Newsroom

NAFCU, along with several trades Monday, signed on to a petition asking the CFPB to initiate a rulemaking, under section 553(e) of the Administrative Procedure Act (APA), to define the “larger participants” in the market for data aggregations services that will be subject to CFPB supervision. 

Citing robust technological expansion which has led to an increase in demand for consumer financial data, the groups expressed support for allowing customers access to financial data that both “protects and empowers” them. Section 1033 of the Dodd-Frank Act requires the bureau to grant consumers the ability to obtain financial data access regarding any transaction. 

The groups urged the CFPB to “ensure that data aggregators and data users that are larger participants in the aggregation services market – not just banks and credit unions – are examined for compliance with applicable federal consumer financial law.”

“By the nature of their business, data aggregators hold a tremendous amount of consumer financial data,” wrote the trades.

“While consumers may consent to the sharing of their financial data, many of these same consumers are unaware of the activities in which these intermediaries engage, how the information is being collected, and how the data may be used or shared.”

Under Section 1033, the CFPB has avidly monitored the aggregation services market and has since identified the main participants as consumers, data holders, data users, and data aggregators. The bureau acknowledged that while the use of consumer financial data by these participants could lead to improved and innovative consumer financial products, there are still several data privacy and security concerns to consider.

However, the groups pointed out that while typical data holders, such as banks and credit unions, are regularly subject to CFPB supervision, “non-depository institutions such as data aggregators and data users are not,” which the trades say creates a “supervisory imbalance.”

In addition, NAFCU has advocated for the implementation of Section 1033, and previously sent a letter to the CFPB stating “the extent to which nonbank technology companies are gathering and exchanging potentially sensitive transaction information raises unique privacy concerns which the Bureau should address through direct supervision before proceeding with any effort to implement section 1033.”

Read the petition. NAFCU will continue to engage with the CFPB to ensure a fair supervisory and regulatory landscape for the data aggregations services market.