Banks Must Share Data With Rivals Under CFPB Proposed Rules (1)

The top US consumer watchdog rolled out rules that would make it easier for Americans to access their personal information held by banks and use it to switch to a new provider, including upstart financial-technology firms.

The long-awaited “open banking” rules were formally proposed Thursday by the Consumer Financial Protection Bureau. The changes will encourage banks to provide better service, and make it simpler for customers to go elsewhere, CFPB Director Rohit Chopra said in a statement.

“Consumers would have control over data about their financial lives and would gain new protections against companies misusing their data,” the agency said in its statement. “It would jump-start competition by forbidding financial institutions from hoarding a person’s data and by requiring companies to share data at the person’s direction with other companies offering better products.”

Rohit Chopra

Photographer: Ron Sachs/CNP/Bloomberg

Consumer advocates and fintech firms have favored the changes. The regulation, which was required by the 2010 Dodd-Frank Act, has been criticized by the banking industry, which has expressed concern about privacy and liability if consumer data leaks to unauthorized users.

“Today’s rule is a win for consumers, who are one step closer to having a strong right to control their financial data,” Penny Lee, chief executive officer of the Financial Technology Association, an industry trade group, said in a statement. “The proposal builds on our industry’s progress and can provide assurances for continued consumer-friendly innovation.”

Data-Sharing Proposals

The Personal Financial Data Rights rule would cover a customer’s use of checking and prepaid accounts, credit cards and digital wallets, the agency said. Not covered by the rule are mortgages, car loans or student loans, though senior CFPB and Biden administration officials said those are markets that could be touched by future rules.

Banks would have to hand over the data at no charge. Access granted by consumers to other firms would expire after a year unless they renew their permission, and if they revoke it, the firms would have to delete the records.

Privacy safeguards would let financial companies and third parties use the data only for what’s “reasonably necessary” to provide the product that the consumer requested, the CFPB said. Other commercial purposes, such as selling consumer data without their knowledge or targeted or behavioral advertising, would be forbidden.

They also seek to curb “screen scraping,” in which consumers are required to share their user names and passwords with third parties. The alternative to screen scraping would be sharing the data via application programming interfaces, known as APIs — a more secure method.

“The CFPB must prioritize data security in its rulemaking process, put an end to unsafe practices like screen scraping and require fintechs to adhere to the same data privacy and security standards that already apply to banks,” said Paige Pidano Paridon, senior associate general counsel of the Bank Policy Institute, one of the lobbying and policy groups for the largest US banks.

Bigger banks will have to comply sooner than small ones, and banks and credit unions that don’t have online interfaces would be exempt, the agency said.

The agency will be soliciting comments on the proposal, with a deadline of Dec. 29. “We’ll look to finalize the rule by next fall,” Chopra said on a media call.

(Updates with trade group comments starting in the fifth paragraph and additional context throughout.)

--With assistance from Evan Weinberger.

To contact the reporters on this story:
Rick Green in New York at rgreen18@bloomberg.net;
Paige Smith in New York at psmith494@bloomberg.net

To contact the editors responsible for this story:
Rick Green at rgreen18@bloomberg.net

Stephanie Stoughton

© 2023 Bloomberg L.P. All rights reserved. Used with permission.