processing product or
service definition are discussed below.
Right to Third Party Data Access
The proposal would require covered data providers to facilitate
consumer instructions to provide consumer-authorized third parties with
covered data. As discussed in the Benefits to Third Parties section,
consumers' initial account connection attempts through authorized third
parties experience high failure rates, and the proposal would benefit
both consumers and third parties by guaranteeing consumer-authorized
third parties the right to access covered data. Under the proposed
rule, data providers are required to offer a developer interface with
commercially reasonable performance, including a proper response rate
of at least 99.5 percent. This would benefit consumers by increasing
the quality of third party products and services as well as the
likelihood that consumers are able to use them at all. As discussed
above, the CFPB expects third parties' costs of establishing
connections with data providers would decline as a result of the
proposal, and this may benefit consumers to the extent that lower costs
are passed through to them.
Further, guaranteed access to consumer-authorized data would likely
increase investment in third parties that request that data, providing
consumers with more options in the marketplace and increasing
competition.\221\ As evidenced by the estimated 100 million consumers
using third party data access discussed in the Baseline section,
consumers have substantial demand for financial products and services
offered by third parties, which may feature more convenient and
automated means of gathering and using consumers' financial data
relative to legacy financial service providers.\222\ The CFPB expects
that an expanded range of third party products and services would
increase competition and innovation, offering important secondary
benefits to consumers, including improved credit access and lower
prices, discussed below.
---------------------------------------------------------------------------
\221\ For example, Babina, Buchak and Gornall (2023) find that
after other countries implemented open banking policies, venture
capital investment in fintech companies increased 50 percent on
average and the number of new entrants in the financial advice and
mortgage markets increased. Tania Babina et al., Customer Data
Access and Fintech Entry: Early Evidence from Open Banking, Stanford
Univ. Graduate Sch. of Bus. Rsch. Paper (rev. May 12, 2023), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4071214.
\222\ As an example of how this can potentially increase access
to credit for underserved populations, Howell et al. (2022) find
that automation of underwriting processes for small business lending
are associated with a higher share of loans being made to Black
borrowers. Sabrina T. Howell et al., Lender Automation and Racial
Disparities in Credit Access, Nat'l Bureau of Econ. Rsch. Working
Paper No. 29364 (Nov. 2022), https://www.nber.org/papers/w29364.
---------------------------------------------------------------------------
Credential-Free Access--Increased Privacy, Reduced Data Breach Risks
Under the proposal, data providers would be required to create an
interface that can be used to share consumer-authorized data with third
parties without consumers' credentials being held by the third party.
Many third parties currently use screen scraping techniques or
credential-based APIs to access consumer information, which requires
the consumer to provide the third party with their username and
password for the data provider's website. This current practice may
expose consumers to greater risk if a third party experiences a data
breach. Data breaches can be very costly for consumers. While the CFPB
does not have data to estimate the resulting consumer benefits of
credential-free access, the academic and practitioner literature
indicates that the associated benefits can be substantial.\223\ Courts
have approved large settlements in cases where data breaches affected
financial service providers.\224\ It is common for consumers to have
their personal information compromised. For example, a 2019 Pew
Research Center survey found that in the past 12 months, 28 percent of
respondents reported having someone make fraudulent charges on their
debit or credit card, take over a social media or email account without
permission, or attempt to open a credit account in their name.\225\
Under the proposed rule, consumers would benefit from a reduced
likelihood that third party data breaches would expose their account
login information, since they would no longer have to give third
parties their account credentials in order for the third party to
access consumer-authorized covered data. If the third party experienced
a data breach it would be less likely to compromise the consumer's
account since the breach would no longer potentially include the
consumer's account access credentials. This in turn may reduce the
risks of unauthorized transfers or other fraudulent account activity.
---------------------------------------------------------------------------
\223\ Albon et al. (2016) surveyed more than 6,000 consumers and
found that in the previous year, 26 percent reported receiving a
data breach notification. When asked about the costs that the data
breach imposed on them, 68 percent of consumers whose data was
breached estimated a nonzero financial loss, with a median value of
$500. Lillian Ablon et al., Consumer Attitudes Toward Data Breach
Notifications and Loss of Personal Information, RAND Corp. (2016),
https://www.rand.org/content/dam/rand/pubs/research_reports/RR1100/RR1187/RAND_RR1187.pdf. A study of identity fraud by Javelin
Strategy found that the average consumer who identified as a victim
of identity fraud lost $1,551 and spent nine hours resolving the
issue. Javelin Strategy, Identity Fraud Losses Total $52 Billion in
2021, Impacting 42 Million U.S. Adults (Mar. 29, 2022), https://javelinstrategy.com/press-release/identity-fraud-losses-total-52-billion-2021-impacting-42-million-us-adults. Consumers' liability
for ATO fraud may be limited under Regulation E, but it is possible
that not all consumers can or do successfully exercise their rights
to limited liability.
\224\ In 2019, a settlement for $190 million was approved in a
data breach at Capital One that affected approximately 100 million
consumers. Capital One, Information on the Capital One cyber
incident (Apr. 22, 2022), https://www.capitalone.com/digital/facts2019/. A settlement of $425 million for consumers was reached
in the 2017 Equifax data breach, which affected approximately 147
million consumers. Fed. Trade Comm'n, Equifax Data Breach Settlement
(Dec. 2022), https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement.
\225\ Brooke Auxier et al., Americans and Privacy: Concerned,
Confused and Feeling Lack of Control Over Their Personal
Information, Pew Rsch. Ctr. (Nov. 15, 2019), https://www.pewresearch.org/internet/2019/11/15/how-americans-think-about-privacy-and-the-vulnerability-of-their-personal-data/.
---------------------------------------------------------------------------
The CFPB expects the provisions may induce some data providers and
third parties to transition voluntarily to credential-free interfaces
for non-covered products that would have been accessed using
credentials under the baseline. This would yield additional data
security benefits to consumers.
Third Party Limitations on Collection, Use, and Retention--Ability To
Be Forgotten, Increased Privacy, More Control Over Use of Own Data
The proposal would increase consumers' control over how their
[[Page 74859]]
covered data are used by third parties. There is strong evidence that
consumers value control over how their personal information is used and
thus would benefit from the proposal. In a 2015 survey, the Pew
Research Center found that 93 percent of Americans said that it was
very or somewhat important to be ``in control of who can get
information about you.'' \226\ One consumer advocacy stakeholder stated
that under the baseline, consumers may not understand how third parties
share their data due to difficult-to-understand disclosures and may
also not understand the rights they may have to limit how their data
are shared. The Pew Research Center found in another study that 70
percent of Americans feel that their personal information is less
secure than it was five years ago, 79 percent are very or somewhat
concerned about how their personal information is being used by
companies, and only 18 percent feel that they have a great deal of or
some control over the data that companies collect about them.\227\
Eighty-one percent feel that the potential risks of personal data
collection by companies outweigh the benefits. This evidence suggests
consumers have a strong desire for more control over how their personal
information is used and thus would benefit substantially from the
proposal. The CFPB does not have sufficient data to provide a
quantitative estimate of these benefits to consumers.
---------------------------------------------------------------------------
\226\ Pew Rsch. Ctr., Americans Hold Strong Views About Privacy
in Everyday Life (May 19, 2015), https://www.pewresearch.org/internet/2015/05/20/americans-attitudes-about-privacy-security-and-surveillance/pi_15-05-20_privacysecurityattd00/.
\227\ Brooke Auxier et al., Americans and Privacy: Concerned,
Confused and Feeling Lack of Control Over Their Personal
Information, Pew Rsch. Ctr. (Nov. 2019), https://www.pewresearch.org/internet/2019/11/15/how-americans-think-about-privacy-and-the-vulnerability-of-their-personal-data/.
---------------------------------------------------------------------------
Effects of Increased Data Sharing on Innovation and Competition
Increased availability of consumer-authorized data to third parties
could have a number of other indirect--but potentially large--benefits
for consumers. For example, as discussed in the Costs to consumers
section, while increased availability of data could result in lenders
assessing some consumers as higher credit risk than they would be
otherwise and charging them higher prices, it is also likely to result
in lenders assessing some consumers as lower credit risk and charging
them lower prices. It is possible that a consumer would be denied a
loan that they would have been granted in the absence of the use of
consumer-authorized data in underwriting. If the loan was not
affordable for the consumer, then this denial could benefit the
consumer in the long term.
Consumer-authorized data may be particularly useful for consumers
who have a limited credit history or do not have a credit file with a
nationwide consumer reporting company. Among consumers who do have
credit scores, a study by FinRegLab found that cash flow underwriting
can help identify consumers who have low traditional credit scores but
are actually a low credit risk for lenders.\228\ It is possible that
many consumers will experience increased access to credit or lower
prices under the proposal, to the extent that they are less able to
share covered data with third parties under the baseline.\229\ Even
without the proposal, the Aggregator Collection shows that in 2022,
tens of millions of data requests were made through those data
aggregators for consumer data to be used for underwriting
purposes.\230\
---------------------------------------------------------------------------
\228\ FinRegLab, The Use of Cash-Flow Data in Underwriting
Credit (July 2019), https://finreglab.org/wp-content/uploads/2019/07/FRL_Research-Report_Final.pdf.
\229\ For example, using data from a German fintech lender, Nam
(2022) finds that borrowers across the credit score distribution
benefit on average when they choose to share data with the lender,
with lower credit score borrowers experiencing a larger increase in
acceptance rates and higher credit score borrowers experiencing a
larger decrease in interest rates. See Rachel J. Nam, Open Banking
and Customer Data Sharing: Implications for Fintech Borrowers, SAFE
Working Paper No. 364 (Nov. 30, 2022), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4278803.
\230\ These requests include requests for information relating
to existing accounts, like credit card limit increases, as well as
the underwriting of new loans.
---------------------------------------------------------------------------
The use of consumer-authorized data may also benefit consumers
through increased availability and quality of payment services. The
availability of consumer-authorized data may improve payment services
by, for example, making it easier to sign up for such services and
allowing the service to verify a consumer's balance before initiating a
payment to ensure that they are not overdrafting the consumer's
account. In 2022, the Aggregator Collection shows nearly two billion
requests for consumer data for facilitating payment services. Increased
use of payment services is likely to benefit consumers.\231\ Easier
person-to-person payments may help consumers send or receive money from
friends and family to avoid overdrafting their bank accounts or
incurring fees through other forms of borrowing. In addition to
providing benefits for person-to-person payments, consumer-authorized
data are increasingly used to facilitate consumer-to-business ``pay by
bank'' purchases, with lower fees relative to credit cards for
merchants, some of which may be passed through as benefits to
consumers.
---------------------------------------------------------------------------
\231\ For example, Balyuk and Williams (2021) find that low-
income consumers with increased exposure to a person-to-person
payment platform are less likely to overdraft their bank accounts
and more likely to borrow from family and friends using the platform
if they have a low balance relative to their needs. See Tetyana
Balyuk & Emily Williams, Friends and Family Money: P2P Transfers and
Financially Fragile Consumers (Nov. 2021), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3974749.
---------------------------------------------------------------------------
Increased availability of consumer-authorized data may also lower
the costs for a consumer switching financial institutions in search of
higher deposit rates, lower fees, better service, or lower rates on
credit products. Recent research has found that digital banking
technology affects the movement of deposits into and out of banks in
response to market pressures.\232\ The provisions may make it easier
for a consumer to move to a new institution by easing the transfer of
funds and account information from the old institution to the new
institution.
---------------------------------------------------------------------------
\232\ Koont, Santos and Zingales (2023) find that in response to
Federal Funds rate changes, deposits flow out of banks with an
online platform more quickly. Naz Koont et al., Destabilizing
Digital Bank Walls (May 2023), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4443273. Erel, Liebersohn, Yannelis, and
Earnest (2023) found that primarily online banks saw larger inflows
of interest-bearing deposits when Federal Funds rates increased.
Isil Erel et al., Monetary Policy Transmission Through Online Banks,
Fisher Coll. of Bus. Working Paper No. 2023-03-015 & Charles A. Dice
Ctr. Working Paper No. 2023-15 (May 26, 2023), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4459621.
---------------------------------------------------------------------------
Even marginal improvements in consumers' ability to shop for and
transfer deposits could have large potential benefits for consumers,
given the substantial size of the deposit market and the dispersion in
prices across institutions. Consumers with sizeable savings may benefit
most from accounts offering higher interest rates, while consumers with
limited funds may benefit most from accounts with low or no fees.
Recent studies suggest there is potential for substantial gains on both
measures. On interest rates, researchers have documented high average
savings interest rates available from large online banks, substantially
above average savings interest rates.\233\
[[Page 74860]]
On fees, the CFPB has found that although deposit account fees are
trending lower since 2019, banks with over $1 billion in assets
collectively earned $7.7 billion in revenue from overdraft and
insufficient funds (NSF) fees in 2022.\234\ This is despite the
availability of at least 397 deposit account products with zero
overdraft and NSF fees, with options available in every state.\235\
---------------------------------------------------------------------------
\233\ Erel, Liebersohn, Yannelis, and Earnest (2023) found that
in April 2023, there were at least 15 large online banks offering an
average savings interest rate of 2.17 percent, compared to 0.28
percent at other banks. Similarly, FDIC data from April 2023 show
that, weighted by share of deposits, average savings interest rates
were 0.39 percent. The authors also find that the online banks offer
substantially higher rates for other products like certificates of
deposit, individual retirement accounts, and money market deposit
accounts. Isil Erel et al., Monetary Policy Transmission Through
Online Banks, Fisher Coll. of Bus. Working Paper No. 2023-03-015 &
Charles A. Dice Ctr. Working Paper No. 2023-15 (May 26, 2023),
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4459621; Fed.
Deposit Ins. Corp., FDIC National Rates and Rate Caps (Apr. 17,
2023), https://www.fdic.gov/resources/bankers/national-rates/2023-04-17.html.
\234\ Off. of Consumer Populations & Mkts., Consumer Fin. Prot.
Bureau, Overdraft/NSF revenue down nearly 50% versus pre-pandemic
levels (May 24, 2023), https://www.consumerfinance.gov/data-research/research-reports/data-spotlight-overdraft-nsf-revenue-in-q4-2022-down-nearly-50-versus-pre-pandemic-levels/full-report/.
\235\ These accounts are certified as meeting the Bank On
National Account Standards established by the Cities for Financial
Empowerment Fund. See list of certified accounts at https://joinbankon.org/accounts/ (last visited Sept. 12, 2023), and current
account standards, https://bankon.wpenginepowered.com/wp-content/uploads/2022/08/Bank-On-National-Account-Standards-2023-2024.pdf
(last visited Sept. 12, 2023).
---------------------------------------------------------------------------
If the proposal improves consumers' ability to switch providers, it
would have two benefits. First, those consumers who switch could earn
higher interest rates or pay lower fees. To estimate the potential size
of this benefit, the CFPB assumes for this analysis that of the
approximately $19 trillion \236\ in domestic deposits at FDIC- and
NCUA-insured institutions, a little under a third ($6 trillion) are
interest-bearing deposits held by consumers, as opposed to accounts
held by businesses or noninterest-bearing accounts.\237\ If, due to the
proposal, 1 percent of consumer deposits were shifted from lower
earning deposit accounts to those with interest rates one percentage
point (100 basis points) higher, consumers would earn an additional
$600 million annually in interest. Similarly, if due to the proposal,
consumers were able to switch accounts and avoid 1 percent of the
overdraft and NSF fees they currently pay, they would pay at least $77
million less in fees per year.\238\
---------------------------------------------------------------------------
\236\ Fed. Deposit Ins. Corp., Insured Institution Performance,
17(2) FDIC Quarterly (2023) https://www.fdic.gov/analysis/quarterly-banking-profile/qbp/2023mar/qbp.pdf, and Nat'l Credit Union Admin.,
Quarterly Credit Union Data Summary (2022 Q4), https://ncua.gov/files/publications/analysis/quarterly-data-summary-2022-Q4.pdf.
\237\ Derived from several data sources, the assumption that
slightly under one third of total deposits are interest-bearing
deposits held by consumers is based on assuming slightly under half
of all deposits are held by consumers, and about 70 percent of
consumers' deposits are interest bearing. First, in the most recent
available 2019 data from the Survey of Consumer Finances,
households' mean savings in transaction accounts and certificates of
deposit was $48,803; see Bd. of Governors of the Fed. Rsrv. Sys.,
Survey of Consumer Finances (SCF), https://www.federalreserve.gov/econres/scfindex.htm (last updated Dec. 9, 2022). The 2020 Census
estimates that there were 127 million U.S. households, and the
product of these two numbers yields an estimate of $6.2 trillion in
deposits held by consumers; see Thomas Gryn et al., Married Couple
Households Made Up Most of Family Households, America Counts:
Stories, https://www.census.gov/library/stories/2023/05/family-households-still-the-majority.html. This is slightly under half of
the $14 trillion in deposits based on Call Report data for 2019;
Fed. Deposit Ins. Corp., 2019 Summary of Deposits Highlights, 14(1)
FDIC Quarterly (2020), https://www.fdic.gov/analysis/quarterly-banking-profile/fdic-quarterly/2020-vol14-1/fdic-v14n1-4q2019-article.pdf, Nat'l Credit Union Admin., Quarterly Credit Union Data
Summary (2019 Q4), https://ncua.gov/files/publications/analysis/quarterly-data-summary-2019-Q4.pdf. The estimate for share of
deposits that are interest bearing is derived from Figure A.3 in
Erel, Liebersohn, Yannelis, and Earnest (2023). Isil Erel et al.,
Monetary Policy Transmission Through Online Banks, Fisher Coll. of
Bus. Working Paper No. 2023-03-015 & Charles A. Dice Ctr. Working
Paper No. 2023-15 (May 26, 2023), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4459621.
\238\ Survey evidence suggests that a small share of consumers
value overdraft as a form of borrowing while a majority would prefer
that the transactions were declined; see The Pew Ctr. on the States,
Overdraft America: Confusion and Concerns about Bank Practices (May
2012), https://www.pewtrusts.org/~/media/legacy/uploadedfiles/
pcs_assets/2012/sciboverdraft20america1pdf. In addition, the CFPB
has found that some overdraft practices can be unfair, if they could
not be reasonably anticipated; Consumer Fin. Prot. Bureau,
Unanticipated overdraft fee assessment practices, Consumer Financial
Protection Circular (Oct. 26, 2022), https://www.consumerfinance.gov/compliance/circulars/consumer-financial-protection-circular-2022-06-unanticipated-overdraft-fee-assessment-practices/. This analysis assumes that those consumers who prefer
overdraft would stay with institutions offering these services,
while those switching would prefer accounts without overdraft fees.
---------------------------------------------------------------------------
The second potential way consumers could benefit is through
improved prices and service even for consumers who do not switch
providers, due to the proposal's effects on competition. Increased
competition from improved online banking services and open banking
services under the baseline may have already contributed to consumers
receiving higher interest rates on deposits and paying lower fees in
recent years.\239\ To estimate the scale of potential benefits from the
provisions, if the proposal further increases these competitive
pressures such that average offered interest rates on deposits increase
by even one basis point (0.01 percentage points), consumers would
accrue an additional $600 million in annual benefits from interest even
without moving their deposits. Similarly, if increased competitive
pressures due to the provisions caused banks to lower overdraft and NSF
fees by 1 percent on average, consumers would benefit from at least $77
million in reduced fees annually.
---------------------------------------------------------------------------
\239\ Kang-Landsberg, Luck and Plosser (2023) find that the
pass-through of the Federal Funds rate to deposit rates is
increasing and nearing the levels seen in the early 2000s. Alena
Kang-Landsberg et al., Deposit Betas: Up, Up, and Away?, Liberty St.
Econ. (Apr. 11, 2013), https://libertystreeteconomics.newyorkfed.org/2023/04/deposit-betas-up-up-and-away.
---------------------------------------------------------------------------
In addition to the effects in the deposit market, under the
proposal, a consumer's depository institution would no longer have a
potential advantage in underwriting a loan based on the consumer's
transaction data, which could increase competition and potentially
lower interest rates on loan products for consumers. While these
potential impacts are difficult to quantify, even marginal improvements
in the interest rates or fees paid by consumers could have substantial
benefits, given the size of consumer lending markets.
The provisions would likely make it easier for consumers to access
their data through personal financial management platforms. This
increased ability to access and monitor information about their
personal finances could benefit consumers.\240\
---------------------------------------------------------------------------
\240\ Carlin, Olafsson, and Pagel (2023) find that increased
access to a personal financial management platform substantially
lowers overdraft fees. Bruce Carlin et al., Mobile Apps and
Financial Decision-Making, 27(3) Rev. of Fin. at 977-96 (May 2023),
https://academic.oup.com/rof/article/27/3/977/6619575. The evidence
on this subject is mixed, however, as Medina (2020) finds that
reminders to consumers to make credit card payments in a personal
financial management platform increased the probability that
consumers incurred overdraft fees and slightly increased overall net
fees paid by consumers, since consumers were more likely to
overdraft their bank account to pay their credit card bill. Paolina
C Medina, Side Effects of Nudging: Evidence from a Randomized
Intervention in the Credit Card Market, 34(5) Rev. of Fin. Studies
at 2580-2607 (Sept. 10, 2020), https://academic.oup.com/rfs/article/34/5/2580/5903746.
---------------------------------------------------------------------------
New Financial Data Processing Products or Services Definition
The CFPB's preliminary view is that the activities covered by the
new financial data processing products or services definition are
already within the scope of the CFPA's definition of financial product
or service. As a result, the CFPB does not expect the new definition to
have benefits to consumers. However, to the extent that there are firms
offering products or services that are within the new definition but
outside of the financial product or service definition, the new
definition could benefit consumers by increasing protections against
unfair,
[[Page 74861]]
deceptive, or abusive acts or practices. The CFPB does not have data to
quantify these potential benefits. The CFPB requests comment on whether
any firms offer products or services that would be covered by the new
definition but fall outside the definition of financial product or
service, and if so, what potential benefits to consumers could result
from the new definition.
5. Alternatives Considered
The CFPB considered the impacts of several alternatives to the
proposal. These include alternatives which would allow secondary use of
data by third parties in certain circumstances (i.e., through an opt-in
mechanism allowing the consumer to consent to specific uses, while
retaining a prohibition on certain high-risk secondary uses) or allow
retention and use of deidentified data as an exception to the general
limitation standard that otherwise limits retention.\241\ The CFPB also
considered alternatives specific to small entities, such as exemptions
or longer compliance timelines, which are discussed in part VII.
---------------------------------------------------------------------------
\241\ Some additional alternatives are considered and discussed
in part IV. For example, alternatives to the prohibition on fees for
establishing and maintaining interfaces and for accessing data
through interfaces are discussed in part IV.C.1.
---------------------------------------------------------------------------
Rather than prohibiting secondary uses, the CFPB considered
allowing some secondary uses through an opt-in mechanism while
prohibiting certain high-risk secondary uses. Relative to the proposal,
this alternative would generally benefit third parties by allowing
additional uses of data and potentially impose costs on consumers by
reducing their privacy and their control of how their data are used. If
these secondary uses lead to improved products and services offered by
third parties, this alternative could benefit consumers relative to the
proposal. If, however, the additional secondary uses are detrimental to
consumers despite the consumer's opt-in consent, allowing such uses
could harm consumers relative to the baseline. The CFPB requests
comment on whether any secondary uses should be allowed through an opt-
in mechanism. The CFPB also requests comment on how potentially harmful
secondary uses could be defined and prohibited under this alternative.
The CFPB also considered an exception to the general limitation
standard for retention and use of deidentified data. Relative to the
proposal, this alternative would generally benefit third parties by
allowing the continued retention and use of deidentified consumer data
after the general limitation standard would normally require the
deletion of identified data. For example, deidentified data could
potentially be used for product improvement or development, which would
benefit third parties. These uses could also potentially benefit
consumers through improved or new products. However, if the risk of
reidentification remains for the consumers in deidentified data, the
retention of such data creates a potential cost to consumers in privacy
and fraud risks in the case of a data breach or misuse of data. The
CFPB requests comment on whether there should be an exception to the
general limitation standard for deidentified data, and if so, how
deidentification should be defined to limit risks to consumers.
F. Potential Impacts on Depository Institutions and Credit Unions With
$10 Billion or Less in Total Assets, as Described in Section 1026
The proposed rule would require most depositories and credit unions
with $10 billion or less in total assets (community banks and credit
unions) to maintain a consumer interface and establish and maintain a
developer interface through which they receive requests for covered
data and make that data available in an electronic form usable by
consumers and authorized third parties. Compared to larger data
providers, these institutions likely are more reliant on core banking
providers and other service providers to comply, have fewer consumers
and thus reduced efficiencies of scale, and may be less likely to act
as data recipients in addition to being data providers. These
institutions are also less likely to have a consumer interface and thus
more likely to be exempt from the proposed rule, relative to larger
data providers. Compared to nondepository data providers of all sizes,
these institutions likely have more legacy systems that may be costly
to modify to come into compliance with the proposal.
As discussed in part VI.E.1, the CFPB expects that most
depositories of this size will contract with a vendor for their
interfaces for consumers and third parties. To examine the types of
vendors used by smaller institutions, the CFPB uses a data field in the
NCUA Profile data which asks credit unions to indicate ``the name of
the primary share and loan information processing vendor.'' \242\ While
the vendor that provides core banking services to a credit union is not
always the same vendor that provides digital banking services to the
credit union, the CFPB expects that in many cases the same vendor
provides both services. Based on the reported information for all
credit unions, 99.6 percent of whom have $10 billion or less in total
assets, the CFPB estimates that at least 53 percent of credit unions
already use a vendor that offers interfaces for third parties. To
measure the size of vendors used, the CFPB estimates that 89 percent of
credit unions use a vendor with at least 100 credit union clients, and
94 percent of credit unions use a vendor with at least 50 credit union
clients. The CFPB expects that many of these vendors would likely offer
interfaces for third parties by the compliance date applicable for
community banks and credit unions. However, the 6 percent of credit
unions using smaller vendors--and in particular the 2 percent of credit
unions that did not report using a vendor or reported using a vendor
with only a single or handful of clients--are more likely to need to
either switch vendors or build a developer interface in house. This
could lead to higher costs, as the costs of switching to a new vendor
may be larger as a proportion of total assets or revenues for smaller
depositories relative to larger depositories.
---------------------------------------------------------------------------
\242\ A ``share'' denotes a deposit account held by a credit
union, and thus will include the Regulation E covered accounts under
the proposal.
---------------------------------------------------------------------------
The CFPB does not have data on the vendors used by community banks,
but expects that they may have a similar distribution of vendors as the
comparably sized credit unions, and thus would face comparable costs to
establish a developer interface.
The CFPB seeks comment on its analysis of the potential impact on
depository institutions and credit unions with $10 billion or less in
total assets.
G. Potential Impacts on Consumers in Rural Areas, as Described in
Section 1026
To the extent that the compliance costs of the provisions lead to
higher fees or reductions in services offered by small banks and credit
unions, consumers in rural areas may be disproportionately affected by
the proposed rule because smaller banks hold a larger share of deposits
in rural areas. For example, analysis by the Federal Reserve Board in
2017 found that the market share of community banks (defined as assets
of less than $10 billion) in rural areas is nearly 80 percent on
average, compared with nearly 40 percent in urban areas.\243\
---------------------------------------------------------------------------
\243\ Bd. of Governors of the Fed. Rsrv. Sys., Trends in Urban
and Rural Community Banks (Oct. 4, 2018), https://www.federalreserve.gov/newsevents/speech/quarles20181004a.htm.
---------------------------------------------------------------------------
[[Page 74862]]
Rural consumers are substantially less likely to use online banking
than those who live in urban areas, defined to include all MSAs. For
example, Benson et al. (2020) find that 56 percent of consumers in
rural areas use online banking compared to 75 percent in large
MSAs.\244\ It is possible that rural consumers are more likely to have
deposit accounts at institutions without online banking platforms.
Since these institutions would be exempt from the requirements for data
providers in the proposal, rural consumers at these institutions could
experience less of both the costs and the benefits of the proposal.
Some of the difference in online banking use may also be explained by
differences in access to high-speed internet, since as of 2018
consumers in rural areas were 20.8 percentage points less likely to
have the option of subscribing to high-speed internet.\245\ Given that
rural consumers are less likely to use online banking, they may also be
less likely to use third party online services. The CFPB does not have
comprehensive data on the geographic distribution of the use of third
party products and services, though since rural consumers are less
likely to have high-speed internet access, they may be less likely to
use third party products and services. The 2021 FDIC National Survey of
Unbanked and Underbanked Households found that 68.7 percent of
consumers with bank accounts outside of MSAs had linked their bank
account to a third party online payment service, compared with 72.3
percent in MSAs, showing that rural consumers are slightly less likely
to use at least one type of third party product.\246\
---------------------------------------------------------------------------
\244\ David Benson et al., How do Rural and Urban Retail Banking
Customers Differ?, FEDS Notes (June 2020), https://www.federalreserve.gov/econres/notes/feds-notes/how-do-rural-and-urban-retail-banking-customers-differ-20200612.html.
\245\ Fed. Commc'ns Comm'n, 2020 Broadband Deployment Report
(Apr. 24, 2020), https://docs.fcc.gov/public/attachments/FCC-20-50A1.pdf.
\246\ Fed. Deposit Ins. Corp., 2021 National Survey of Unbanked
and Underbanked Households, https://www.fdic.gov/analysis/household-survey/index.html (last updated July 24, 2023).
---------------------------------------------------------------------------
The CFPB seeks comment on its analysis of potential impacts on
consumers in rural areas.
VII. Regulatory Flexibility Act Analysis
The Regulatory Flexibility Act (RFA) \247\ generally requires an
agency to conduct an IRFA and a FRFA of any rule subject to notice-and-
comment requirements. These analyses must ``describe the impact of the
proposed rule on small entities.'' \248\ An IRFA or FRFA is not
required if the agency certifies that the rule will not have a
significant economic impact on a substantial number of small
entities.\249\ The CFPB also is subject to certain additional
procedures under the RFA involving the convening of a panel to consult
with small business representatives prior to proposing a rule for which
an IRFA is required.\250\ The CFPB has not certified that the proposed
rule would not have a significant economic impact on a substantial
number of small entities within the meaning of the RFA. Accordingly,
the CFPB convened and chaired a Small Business Review Panel under
SBREFA to consider the impact of the proposed rule on small entities
that would be subject to that rule and to obtain feedback from
representatives of such small entities. The Small Business Review Panel
for this proposed rule is discussed in part VII.A. The CFPB is also
publishing an IRFA. Among other things, the IRFA estimates the number
of small entities that will be subject to the proposed rule and
describes the impact of that rule on those entities. The IRFA for this
proposed rule is set forth in part VII.B.
---------------------------------------------------------------------------
\247\ 5 U.S.C. 601 et seq.
\248\ 5 U.S.C. 603(a). For purposes of assessing the impacts of
the proposed rule on small entities, ``small entities'' is defined
in the RFA to include small businesses, small not-for-profit
organizations, and small government jurisdictions. 5 U.S.C. 601(6).
A ``small business'' is determined by application of SBA regulations
and reference to the NAICS classifications and size standards. 5
U.S.C. 601(3). A ``small organization'' is any ``not-for-profit
enterprise which is independently owned and operated and is not
dominant in its field.'' 5 U.S.C. 601(4). A ``small governmental
jurisdiction'' is the government of a city, county, town, township,
village, school district, or special district with a population of
less than 50,000. 5 U.S.C. 601(5).
\249\ 5 U.S.C. 605(b).
\250\ 5 U.S.C. 609.
---------------------------------------------------------------------------
A. Small Business Review Panel
Under section 609(b) of the RFA, as amended by SBREFA and the CFPA,
the CFPB must seek, prior to conducting the IRFA, information from
representatives of small entities that may potentially be affected by
its proposed rules to assess the potential impacts of that rule on such
small entities.
The CFPB complied with this requirement. Details on the SBREFA
Panel and SBREFA Panel Report for this proposed rule are described in
part II.B.
B. Initial Regulatory Flexibility Analysis
1. Description of the Reasons Why Agency Action Is Being Considered
In section 1033 of the CFPA, Congress directed the CFPB to adopt
regulations governing consumers' data access rights. The CFPB is
issuing this proposed rule primarily to begin implementing the CFPA
section 1033 mandate, although the CFPB is also relying on other CFPA
authorities for specific aspects of the proposed rule. See part VI.A
for additional discussion.
2. Succinct Statement of the Objectives of, and Legal Basis for, the
Proposed Rule
As discussed in part VI.A, the primary purpose of this proposed
rule is to implement section 1033 of the CFPA. This proposed rule aims
to (1) expand consumers' access to their financial data across a wide
range of financial institutions, (2) ensure privacy and data security
for consumers by limiting the collection, use, and retention of data
that is not needed to provide the consumer's requested service, and (3)
push for greater efficiency and reliability of data access across the
industry to reduce industry costs, facilitate greater competition, and
support the development of beneficial products and services. The CFPB
is issuing this proposed rule pursuant to its authority under the CFPA.
The specific CFPA provisions relied upon are discussed in part III.
3. Description and, Where Feasible, Provision of an Estimate of the
Number of Small Entities to Which the Proposed Rule Will Apply
The small entities affected by the proposed rule would be those
that meet the definitions of covered data providers, third parties, or
data aggregators. Covered data providers include depository
institutions and nondepository institutions. In the case of the new
financial data processing product or service definition, it would apply
to third parties, data aggregators, or others who provide financial
data processing products or services for consumer purposes.
Nondepository financial institutions and entities outside of the
financial industry may also be affected, though it is important to note
that entities within these industries would only be subject to the
proposed rule if they meet the definitions of covered data provider,
third party, or data aggregator. Examples of potentially affected small
third parties include entities using consumer-authorized information to
underwrite loans, offer budgeting or personal financial management
services, or facilitate payments.
For the purposes of assessing the impacts of the proposed rule on
small entities, ``small entities'' are defined in the RFA to include
small businesses, small nonprofit organizations, and small
[[Page 74863]]
government jurisdictions. A ``small business'' is defined by the SBA's
Office of Size Standards for all industries in the NAICS. The CFPB has
identified several categories of small entities that may be subject to
the proposals under consideration. Within the financial industry, these
include depository institutions (such as commercial banks, savings
associations, and credit unions), credit card issuing nondepositories,
sales financing companies, consumer lending companies, real estate
credit companies, firms that engage in financial transactions
processing, reserve, and clearinghouse activities, firms that engage in
other activities related to credit intermediation, investment banking
and securities dealing companies, securities brokerage companies, and
commodities contracts brokerage companies. Outside of the financial
industry, potentially affected small entities include software
publishers, firms that provide data processing and hosting services,
firms that provide payroll services, firms that provide custom computer
programming services, and credit bureaus. According to the SBA's Office
of Size Standards, depository institutions are small if they have less
than $850 million in assets. Nondepository firms that may be subject to
the proposals under consideration have a maximum size of $47 million in
receipts, but the threshold is lower for some NAICS categories.\251\
Table 1 shows the number of small businesses within NAICS categories
that may be subject to the proposed rule based on December 2022 NCUA
and FFIEC Call Report data and 2017 Economic Census data from the U.S.
Census Bureau. Entity counts are not provided for the specific revenue
amounts that the SBA uses to define small entities and are instead
usually provided at multiples of five or ten million dollars. Table 1
includes the closest upper and lower estimates for each revenue limit
(e.g., a NAICS category with a maximum size of $47 million in receipts
has both the count of entities with less than $50 million in revenue
and the count of entities with less than $40 million in revenue). Not
all small entities within each included NAICS category would be subject
to the proposed rule.
---------------------------------------------------------------------------
\251\ SBA regularly updates its size thresholds to account for
inflation and other factors. The SBA Size Standards described here
reflect the thresholds in effect at the publication date of this
report. The 2017 Economic Census data are the most recently
available data with entity counts by annual revenue. See Small Bus.
Admin., SBA Size Standards (effective Mar. 17, 2023), https://www.sba.gov/sites/sbagov/files/2023-06/Table%20of%20Size%20Standards_Effective%20March%2017%2C%202023%20%282%29.pdf.
Table 1--Number of Small Businesses Within NAICS Industry Codes That May
Be Subject to the Provisions Under Consideration
------------------------------------------------------------------------
Number of Percent of
entities entities
------------------------------------------------------------------------
A. Small Depository Firms
Commercial Banking (522110) and Savings 4,706 ..............
Institutions (522120)..................
< $850M (Assets).................... 3,566 75.8
Credit Unions (522130).................. 4,861 ..............
< $850M (Assets).................... 4,365 89.8
B. Small Nondepository Firms
Software Publishers (511210)............ 10,014 ..............
< $40M (Revenue).................... 9,395 93.8
< $50M (Revenue).................... 9,461 94.5
Data Processing, Hosting, and Related 10,860 ..............
Services (518210)......................
< $40M (Revenue).................... 9,930 91.4
Sales Financing (522220)................ 2,367 ..............
< $40M (Revenue).................... 2,112 89.2
< $50M (Revenue).................... 2,124 89.7
Consumer Lending (522291)............... 3,037 ..............
< $40M (Revenue).................... 2,905 95.7
< $50M (Revenue).................... 2,915 96.0
Real Estate Credit (522292)............. 3,289 ..............
< $40M (Revenue).................... 2,872 87.3
< $50M (Revenue).................... 2,904 88.3
Financial Transactions Processing, 3,068 ..............
Reserve, and Clearinghouse Activities
(522320)...............................
< $40M (Revenue).................... 2,916 95.0
< $50M (Revenue).................... 2,928 95.4
Other Activities Related to Credit 3,772 ..............
Intermediation (522390)................
< $25M (Revenue).................... 3,610 95.7
< $30M (Revenue).................... 3,621 96.0
Investment Banking and Securities 2,394 ..............
Dealing (523110).......................
< $40M (Revenue).................... 2,214 92.5
< $50M (Revenue).................... 2,227 93.0
Securities Brokerage (523120)........... 6,919 ..............
< $40M (Revenue).................... 6,703 96.9
< $50M (Revenue).................... 6,717 97.1
Commodities Contracts Brokerage (523140) 856 ..............
< $40M (Revenue).................... 825 96.4
< $50M (Revenue).................... 829 96.8
Payroll Services (541214)............... 4,328 ..............
< $35M (Revenue).................... 4,111 95.0
< $40M (Revenue).................... 4,116 95.1
Custom Computer Programming Services 62,205 ..............
(541511)...............................
< $30M (Revenue).................... 60,959 98.0
< $35M (Revenue).................... 61,088 98.2
Credit Bureaus (561450)................. 307 ..............
[[Page 74864]]
< $35M (Revenue).................... 279 90.9
< $75M (Revenue).................... 283 92.2
------------------------------------------------------------------------
Table 2 provides the CFPB's estimate of the actual number of
affected entities within the categories of depositories, nondepository
data providers, and third parties, and the NAICS codes these entities
may fall within. As described in part VII.B.6, the CFPB estimates that
approximately 13 percent of the small depositories would not be subject
to the proposed rule because they did not have a consumer interface as
of December 2022, leaving approximately 6,897 small depositories
subject to the proposed rule. The CFPB is not able to estimate with
precision the number of small nondepository entities that would be
subject to the proposed rule, but expects that approximately 100 small
nondepository institutions would be covered data providers subject to
the proposed rule. In addition, based on data from the Provider
Collection and Aggregator Collection, the CFPB estimates that between
6,800 and 9,500 small entities are third parties that access consumer-
authorized data.
Table 2--Estimated Number of Affected Entities and Small Entities by Category
----------------------------------------------------------------------------------------------------------------
Est. total
Category NAICS Small entity affected Est. number of
threshold entities small entities
----------------------------------------------------------------------------------------------------------------
Depository Institutions........... 522110, 522120, $850 million in 8,506 6,897
522130, 522210. assets.
Nondepository financial 511210, 522291, Varies, less than $47 120 100
institutions and data providers. 522320. million in annual
receipts.
Third parties..................... 511210, 518210, Varies, less than $47 7,000-10,000 6,800-9,500
522220, 522291, million in annual
522292, 522320, receipts.
522390, 523110,
523120, 523140,
541214, 541511,
561450.
----------------------------------------------------------------------------------------------------------------
4. Projected Reporting, Recordkeeping, and Other Compliance
Requirements of the Proposed Rule, Including an Estimate of the Classes
of Small Entities Which Will Be Subject to the Requirement and the Type
of Professional Skills Necessary for the Preparation of the Report
The proposed rule would impose new reporting, recordkeeping, and
other compliance requirements on small entities subject to the
proposal. These requirements generally differ for small entities in two
classes: data providers and third parties. Part VI.E provides a
detailed description of the requirements and estimated compliance costs
that would be faced by affected small entities under the proposed rule.
These requirements would be imposed on an estimated 6,897 depository
data providers, 100 nondepository data providers, and between 6,800 and
9,500 third parties, as shown in Table 2. The proposed requirements and
their costs are summarized in this section.
Requirements for Data Providers
The proposed rule would require data providers to report the number
of proper responses divided by the total number of queries to their
developer interface on a monthly basis. The CFPB estimates that data
providers may face a $7,300 cost of developing and testing a system to
regularly disclose this performance metric on their websites. The CFPB
expects these reports will generally be automated and will have minimal
ongoing costs after the system is implemented.
The proposed rule would require data providers to have policies and
procedures to retain records to demonstrate compliance with certain
other requirements of the proposed rule. Data providers would also be
required to have policies and procedures designed to ensure that the
reason for the decision to decline a third party's request to access
its developer interface is communicated to the third party. The CFPB
expects that these recordkeeping requirements would likely be built
into a data provider's developer interface and the cost methodology
described in part IV.E.1 includes these in the overall cost of
establishing and maintaining a compliant developer interface.
Incremental costs of these requirements are limited to developing and
implementing reasonable policies and procedures, which the CFPB
estimates would cost $5,500 to $11,900 per data provider.
The proposed rule requires data providers to establish and maintain
a consumer interface that allows consumers to export their covered data
in machine-readable formats. As discussed in part VII.B.4, the CFPB
expects that data providers subject to this requirement generally
already provide the required information under the baseline and
estimates that the incremental costs of this requirement will be
minimal.
The proposed rule requires data providers to establish and maintain
a developer interface. As described in part VII.B.4, the CFPB expects
that data providers will either contract with a vendor for their
developer interfaces or develop and maintain their developer interfaces
in-house. The cost estimate of developing and maintaining a developer
interface is up to $24 per account per year for small data providers
that choose to contract with a vendor. For small data providers that
choose to build their developer interface in-house, the estimated
upfront cost is between $250,000 and $500,000. Estimated annual costs
for in-house developer interfaces include technology costs of $20,000
as well as ongoing staffing costs of $45,000 to $91,000. The proposed
rule would require data providers to report the number of proper
responses divided by the total number of queries to their developer
interface on a monthly basis. The CFPB estimates that data providers
may face a $7,300 cost of developing and testing a system to
[[Page 74865]]
regularly disclose this performance metric on their websites, with
minimal maintenance costs after the system is implemented.
The proposed rule would require data providers to have policies and
procedures to ensure that data are accurately transferred to third
parties. In the cost methodology described in part IV.E.1, the CFPB
includes these costs in the estimate for establishing and maintaining a
compliant developer interface.
Satisfying these requirements for data providers would generally
involve professional skills related to software development, general
and operational management, legal expertise, compliance, and customer
support.
Requirements for Third Parties
Third parties are not subject to reporting requirements but would
be required to retain records of consumer data access requests and
actions taken in response to these requests, reasons for not making the
data available, and data access denials under the proposed rule. The
CFPB understands that most third parties maintain similar records and
costs would be limited to a one-time change to existing systems and
small storage costs. The CFPB estimates a one-time cost of $8,200 for
third parties to develop and implement appropriate policies and
procedures, with minimal ongoing costs.
The proposed rule would require third parties to establish and
maintain systems that could receive data access revocation requests,
track duration-limited authorizations, delete data when required due to
revoked or lapsed authorizations, and retain the relevant records. The
CFPB estimates that the one-time cost to establish these systems would
be between $21,900 and $91,300, with minimal ongoing costs.
The proposed rule would require third parties to provide
authorization disclosure and certification statements. The CFPB
estimates that the one-time cost to third parties of establishing an
automated system to provide these disclosures would be $91,300.
However, the CFPB expects that small third parties will generally use
another third party to provide these disclosures and this cost will not
be incurred. If third parties currently provide disclosures, modifying
the content to comply with the proposed rule is estimated to cost
between $2,700 and $3,700.
Satisfying these requirements for data providers would generally
involve professional skills related to software development, general
and operational management, legal expertise, compliance, and customer
support.
As discussed in part VI.E.1, the CFPB does not expect the new
financial data processing products or services definition to impose
costs on small entities.
5. Identification, to the Extent Practicable, of All Relevant Federal
Rules Which May Duplicate, Overlap, or Conflict With the Proposed Rule
The Equal Credit Opportunity Act (ECOA) \252\ and the CFPB's
implementing regulation, Regulation B (12 CFR part 1002), prohibit
creditors from discriminating in any aspect of a credit transaction,
including a business-purpose transaction, on the basis of race, color,
religion, national origin, sex, marital status, age (if the applicant
is old enough to enter into a contract), receipt of income from any
public assistance program, or the exercise in good faith of a right
under the Consumer Credit Protection Act.\253\
---------------------------------------------------------------------------
\252\ 15 U.S.C. 1691 et seq.
\253\ 15 U.S.C. 1601 et seq.
---------------------------------------------------------------------------
EFTA and the CFPB's implementing regulation, Regulation E,
establish a basic framework of the rights, liabilities, and
responsibilities of participants in the electronic fund and remittance
transfer systems. Among other requirements, EFTA and Regulation E
prescribe requirements applicable to electronic fund transfers,
including disclosures, error resolution, and rules related to
unauthorized electronic fund transfers.
The FCRA and the CFPB's implementing regulation, Regulation V (12
CFR part 1022), govern the collection, assembly, and use of consumer
report information and provide the framework for the consumer reporting
system in the United States. They also promote the accuracy, fairness,
and privacy of information in the files of consumer reporting agencies.
They also include limitations on the use of certain types of consumer
information, limitations on the disclosure of such information to third
parties, as well as certain requirements related to accuracy and
dispute resolution.
The GLBA and the CFPB's implementing regulation, Regulation P (12
CFR part 1016), require financial institutions subject to the CFPB's
jurisdiction to provide their customers with notices concerning their
privacy policies and practices, among other things. They also place
certain limitations on the disclosure of nonpublic personal information
to nonaffiliated third parties, and on the redisclosure and reuse of
such information. Other parts of the GLBA, as implemented by
regulations and guidelines of certain other Federal agencies (e.g., the
FTC's Safeguards Rule and the prudential regulators' Safeguards
Guidelines), set forth standards for administrative, technical, and
physical safeguards with respect to financial institutions' customer
information. These standards generally apply to the security and
confidentiality of customer records and information, anticipated
threats or hazards to the security or integrity of such records, and
unauthorized access to or use of such records or information that could
result in substantial harm or inconvenience to any customer.
TILA and the CFPB's implementing regulation, Regulation Z, impose
requirements on creditors and include special provisions for credit
offered by credit card issuers. Among other requirements, TILA and
Regulation Z prescribe requirements applicable to credit cards,
including disclosures, error resolution, and rules related to
unauthorized credit card use.
TISA and the CFPB's implementing regulation, Regulation DD (12 CFR
part 1030), apply to depository institutions; TISA and part 707 of the
NCUA Rules and Regulations apply to credit unions. Among other things,
TISA and Regulation DD prescribe requirements applicable to deposit
accounts, including disclosure requirements.
The Real Estate Settlement Procedures Act of 1974 \254\ and the
CFPB's implementing regulation, Regulation X (12 CFR part 1024),
include requirements applicable to mortgage servicers that seek to
protect borrowers against certain billing and servicing errors.
---------------------------------------------------------------------------
\254\ 12 U.S.C. 2601 et seq.
---------------------------------------------------------------------------
6. Description of Any Significant Alternatives to the Proposed Rule
Which Accomplish the Stated Objectives of Applicable Statutes and
Minimize Any Significant Economic Impact of the Proposed Rule on Small
Entities
The CFPB considered several alternatives to the proposed rule that
would minimize economic impacts on small entities. These alternatives
generally fall into four categories: (1) exemptions from the proposed
rule for small data providers, (2) permitting small data providers to
charge fees for making covered data available, (3) exemptions from the
proposed rule for small third parties, or (4) alternative compliance
dates for small depository data providers.
For small data providers, the CFPB considered exemptions based on
the
[[Page 74866]]
number of covered accounts or on total assets. To estimate the
potential number of entities and share of accounts that would be
exempted under the alternatives, the CFPB uses Call Report data as of
the end of December 2022 on the number of FDIC- or NCUA-insured deposit
accounts as a proxy for covered accounts at depository data providers.
The CFPB expects that depositories make up a large majority of small
entity data providers but lacks data to estimate the number and size of
small nondepository data providers. The CFPB requests data and evidence
on these entities.
Tables 3 and 4 report the share and number of all depositories that
would be exempted under the proposed rule and under alternative
exemption thresholds, as well as the number and share of small entity
depositories--those with less than $850 million in assets--that would
be exempted. For the estimates under the proposed rule, banks are
estimated to be exempt if they did not report ``Yes'' in response to
the question ``Do any of the bank's internet websites have
transactional capability, i.e., allow the bank's customers to execute
transactions on their accounts through the website?'' in December 2022
FFIEC Call Report data. Credit unions are estimated to be exempt if
they did not affirmatively report having ``Online Banking'' or a
``Mobile Application'' or services to offer ``Download Account
History'' or ``E-Statements'' electronically in December 2022 NCUA
Profile Form 4501A data. These data do not precisely identify which
entities may be exempt from the proposal, but the CFPB is not aware of
better available data to estimate whether entities are exempt. In
addition, because at least some entities not reporting online banking
or transactional websites have online banking websites as of the
publication of this proposal, this is likely an overestimate of the
number of exempt entities. The CFPB requests comment on its estimate of
the share of depositories exempted.
---------------------------------------------------------------------------
\255\ This is the number of FDIC- or NCUA-insured deposit
accounts that would be exempted divided by the total number of FDIC-
or NCUA-insured deposit accounts. Credit cards are not in the
numerator or denominator. Commercial deposit accounts are in both
the numerator and denominator.
\256\ For this analysis, banks are classified as exempt if they
do not report ``Yes'' to Item 9 of the Schedule RC-M on their
December 2022 Call Report. Credit unions are classified as exempt if
they did not report that they have ``Online Banking'' or ``Mobile
Application'' for question 2 or ``Download Account History'' or ``E-
Statements'' for question 4 under ``Information Technology (IT)'' on
their December 2022 NCUA Profile Form 4501A.
\257\ The estimates in this table are based on FDIC- or NCUA-
insured deposit accounts, as there is no available data on number of
covered accounts.
\258\ This is the number of FDIC- or NCUA-insured deposit
accounts that would be exempted divided by the total number of FDIC-
or NCUA-insured deposit accounts. Credit cards are not in the
numerator or denominator. Commercial deposit accounts are in both
the numerator and denominator.
\259\ For this analysis, banks are classified as exempt if they
do not report ``Yes'' to Item 9 of the Schedule RC-M on their
December 2022 Call Report. Credit unions are classified as exempt if
they did not report that they have ``Online Banking'' or ``Mobile
Application'' for Item 2 or ``Download Account History'' or ``E-
Statements'' for Item 4 under ``Information Technology (IT)'' on
their December 2022 NCUA Profile Form 4501A.
Table 3--Number of Exempted Entities Under Account-Based Alternative Exemption Thresholds Considered
----------------------------------------------------------------------------------------------------------------
Share of small Number of Share of
Share of Number of entity small entity accounts
Exemption threshold depositories depositories depositories depositories exempted
exempted exempted exempted exempted (approx.)
(approx.) (%) (approx.) (approx.) (%) (approx.) \255\ (%)
----------------------------------------------------------------------------------------------------------------
Proposed rule \256\............. 11 1,061 13 1,033 0.64
Less than 500 accounts \257\.... 5 479 6 464 0.01
Less than 1,000 accounts........ 10 964 12 943 0.04
Less than 2,000 accounts........ 18 1,731 21 1,705 0.15
Less than 3,000 accounts........ 26 2,492 31 2,460 0.32
Less than 4,000 accounts........ 32 3,091 38 3,047 0.51
Less than 5,000 accounts........ 38 3,622 45 3,573 0.72
Less than 10,000 accounts....... 57 5,407 67 5,302 1.88
----------------------------------------------------------------------------------------------------------------
Table 4--Number of Exempted Entities Under Asset-Based Alternative Exemption Thresholds Considered
----------------------------------------------------------------------------------------------------------------
Share of
Share of Number of Share of small Number of accounts
Exemption threshold depositories depositories entity small entity exempted
exempted (%) exempted depositories depositories (approx.)
exempted (%) exempted \258\ (%)
----------------------------------------------------------------------------------------------------------------
Proposed rule \259\............. 11 1,061 13 1,033 0.64
Less than $50 million in assets. 27 2,621 33 2,621 0.57
Less than $100 million in assets 40 3,799 48 3,799 1.29
Less than $150 million in assets 48 4,631 58 4,631 1.98
Less than $200 million in assets 55 5,249 66 5,249 2.64
Less than $250 million in assets 60 5,704 72 5,704 3.23
----------------------------------------------------------------------------------------------------------------
The CFPB has preliminarily determined that the exemption in the
proposed rule would best target the exemption to those entities which
would face the highest cost of compliance absent the exemption. Small
depositories without any digital banking infrastructure would face the
highest costs from establishing and maintaining interfaces for both
consumer and authorized third party access. While many of these
entities would be exempted by alternative account- or asset-based
exemptions, the CFPB has preliminarily determined that such
alternatives would also exempt some data providers that may be able to
comply at lower cost. The CFPB also
[[Page 74867]]
expects that the later compliance date for these smaller entities will
generally reduce the burden on these entities, mitigating the need for
broader exemptions.
Small data providers not excluded from the requirements of proposed
part 1033 (because they have a consumer interface) that do not have a
developer interface would incur the costs necessary to establish and
maintain such an interface. To help offset those costs, the CFPB has
considered the alternative of permitting small data providers to charge
fees for making covered data available through developer interfaces.
The CFPB is proposing, however, to prohibit fees across data providers
of all sizes. This is because the CFPB has preliminarily determined
that a data provider charging such fees would be inconsistent with the
data provider's statutory obligation under CFPA section 1033 to make
covered data available to consumers and to their authorized third party
representatives. Further, consumers at small data providers could be
harmed through reduced access to third parties' products and services
if the CFPB were to permit only small data providers to charge fees.
The CFPB also considered exemptions as a means to reduce burden for
small entity third parties. Based on data from the Aggregator
Collection, the CFPB estimates that there are approximately 6,800 to
9,500 third parties with fewer than 100,000 connected accounts, many of
whom may be small entities. However, exempting third parties from
certain conditions of access under the proposed rule, such as the
requirements on collection, use, and retention, would likely create
risks of harm for consumers on data security and privacy grounds,
provide unfair competitive advantages for exempt versus non-exempt
third parties, and increase the risks of losses from data security
incidents for consumers and data providers.
Finally, the CFPB considered alternative compliance dates for small
entities to reduce burden. The proposed rule has a compliance date of
approximately four years after the final rule is published in the
Federal Register for depository data providers with less than $850
million in assets. Since depositories are defined as small entities if
they have less than $850 million in assets, all depository small
entities would fall into this compliance date tier by definition. As a
result, all depository small entities would have a significant amount
of time from the issuance of this proposed rule to come into compliance
with the rule. Given the development of credential-free interfaces for
third parties by core banking providers and other vendors, the CFPB
expects that it will not be overly burdensome for small entity data
providers to come into compliance before this date. Alternative
compliance dates further into the future would extend the period during
which screen scraping and other less secure and less privacy-protective
data access methods would continue to be used, creating risks of harm
to consumers and data providers.
7. Discussion of Impact on Cost of Credit for Small Entities
The CFPB expects that the proposal may have some limited impact on
the cost or availability of credit for small entities but does not
expect that the impact would be substantial. The CFPB expects there are
several ways the proposal could potentially impact the cost or
availability of credit to small entities. First, the provisions could
impact the availability of credit to small entities if small businesses
are using loans from lenders (either data providers or third parties)
affected by the provisions and the provisions lead to a contraction of
the market. Second, the proposal could potentially increase the cost of
credit for small businesses if the costs of implementing the proposal
are passed through in the form of higher prices on loans from lenders.
Third, for small business owners that use consumer-authorized data to
qualify for or access credit, the provisions could potentially increase
credit availability or lower costs for small entities by facilitating
increased data access.\260\ Small entity representatives did not
provide feedback on this topic.\261\ The CFPB does not have data to
quantify these potential impacts.
---------------------------------------------------------------------------
\260\ As an example, Howell et al. found that more automated
fintech lenders facilitated a higher share of Paycheck Protection
Program loans to small, Black-owned firms relative to traditional
lenders. Sabrina T. Howell et al., Lender Automation and Racial
Disparities in Credit Access, NBER Working Paper No. 29364 (Nov.
2022), https://www.nber.org/system/files/working_papers/w29364/w29364.pdf.
\261\ SBREFA Panel Report at 40.
---------------------------------------------------------------------------
The CFPB seeks comment on its analysis of the proposal's impact on
the cost of credit for small entities, and requests data or evidence on
these potential impacts.
VIII. Paperwork Reduction Act
Under the Paperwork Reduction Act of 1995 (PRA),\262\ Federal
agencies are generally required to seek, prior to implementation,
approval from OMB for information collection requirements. Under the
PRA, the CFPB may not conduct or sponsor, and, notwithstanding any
other provision of law, a person is not required to respond to, an
information collection unless the information collection displays a
valid control number assigned by OMB.
---------------------------------------------------------------------------
\262\ 44 U.S.C. 3501 et seq.
---------------------------------------------------------------------------
As part of its continuing effort to reduce paperwork and respondent
burden, the CFPB conducts a preclearance consultation program to
provide the general public and Federal agencies with an opportunity to
comment on the information collection requirements in accordance with
the PRA. This helps ensure that the public understands the CFPB's
requirements or instructions, respondents can provide the requested
data in the desired format, reporting burden (time and financial
resources) is minimized, information collection instruments are clearly
understood, and the CFPB can properly assess the impact of information
collection requirements on respondents.
The proposed rule would create a new 12 CFR part 1033 and amend 12
CFR part 1001. The proposed rule contains seven new information
collection requirements.
1. Obligation to make covered data available (proposed Sec.
1033.201), including general requirements (proposed Sec. 1033.301) and
requirements applicable to developer interface (proposed Sec.
1033.311).
2. Information about the data provider (proposed Sec. 1033.341).
3. Policies and procedures for data providers (proposed Sec.
1033.351).
4. Third party authorization; general (proposed Sec. 1033.401),
including the authorization disclosure (proposed Sec. 1033.411).
5. Third party obligations (proposed Sec. 1033.421).
6. Use of data aggregator (proposed Sec. 1033.431).
7. Policies and procedures for third party record retention
(proposed Sec. 1033.441).
The information collection requirements in this proposed rule would
be mandatory.
The collections of information contained in this proposed rule, and
identified as such, have been submitted to OMB for review under section
3507(d) of the PRA. A complete description of the information
collection requirements (including the burden estimate methods) is
provided in the information collection request (ICR) that the CFPB has
submitted to OMB under the requirements of the PRA. The ICR submitted
to OMB requesting approval under the PRA for the information collection
requirements contained herein is available at www.regulations.gov as
well as on OMB's public-facing docket at
[[Page 74868]]
www.reginfo.gov. Please submit your comments to OMB at www.reginfo.gov/public/do/PRAMain by clicking the link ``Currently under Review--Open
for Public Comments'' and using the search function to find the ICR for
comment.
Title of Collection: 12 CFR part 1033.
OMB Control Number: 3170-XXXX.
Type of Review: New collection.
Affected Public: Private Sector.
Estimated Number of Respondents: 17,006.
Estimated Total Annual Burden Hours: 2,040,600 annually and
10,323,120 one-time.
Comments are invited on: (1) Whether the collection of information
is necessary for the proper performance of the functions of the CFPB,
including whether the information will have practical utility; (2) the
accuracy of the CFPB's estimate of the burden of the collection of
information, including the validity of the methods and the assumptions
used; (3) ways to enhance the quality, utility, and clarity of the
information to be collected; and (4) ways to minimize the burden of the
collection of information on respondents, including through the use of
automated collection techniques or other forms of information
technology. Comments submitted in response to this proposal will be
summarized and/or included in the request for OMB approval. All
comments will become a matter of public record.
If applicable, the notice of final rule will display the control
number assigned by OMB to any information collection requirements
proposed herein and adopted in the final rule.
IX. Severability
The CFPB preliminarily intends that, if any provision of the final
rule, or any application of a provision, is stayed or determined to be
invalid, the remaining provisions or applications are severable and
shall continue in effect.
However, this is subject to the following significant exception.
The CFPB preliminarily considers data providers' proposed obligations
to provide data under 12 CFR part 1033 to authorized third parties to
be inseparable from the protections the CFPB is proposing in subpart D
to ensure that authorized third parties are acting on behalf of
consumers. Accordingly, if any of the provisions in subpart D were
stayed or determined to be invalid, the CFPB preliminary intends that
subpart D, together with references to third parties and authorized
third parties elsewhere in part 1033, shall not continue in effect.
This would not affect direct access by consumers to covered data under
the remainder of part 1033, and it would also not affect the definition
of financial product or service under proposed Sec. 1001.2(b).
List of Subjects
12 CFR Part 1001
Consumer protection, Credit.
12 CFR Part 1033
Banks, banking, Consumer protection, Credit, Credit Unions,
Electronic funds transfers, National banks, Privacy, Reporting and
recordkeeping requirements, Savings associations, Voluntary standards.
Authority and Issuance
For the reasons set forth in the preamble, the CFPB proposes to
amend 12 CFR part 1001 and add part 1033, as set forth below:
PART 1001--FINANCIAL PRODUCTS OR SERVICES
0
1. The authority citation for part 1001 continues to read as follows:
Authority: 12 U.S.C. 5481(15)(A)(xi); and 12 U.S.C. 5512(b)(1).
0
2. Amend Sec. 1001.2 by revising paragraph (b) and adding reserved
paragraph (c) to read as follows:
Sec. 1001.2 Definitions.
* * * * *
(b) Providing financial data processing products or services by any
technological means, including processing, storing, aggregating, or
transmitting financial or banking data, alone or in connection with
another product or service, where the financial data processing is not
offered or provided by a person who, by operation of 12 U.S.C.
5481(15)(A)(vii)(I) or (II), is not a covered person.
(c) [Reserved].
0
3. Add part 1033 to read as follows:
PART 1033--PERSONAL FINANCIAL DATA RIGHTS
Subpart A--General
Sec.
1033.101 Authority, purpose, and organization.
1033.111 Coverage of data providers.
1033.121 Compliance dates.
1033.131 Definitions.
1033.141 Standard setting.
Subpart B--Obligation to Make Covered Data Available
1033.201 Obligation to make covered data available.
1033.211 Covered data.
1033.221 Exceptions.
Subpart C--Data Provider Interfaces; Responding to Requests
1033.301 General requirements.
1033.311 Requirements applicable to developer interface.
1033.321 Interface access.
1033.331 Responding to requests for information.
1033.341 Information about the data provider.
1033.351 Policies and procedures.
Subpart D--Authorized Third Parties
1033.401 Third party authorization; general.
1033.411 Authorization disclosure.
1033.421 Third party obligations.
1033.431 Use of data aggregator.
1033.441 Policies and procedures for third party record retention.
Authority: 12 U.S.C. 5512; 12 U.S.C. 5514; 12 U.S.C. 5532; 12
U.S.C. 5533.
Subpart A--General
Sec. 1033.101 Authority, purpose, and organization.
(a) Authority. The regulation in this part is issued by the
Consumer Financial Protection Bureau (CFPB) pursuant to the Consumer
Financial Protection Act of 2010 (CFPA), Pub. L. 111-203, tit. X, 124
Stat. 1955.
(b) Purpose. This part implements the provisions of section 1033 of
the CFPA by requiring data providers to make available to consumers and
authorized third parties, upon request, covered data in the data
provider's control or possession concerning a covered consumer
financial product or service, in an electronic form usable by consumers
and authorized third parties; and by prescribing standards to promote
the development and use of standardized formats for covered data,
including through industry standards developed by standard-setting
bodies recognized by the CFPB. This part also sets forth obligations of
third parties that would access covered data on a consumer's behalf,
including limitations on their collection, use, and retention of
covered data.
(c) Organization. This part is divided into subparts as follows:
(1) Subpart A establishes the authority, purpose, organization,
coverage of data providers, compliance dates, and definitions
applicable to this part.
(2) Subpart B provides the general obligation of data providers to
make covered data available upon the request of a consumer or
authorized third party, including what types of information must be
made available.
(3) Subpart C provides the requirements for data providers to
establish and maintain interfaces to
[[Page 74869]]
receive and respond to requests for covered data.
(4) Subpart D provides the obligations of third parties that would
access covered data on behalf of a consumer.
Sec. 1033.111 Coverage of data providers.
(a) Coverage of data providers. A data provider has obligations
under this part if it controls or possesses covered data concerning a
covered consumer financial product or service, subject to the exclusion
in paragraph (d) of this section.
(b) Definition of covered consumer financial product or service.
Covered consumer financial product or service means a consumer
financial product or service, as defined in 12 U.S.C. 5481(5), that is:
(1) A Regulation E account, which means an account, as defined in
Regulation E, 12 CFR 1005.2(b);
(2) A Regulation Z credit card, which means a credit card, as
defined in Regulation Z, 12 CFR 1026.2(a)(15)(i); and
(3) Facilitation of payments from a Regulation E account or
Regulation Z credit card.
(c) Definition of data provider. Data provider means a covered
person, as defined in 12 U.S.C. 5481(6), that is:
(1) A financial institution, as defined in Regulation E, 12 CFR
1005.2(i);
(2) A card issuer, as defined in Regulation Z, 12 CFR 1026.2(a)(7);
or
(3) Any other person that controls or possesses information
concerning a covered consumer financial product or service the consumer
obtained from that person.
Example 1 to paragraph (c): A digital wallet provider is a data
provider.
(d) Excluded data providers. The requirements of this part do not
apply to data providers that are depository institutions that do not
have a consumer interface.
Sec. 1033.121 Compliance dates.
A data provider must comply with Sec. Sec. 1033.201 and 1033.301
beginning on:
(a) [Approximately six months after the date of publication of the
final rule in the Federal Register], for depository institution data
providers that hold at least $500 billion in total assets and
nondepository institution data providers that generated at least $10
billion in revenue in the preceding calendar year or are projected to
generate at least $10 billion in revenue in the current calendar year.
(b) [Approximately one year after the date of publication of the
final rule in the Federal Register], for data providers that are:
(1) Depository institutions that hold at least $50 billion in total
assets but less than $500 billion in total assets; or
(2) Nondepository institutions that generated less than $10 billion
in revenue in the preceding calendar year and are projected to generate
less than $10 billion in revenue in the current calendar year.
(c) [Approximately two and a half years after the date of
publication of the final rule in the Federal Register], for depository
institutions that hold at least $850 million in total assets but less
than $50 billion in total assets.
(d) [Approximately four years after the date of publication of the
final rule in the Federal Register], for depository institutions that
hold less than $850 million in total assets.
Sec. 1033.131 Definitions.
For purposes of this part, the following definitions apply:
Authorized third party means a third party that has complied with
the authorization procedures described in Sec. 1033.401.
Card issuer is defined at Sec. 1033.111(c)(2).
Consumer means a natural person. Trusts established for tax or
estate planning purposes are considered natural persons for purposes of
this definition.
Consumer interface means an interface through which a data provider
receives requests for covered data and makes available covered data in
an electronic form usable by consumers in response to the requests.
Covered consumer financial product or service is defined at Sec.
1033.111(b).
Covered data is defined at Sec. 1033.211.
Data aggregator means an entity that is retained by and provides
services to the authorized third party to enable access to covered
data.
Data provider is defined at Sec. 1033.111(c).
Developer interface means an interface through which a data
provider receives requests for covered data and makes available covered
data in an electronic form usable by authorized third parties in
response to the requests.
Financial institution is defined at Sec. 1033.111(c)(1).
Qualified industry standard means a standard issued by a standard-
setting body that is fair, open, and inclusive in accordance with Sec.
1033.141(a).
Regulation E account is defined at Sec. 1033.111(b)(1).
Regulation Z credit card is defined at Sec. 1033.111(b)(2).
Third party means any person or entity that is not the consumer
about whom the covered data pertains or the data provider that controls
or possesses the consumer's covered data.
Sec. 1033.141 Standard setting.
(a) Fair, open, and inclusive standard-setting body. A standard-
setting body is fair, open, and inclusive and is an issuer of qualified
industry standards when it has all of the following attributes:
(1) Openness: The sources, procedures, and processes used are open
to all interested parties, including: consumer and other public
interest groups with expertise in consumer protection, financial
services, community development, fair lending, and civil rights;
authorized third parties; data providers; data aggregators and other
providers of services to authorized third parties; and relevant trade
associations. Parties can meaningfully participate in standards
development on a non-discriminatory basis.
(2) Balance: The decision-making power is balanced across all
interested parties, including consumer and other public interest
groups, at all levels of the standard-setting body. There is meaningful
representation for large and small commercial entities within these
categories. No single interest or set of interests dominates decision-
making. Achieving balance requires recognition that some participants
may play multiple roles, such as being both a data provider and an
authorized third party. The ownership structure of entities is
considered in achieving balance.
(3) Due process: The standard-setting body uses documented and
publicly available policies and procedures, and it provides adequate
notice of meetings and standards development, sufficient time to review
drafts and prepare views and objections, access to views and objections
of other participants, and a fair and impartial process for resolving
conflicting views.
(4) Appeals: An appeals process is available for the impartial
handling of appeals.
(5) Consensus: Standards development proceeds by consensus, which
is defined as general agreement, but not unanimity. During the
development of consensus, comments and objections are considered using
fair, impartial, open, and transparent processes.
(6) Transparency: Procedures or processes for participating in
standards development and for developing standards are transparent to
participants and publicly available.
(7) CFPB recognition: The standard-setting body has been recognized
by the CFPB within the last three years as an issuer of qualified
industry standards.
[[Page 74870]]
(b) CFPB consideration. A standard-setting body may request that
the CFPB recognize it as an issuer of qualified industry standards. The
attributes set forth in paragraphs (a)(1) through (6) of this section
will inform the CFPB's consideration of the request.
Subpart B--Obligation to Make Covered Data Available
Sec. 1033.201 Obligation to make covered data available.
(a) Obligation to make covered data available. A data provider must
make available to a consumer and an authorized third party, upon
request, covered data in the data provider's control or possession
concerning a covered consumer financial product or service that the
consumer obtained from the data provider, in an electronic form usable
by consumers and authorized third parties. Compliance with the
requirements in Sec. Sec. 1033.301 and 1033.311 is required in
addition to the requirements of this paragraph (a).
(b) Current data. In complying with paragraph (a) of this section,
a data provider must make available the most recently updated covered
data that it has in its control or possession at the time of a request.
A data provider must make available information concerning authorized
but not yet settled debit card transactions.
Sec. 1033.211 Covered data.
Covered data in this part means, as applicable:
(a) Transaction information, including historical transaction
information in the control or possession of the data provider. A data
provider is deemed to make available sufficient historical transaction
information for purposes of Sec. 1033.201(a) if it makes available at
least 24 months of such information.
Example 1 to paragraph (a): This category includes amount, date,
payment type, pending or authorized status, payee or merchant name,
rewards credits, and fees or finance charges.
(b) Account balance.
(c) Information to initiate payment to or from a Regulation E
account.
Example 1 to paragraph (c): This category includes a tokenized
account and routing number that can be used to initiate an Automated
Clearing House transaction. In complying with its obligation under
Sec. 1033.201(a), a data provider is permitted to make available a
tokenized account and routing number instead of, or in addition to, a
non-tokenized account and routing number.
(d) Terms and conditions.
Example 1 to paragraph (d): This category includes the applicable
fee schedule, any annual percentage rate or annual percentage yield,
rewards program terms, whether a consumer has opted into overdraft
coverage, and whether a consumer has entered into an arbitration
agreement.
(e) Upcoming bill information.
Example 1 to paragraph (e): This category includes information
about third party bill payments scheduled through the data provider and
any upcoming payments due from the consumer to the data provider.
(f) Basic account verification information, which is limited to the
name, address, email address, and phone number associated with the
covered consumer financial product or service.
Sec. 1033.221 Exceptions.
A data provider is not required to make available the following
covered data to a consumer or authorized third party:
(a) Any confidential commercial information, including an algorithm
used to derive credit scores or other risk scores or predictors.
Information does not qualify for this exception merely because it is an
input to, or an output of, an algorithm, risk score, or predictor. For
example, annual percentage rate and other pricing terms are sometimes
determined by an internal algorithm or predictor but do not fall within
this exception.
(b) Any information collected by the data provider for the sole
purpose of preventing fraud or money laundering, or detecting, or
making any report regarding other unlawful or potentially unlawful
conduct. Information collected for other purposes does not fall within
this exception. For example, name and other basic account verification
information do not fall within this exception.
(c) Any information required to be kept confidential by any other
provision of law. Information does not qualify for this exception
merely because the data provider must protect it for the benefit of the
consumer. For example, the data provider cannot restrict access to the
consumer's own information merely because that information is subject
to privacy protections.
(d) Any information that the data provider cannot retrieve in the
ordinary course of its business with respect to that information.
Subpart C--Data Provider Interfaces; Responding to Requests
Sec. 1033.301 General requirements.
(a) Requirement to establish and maintain interfaces. A data
provider subject to the requirements of this part must maintain a
consumer interface and must establish and maintain a developer
interface. The consumer interface and the developer interface must
satisfy the requirements set forth in this section. The developer
interface must satisfy the additional requirements set forth in Sec.
1033.311.
(b) Machine-readable files upon specific request. Upon specific
request, a data provider must make available to a consumer or an
authorized third party covered data in a machine-readable file that can
be retained by the consumer or authorized third party and transferred
for processing into a separate information system that is reasonably
available to and in the control of the consumer or authorized third
party.
Example 1 to paragraph (b): A data provider makes available covered
data in a machine-readable file that can be retained if the data can be
printed or kept in a separate information system that is in the control
of the consumer or authorized third party.
(c) Fees prohibited. A data provider must not impose any fees or
charges on a consumer or an authorized third party in connection with:
(1) Interfaces. Establishing or maintaining the interfaces required
by paragraph (a) of this section; or
(2) Requests. Receiving requests or making available covered data
in response to requests as required by this part.
Sec. 1033.311 Requirements applicable to developer interface.
(a) General. A developer interface required by Sec. 1033.301(a)
must satisfy the requirements set forth in this section.
(b) Standardized format. The developer interface must make
available covered data in a standardized format. The interface is
deemed to satisfy this requirement if:
(1) The interface makes available covered data in a format that is
set forth in a qualified industry standard; or
(2) In the absence of a qualified industry standard, the interface
makes available covered data in a format that is widely used by the
developer interfaces of other similarly situated data providers with
respect to similar data and is readily usable by authorized third
parties.
(c) Performance specifications. The developer interface must
satisfy the following performance specifications:
(1) Commercially reasonable performance. The performance of the
interface must be commercially reasonable.
(i) Quantitative minimum performance specification. The
[[Page 74871]]
performance of the interface cannot be commercially reasonable if it
does not meet the following quantitative minimum performance
specification regarding its response rate: The number of proper
responses by the interface divided by the total number of queries for
covered data to the interface must be equal to or greater than 99.5
percent. For purposes of this paragraph (c)(1)(i), all of the following
requirements apply:
(A) Any responses by and queries to the interface during scheduled
downtime for the interface must be excluded respectively from the
numerator and the denominator of the calculation.
(B) In order for any downtime of the interface to qualify as
scheduled downtime, the data provider must have provided reasonable
notice of the downtime to all third parties to which the data provider
has granted access to the interface. Indicia that the data provider's
notice of the downtime may be reasonable include that the notice
adheres to a qualified industry standard.
(C) The total amount of scheduled downtime for the interface in the
relevant time period, such as a month, must be reasonable. Indicia that
the total amount of scheduled downtime may be reasonable include that
the amount adheres to a qualified industry standard.
(D) A proper response is a response, other than any message such as
an error message provided during unscheduled downtime of the interface,
that meets all of the following criteria:
(1) The response either fulfills the query or explains why the
query was not fulfilled;
(2) The response is consistent with the reasonable written policies
and procedures that the data provider establishes and maintains
pursuant to Sec. 1033.351(a); and
(3) The response is provided by the interface within a commercially
reasonable amount of time. The amount of time cannot be commercially
reasonable if it is more than 3,500 milliseconds.
(ii) Indicia of compliance. Indicia that the performance of the
interface is commercially reasonable include that it:
(A) Meets the applicable performance specifications set forth in a
qualified industry standard; and
(B) Meets the applicable performance specifications achieved by the
developer interfaces established and maintained by similarly situated
data providers.
(2) Access cap prohibition. Except as otherwise permitted by
Sec. Sec. 1033.221, 1033.321, and 1033.331(b) and (c), a data provider
must not unreasonably restrict the frequency with which it receives and
responds to requests for covered data from an authorized third party
through its developer interface. Any frequency restrictions must be
applied in a manner that is non-discriminatory and consistent with the
reasonable written policies and procedures that the data provider
establishes and maintains pursuant to Sec. 1033.351(a). Indicia that
any frequency restrictions applied are reasonable include that they
adhere to a qualified industry standard.
(d) Security specifications--(1) Access credentials. A data
provider must not allow a third party to access the data provider's
developer interface by using any credentials that a consumer uses to
access the consumer interface.
(2) Security program. (i) A data provider must apply to the
developer interface an information security program that satisfies the
applicable rules issued pursuant to section 501 of the Gramm-Leach-
Bliley Act, 15 U.S.C. 6801; or
(ii) If the data provider is not subject to section 501 of the
Gramm-Leach-Bliley Act, the data provider must apply to its developer
interface the information security program required by the Federal
Trade Commission's Standards for Safeguarding Customer Information, 16
CFR part 314.
Sec. 1033.321 Interface access.
(a) Denials related to risk management. A data provider does not
violate the general obligation in Sec. 1033.201(a) by reasonably
denying a consumer or third party access to an interface described in
Sec. 1033.301(a) based on risk management concerns. Subject to
paragraph (b) of this section, a denial is not unreasonable if it is
necessary to comply with section 39 of the Federal Deposit Insurance
Act, 12 U.S.C. 1831p-1 or section 501 of the Gramm-Leach-Bliley Act, 15
U.S.C. 6801.
(b) Reasonable denials. To be reasonable pursuant to paragraph (a)
of this section, a denial must, at a minimum, be directly related to a
specific risk of which the data provider is aware, such as a failure of
a third party to maintain adequate data security, and must be applied
in a consistent and non-discriminatory manner.
(c) Indicia of reasonable denials. Indicia that a denial pursuant
to paragraph (a) of this section is reasonable include whether access
is denied to adhere to a qualified industry standard related to data
security or risk management.
(d) Denials related to lack of information. A data provider has a
reasonable basis for denying access to a third party under paragraph
(a) of this section if:
(1) The third party does not present evidence that its data
security practices are adequate to safeguard the covered data, provided
that the denial of access is not otherwise unreasonable; or
(2) The third party does not make the following information
available in both human-readable and machine-readable formats, and
readily identifiable to members of the public, meaning the information
must be at least as available as it would be on a public website:
(i) Its legal name and, if applicable, any assumed name it is using
while doing business with the consumer;
(ii) A link to its website;
(iii) Its Legal Entity Identifier (LEI) that is issued by:
(A) A utility endorsed by the LEI Regulatory Oversight Committee,
or
(B) A utility endorsed or otherwise governed by the Global LEI
Foundation (or any successor thereof) after the Global LEI Foundation
assumes operational governance of the global LEI system; and
(iv) Contact information a data provider can use to inquire about
the third party's data security practices.
Sec. 1033.331 Responding to requests for information.
(a) Responding to requests--access by consumers. To comply with the
requirement in Sec. 1033.201(a), upon request from a consumer, a data
provider must make available covered data when it receives information
sufficient to:
(1) Authenticate the consumer's identity; and
(2) Identify the scope of the data requested.
(b) Responding to requests--access by third parties. (1) To comply
with the requirement in Sec. 1033.201(a), upon request from an
authorized third party, a data provider must make available covered
data when it receives information sufficient to:
(i) Authenticate the consumer's identity;
(ii) Authenticate the third party's identity;
(iii) Confirm the third party has followed the authorization
procedures in Sec. 1033.401; and
(iv) Identify the scope of the data requested.
(2) The data provider is permitted to confirm the scope of a third
party's authorization to access the consumer's data by asking the
consumer to confirm:
(i) The account(s) to which the third party is seeking access; and
(ii) The categories of covered data the third party is requesting
to access, as
[[Page 74872]]
disclosed by the third party pursuant to Sec. 1033.411(b)(4).
(c) Response not required. Notwithstanding the general rules in
paragraphs (a) and (b) of this section, a data provider is not required
to make covered data available in response to a request when:
(1) The data are withheld because an exception described in Sec.
1033.221 applies;
(2) The data provider has a basis to deny access pursuant to risk
management concerns in accordance with Sec. 1033.321(a);
(3) The data provider's interface is not available when the data
provider receives a request requiring a response under this section.
However, the data provider is subject to the performance specifications
in Sec. 1033.311(c);
(4) The request is for access by a third party, and:
(i) The consumer has revoked the third party's authorization
pursuant to paragraph (e) of this section;
(ii) The data provider has received notice that the consumer has
revoked the third party's authorization pursuant to Sec.
1033.421(h)(2); or
(iii) The consumer has not provided a new authorization to the
third party after the maximum duration period, as described in Sec.
1033.421(b)(2).
(d) Jointly held accounts. A data provider that receives a request
for covered data from a consumer that jointly holds an account or from
an authorized third party acting on behalf of such a consumer must make
available covered data to that consumer or authorized third party,
subject to the other requirements of this section.
(e) Mechanism to revoke third party authorization to access covered
data. A data provider does not violate the general obligation in Sec.
1033.201(a) by making available to the consumer a reasonable method to
revoke any third party's authorization to access all of the consumer's
covered data. To be reasonable, the revocation method must, at a
minimum, be unlikely to interfere with, prevent, or materially
discourage consumers' access to or use of the data, including access to
and use of the data by an authorized third party. Indicia that the data
provider's revocation method is reasonable include its conformance to a
qualified industry standard. A data provider that receives a revocation
request from consumers through a revocation method it makes available
must notify the authorized third party of the request.
Sec. 1033.341 Information about the data provider.
(a) Requirement to make information about the data provider readily
identifiable. A data provider must make the information described in
paragraphs (b) through (d) of this section:
(1) Readily identifiable to members of the public, meaning the
information must be at least as available as it would be on a public
website; and
(2) Available in both human-readable and machine-readable formats.
(b) Identifying information. A data provider must disclose in the
manner required by paragraph (a) of this section:
(1) Its legal name and, if applicable, any assumed name it is using
while doing business with the consumer;
(2) A link to its website;
(3) Its LEI that is issued by:
(i) A utility endorsed by the LEI Regulatory Oversight Committee,
or
(ii) A utility endorsed or otherwise governed by the Global LEI
Foundation (or any successor thereof) after the Global LEI Foundation
assumes operational governance of the global LEI system; and
(4) Contact information that enables a consumer or third party to
receive answers to questions about accessing covered data under this
part.
(c) Developer interface documentation. For its developer interface,
a data provider must disclose in the manner required by paragraph (a)
of this section documentation, including metadata describing all
covered data and their corresponding data fields, and other
documentation sufficient for a third party to access and use the
interface. The documentation must:
(1) Be maintained and updated as the developer interface is
updated;
(2) Include how third parties can get technical support and report
issues with the interface; and
(3) Be easy to understand and use, similar to data providers'
documentation for other commercially available products.
(d) Performance specification. On or before the tenth calendar day
of each calendar month, a data provider must disclose in the manner
required by paragraph (a) of this section the quantitative minimum
performance specification described in Sec. 1033.311(c)(1)(i) that the
data provider's developer interface achieved in the previous calendar
month. The data provider's disclosure must include at least a rolling
13 months of the required monthly figure, except that the disclosure
need not include the monthly figure for months prior to the compliance
date applicable to the data provider. The data provider must disclose
the metric as a percentage rounded to four decimal places, such as
``99.9999 percent.''
Sec. 1033.351 Policies and procedures.
(a) Reasonable written policies and procedures. A data provider
must establish and maintain written policies and procedures that are
reasonably designed to achieve the objectives set forth in subparts B
and C of this part, including paragraphs (b) through (d) of this
section. Policies and procedures must be appropriate to the size,
nature, and complexity of the data provider's activities. A data
provider must periodically review the policies and procedures required
by this section and update them as appropriate to ensure their
continued effectiveness.
(b) Policies and procedures for making covered data available. The
policies and procedures required by paragraph (a) of this section must
be reasonably designed to ensure that:
(1) Making available covered data. A data provider creates a record
of the data fields that are covered data in the data provider's control
or possession, what covered data are not made available through a
consumer or developer interface pursuant to an exception in Sec.
1033.221, and the reasons the exception applies. A data provider is
permitted to comply with this requirement by incorporating the data
fields defined by a qualified industry standard, provided doing so is
appropriate to the size, nature, and complexity of the data provider's
activities. Exclusive reliance on data fields defined by a qualified
industry standard would not be appropriate if such data fields failed
to identify all the covered data in the data provider's control or
possession.
(2) Denials of developer interface access. When a data provider
denies a third party access to a developer interface pursuant to Sec.
1033.321, the data provider:
(i) Creates a record explaining the basis for denial; and
(ii) Communicates to the third party, electronically or in writing,
the reason(s) for the denial, and that the communication occurs as
quickly as is practicable.
(3) Denials of information requests. When a data provider denies a
request for information pursuant to Sec. 1033.331, the data provider:
(i) Creates a record explaining the basis for the denial; and
(ii) Communicates to the consumer or third party, electronically or
in writing, the type(s) of information denied and the reason(s) for the
denial, and that the
[[Page 74873]]
communication occurs as quickly as is practicable.
(c)(1) Policies and procedures for ensuring accuracy. The policies
and procedures required by paragraph (a) of this section must be
reasonably designed to ensure that covered data are accurately made
available through the data provider's developer interface.
(2) Elements. In developing its policies and procedures regarding
accuracy, a data provider must consider, for example:
(i) Implementing the format requirements of Sec. 1033.311(b); and
(ii) Addressing information provided by a consumer or a third party
regarding inaccuracies in the covered data made available through its
developer interface.
(3) Indicia of compliance. Indicia that a data provider's policies
and procedures regarding accuracy are reasonable include whether the
policies and procedures conform to a qualified industry standard
regarding accuracy.
(d) Policies and procedures for record retention. The policies and
procedures required by paragraph (a) of this section must be reasonably
designed to ensure retention of records that are evidence of compliance
with subparts B and C of this part.
(1) Retention period. Records related to a data provider's response
to a consumer's or third party's request for information or a third
party's request to access a developer interface must be retained for at
least three years after a data provider has responded to the request.
All other records that are evidence of compliance with subparts B and C
of this part must be retained for a reasonable period of time.
(2) Certain records retained pursuant to policies and procedures.
Records retained pursuant to policies and procedures required under
paragraph (a) of this section must include, without limitation:
(i) Records of requests for a third party's access to an interface,
actions taken in response to such requests, and reasons for denying
access, if applicable;
(ii) Records of requests for information, actions taken in response
to such requests, and reasons for not making the information available,
if applicable;
(iii) Copies of a third party's authorization to access data on
behalf of a consumer; and
(iv) Records of actions taken by a consumer and a data provider to
revoke a third party's access pursuant to any revocation mechanism made
available by a data provider.
Subpart D--Authorized Third Parties
Sec. 1033.401 Third party authorization; general.
To become an authorized third party, the third party must seek
access to covered data from a data provider on behalf of a consumer to
provide a product or service the consumer requested and:
(a) Provide the consumer with an authorization disclosure as
described in Sec. 1033.411;
(b) Provide a statement to the consumer in the authorization
disclosure, as provided in Sec. 1033.411(b)(5), certifying that the
third party agrees to the obligations described in Sec. 1033.421; and
(c) Obtain the consumer's express informed consent to access
covered data on behalf of the consumer by obtaining an authorization
disclosure that is signed by the consumer electronically or in writing.
Sec. 1033.411 Authorization disclosure.
(a) General requirements. To comply with Sec. 1033.401(a), a third
party must provide the consumer with an authorization disclosure
electronically or in writing. The authorization disclosure must be
clear, conspicuous, and segregated from other material.
(b) Content. The authorization disclosure must include:
(1) The name of the third party that will be authorized to access
covered data pursuant to the third party authorization procedures in
Sec. 1033.401.
(2) The name of the data provider that controls or possesses the
covered data that the third party identified in paragraph (b)(1) of
this section seeks to access on the consumer's behalf.
(3) A brief description of the product or service that the consumer
has requested the third party identified in paragraph (b)(1) of this
section provide and a statement that the third party will collect, use,
and retain the consumer's data only for the purpose of providing that
product or service to the consumer.
(4) The categories of covered data that will be accessed.
(5) The certification statement described in Sec. 1033.401(b).
(6) A description of the revocation mechanism described in Sec.
1033.421(h)(1).
(c) Language access--(1) General language requirements. The
authorization disclosure must be in the same language as the
communication in which the third party conveys the authorization
disclosure to the consumer. Any translation of the authorization
disclosure must be complete and accurate.
(2) Additional languages. If the authorization disclosure is in a
language other than English, it must include a link to an English-
language translation, and it is permitted to include links to
translations in other languages. If the authorization disclosure is in
English, it is permitted to include links to translations in other
languages.
Sec. 1033.421 Third party obligations.
(a) General limitation on collection, use, and retention of
consumer data--(1) In general. The third party will limit its
collection, use, and retention of covered data to what is reasonably
necessary to provide the consumer's requested product or service.
(2) Specific activities. For purposes of paragraph (a)(1) of this
section, the following activities are not part of, or reasonably
necessary to provide, any other product or service:
(i) Targeted advertising;
(ii) Cross-selling of other products or services; or
(iii) The sale of covered data.
(b) Collection of covered data--(1) In general. Collection of
covered data for purposes of paragraph (a) of this section includes the
scope of covered data collected and the duration and frequency of
collection of covered data.
(2) Maximum duration. In addition to the limitation described in
paragraph (a) of this section, the third party will limit the duration
of collection of covered data to a maximum period of one year after the
consumer's most recent authorization.
(3) Reauthorization after maximum duration. To collect covered data
beyond the one-year maximum period described in paragraph (b)(2) of
this section, the third party will obtain a new authorization from the
consumer pursuant to Sec. 1033.401 no later than the anniversary of
the most recent authorization from the consumer. The third party is
permitted to ask the consumer for a new authorization pursuant to Sec.
1033.401 in a reasonable manner. Indicia that a new authorization
request is reasonable include its conformance to a qualified industry
standard.
(4) Effect of maximum duration. If a consumer does not provide the
third party with a new authorization as described in paragraph (b)(3)
of this section, the third party will:
(i) No longer collect covered data pursuant to the most recent
authorization; and
(ii) No longer use or retain covered data that was previously
collected pursuant to the most recent authorization unless use or
retention of that covered data remains reasonably
[[Page 74874]]
necessary to provide the consumer's requested product or service under
paragraph (a) of this section.
(c) Use of covered data. Use of covered data for purposes of
paragraph (a) of this section includes both the third party's own use
of covered data and provision of covered data by that third party to
other third parties. Examples of uses of covered data that are
permitted under paragraph (a) of this section include:
(1) Uses that are specifically required under other provisions of
law, including to comply with a properly authorized subpoena or summons
or to respond to a judicial process or government regulatory authority;
(2) Uses that are reasonably necessary to protect against or
prevent actual or potential fraud, unauthorized transactions, claims,
or other liability; and
(3) Servicing or processing the product or service the consumer
requested.
(d) Accuracy. The third party will establish and maintain written
policies and procedures that are reasonably designed to ensure that
covered data are accurately received from a data provider and
accurately provided to another third party, if applicable.
(1) Flexibility. A third party has flexibility to determine its
policies and procedures in light of the size, nature, and complexity of
its activities.
(2) Periodic review. A third party will periodically review its
policies and procedures and update them as appropriate to ensure their
continued effectiveness.
(3) Elements. In developing its policies and procedures regarding
accuracy, a third party must consider, for example:
(i) Accepting covered data in a format required by Sec.
1033.311(b); and
(ii) Addressing information provided by a consumer, data provider,
or another third party regarding inaccuracies in the covered data.
(4) Indicia of compliance. Indicia that a third party's policies
and procedures are reasonable include whether the policies and
procedures conform to a qualified industry standard regarding accuracy.
(e) Data security. (1) A third party will apply to its systems for
the collection, use, and retention of covered data an information
security program that satisfies the applicable rules issued pursuant to
section 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801); or
(2) If the third party is not subject to section 501 of the Gramm-
Leach-Bliley Act, the third party will apply to its systems for the
collection, use, and retention of covered data the information security
program required by the Federal Trade Commission's Standards for
Safeguarding Customer Information, 16 CFR part 314.
(f) Provision of covered data to other third parties. Before
providing covered data to another third party, subject to the
limitation described in paragraphs (a) and (c) of this section, the
third party will require the other third party by contract to comply
with the third party obligations in paragraphs (a) through (g) of this
section and the condition in paragraph (h)(3) of this section upon
receipt of the notice described in paragraph (h)(2) of this section.
(g) Ensuring consumers are informed. (1) The third party will
provide the consumer with a copy of the authorization disclosure that
is signed or otherwise agreed to by the consumer and reflects the date
of the consumer's signature or other written or electronic consent.
Upon obtaining authorization to access covered data on the consumer's
behalf, the third party will deliver a copy to the consumer or make it
available in a location that is readily accessible to the consumer,
such as the third party's interface. If the third party makes the
authorization disclosure available in such a location, the third party
will ensure it is accessible to the consumer until the third party's
access to the consumer's covered data terminates.
(2) The third party will provide contact information that enables a
consumer to receive answers to questions about the third party's access
to the consumer's covered data. The contact information must be readily
identifiable to the consumer.
(3) The third party will establish and maintain reasonable written
policies and procedures designed to ensure that the third party
provides to the consumer, upon request, the information listed in this
paragraph (g)(3) about the third party's access to the consumer's
covered data. The third party has flexibility to determine its policies
and procedures in light of the size, nature, and complexity of its
activities, and the third party will periodically review its policies
and procedures and update them as appropriate to ensure their continued
effectiveness.
(i) Categories of covered data collected;
(ii) Reasons for collecting the covered data;
(iii) Names of parties with which the covered data was shared;
(iv) Reasons for sharing the covered data;
(v) Status of the third party's authorization; and
(vi) How the consumer can revoke the third party's authorization to
access the consumer's covered data and verification the third party has
adhered to requests for revocation.
(h) Revocation of third party authorization--(1) Provision of
revocation mechanism. The third party will provide the consumer with a
mechanism to revoke the third party's authorization to access the
consumer's covered data that is as easy to access and operate as the
initial authorization. The third party will also ensure the consumer is
not subject to costs or penalties for revoking the third party's
authorization.
(2) Notice of revocation. The third party will notify the data
provider, any data aggregator, and other third parties to whom it has
provided the consumer's covered data when the third party receives a
revocation request from the consumer.
(3) Effect of revocation. Upon receipt of a consumer's revocation
request as described in paragraph (h)(1) of this section or notice of a
revocation request from a data provider as described in Sec.
1033.331(e), a third party will:
(i) No longer collect covered data pursuant to the most recent
authorization; and
(ii) No longer use or retain covered data that was previously
collected pursuant to the most recent authorization unless use or
retention of that covered data remains reasonably necessary to provide
the consumer's requested product or service under paragraph (a) of this
section.
Sec. 1033.431 Use of data aggregator.
(a) Responsibility for authorization procedures when the third
party will use a data aggregator. A data aggregator is permitted to
perform the authorization procedures described in Sec. 1033.401 on
behalf of the third party seeking authorization under Sec. 1033.401 to
access covered data. However, the third party seeking authorization
remains responsible for compliance with the authorization procedures
described in Sec. 1033.401, and the data aggregator must comply with
paragraph (c) of this section.
(b) Disclosure of the name of the data aggregator. The
authorization disclosure must include the name of any data aggregator
that will assist the third party seeking authorization under Sec.
1033.401 with accessing covered data and a brief description of the
services the data aggregator will provide.
(c) Data aggregator certification. When the third party seeking
[[Page 74875]]
authorization under Sec. 1033.401 will use a data aggregator to assist
with accessing covered data on behalf of a consumer, the data
aggregator must certify to the consumer that it agrees to the
conditions on accessing the consumer's data in Sec. 1033.421(a)
through (f) and the condition in Sec. 1033.421(h)(3) upon receipt of
the notice described in Sec. 1033.421(h)(2) before accessing the
consumer's data. Any data aggregator that is retained by the authorized
third party after the consumer has completed the authorization
procedures must also satisfy this requirement. For this requirement to
be satisfied:
(1) The third party seeking authorization under Sec. 1033.401 must
include the data aggregator's certification in the authorization
disclosure described in Sec. 1033.411; or
(2) The data aggregator must provide its certification to the
consumer in a separate communication.
Sec. 1033.441 Policies and procedures for third party record
retention.
(a) General requirement. A third party that is a covered person or
service provider, as defined in 12 U.S.C. 5481(6) and (26), must
establish and maintain written policies and procedures that are
reasonably designed to ensure retention of records that are evidence of
compliance with the requirements of subpart D.
(b) Retention period. Records required under paragraph (a) of this
section must be retained for a reasonable period of time, not less than
three years after a third party obtains the consumer's most recent
authorization under Sec. 1033.401(a).
(c) Flexibility. A third party covered under paragraph (a) of this
section has flexibility to determine its policies and procedures in
light of the size, nature, and complexity of its activities.
(d) Periodic review. A third party covered under paragraph (a) of
this section must periodically review its policies and procedures and
update them as appropriate to ensure their continued effectiveness to
evidence compliance with the requirements of subpart D.
(e) Certain records retained pursuant to policies and procedures.
Records retained pursuant to policies and procedures required under
this section must include, without limitation:
(1) A copy of the authorization disclosure that is signed or
otherwise agreed to by the consumer and reflects the date of the
consumer's signature or other written or electronic consent and a
record of actions taken by the consumer, including actions taken
through a data provider, to revoke the third party's authorization; and
(2) With respect to a data aggregator covered under paragraph (a)
of this section, a copy of any data aggregator certification statement
provided to the consumer separate from the authorization disclosure
pursuant to Sec. 1033.431(c)(2).
Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2023-23576 Filed 10-30-23; 8:45 am]
BILLING CODE 4810-AM-P