The power to walk away: CFPB moves to give consumers control over financial data

The Consumer Financial Protection Bureau on Thursday released a landmark proposal restricting how financial institutions handle consumer data.

The long-awaited move — which would make it easier for consumers to switch banks and require greater data security from fintechs — is part of a sweeping campaign by the Biden administration to shore up consumer protection. That includes cutting down on so-called junk fees that cost consumers billions of dollars a year and scrutinizing the way big technology firms handle consumer information.

It comes against the backdrop of a yearslong power struggle between traditional banks and fintech startups over the way consumer data is shared as more people use apps offering payment and budgeting services. The CFPB is trying to standardize the patchwork data-sharing system that has arisen in response.

“Today, we are proposing a rule to give consumers the power to walk away from bad service and choose the financial institutions that offer the best products and prices,” CFPB Director Rohit Chopra said.

The proposed rule — which faces months of feedback and lobbying from industry and consumer groups before it's approved — would bar financial firms from “hoarding” a consumer’s data, the agency said. It would require companies to share information, at a customer’s request, with other businesses offering competing products and prevent them from charging for it.

Banks would be required to make personal financial data available to consumers free of charge, and companies that access a person’s data would not be able to use it for targeted advertising. Access to a person’s data would have to be reauthorized annually, and consumers would have the right to revoke access at any time.

“It is often really daunting for a consumer to switch banks, in part because it's difficult to take their financial transaction history data to a new bank,” White House National Economic Council Director Lael Brainard said on a call with reporters. “Today's rule will help ensure financial companies compete based on service quality and pricing.”

The proposal, which implements Section 1033 of the 2010 Dodd-Frank law, also “seeks to move the market away from … risky data collection practices” such as screen scraping, the CFPB said.

“With the right consumer protections in place, a shift toward open and decentralized banking can supercharge competition, improve financial products and services, and discourage junk fees,” Chopra said.

The CFPB is clearly aiming to strike a delicate balance: The proposal would mandate that certain information be shared by banks and other firms where consumers have accounts. That would give data aggregators — financial firms that act as data-sharing middlemen between apps and banks — more leverage in negotiations with legacy financial institutions. But it would also put more restrictions on how data can be handled by those aggregators.

For example, it defines aggregators as under the scope of the Fair Credit Reporting Act in certain circumstances, which means they would have to meet certain standards in handling data.

It would also allow industry to continue to negotiate technical standards around data sharing. Financial firms have been negotiating standards for data fields at a forum known as Financial Data Exchange. The proposal says a standard-setting body must be “fair, open and inclusive,” and include a diverse set of actors.

Although industry groups were still processing the proposal, the agency’s effort to thread the needle and put banks and fintechs on more equal footing appeared to leave each side with something to like.

The Consumer Bankers Association applauded provisions of the proposed rule cracking down on fintechs.

“Many of these entities that are collecting, storing, and selling this consumer information are not subject to the same rigorous data security and privacy standards as well-regulated and supervised financial institutions,” CBA President Lindsey Johnson said.

Fintechs cheered the provisions making it easier for consumers to leave their bank and take their data elsewhere.

“Today’s rule is a win for consumers, who are one step closer to having a strong right to control their financial data,” said Penny Lee, president and CEO of the Financial Technology Association, a trade group representing fintechs.

“Looking ahead, we urge the CFPB to implement open banking in a way that prevents anti-competitive behavior from incumbent financial institutions, safeguards consumer data privacy, and fosters innovation in the marketplace," Lee said.

Comments on the proposal are due by Dec. 29.