WASHINGTON–The Consumer Financial Protection Bureau (CFPB) has proposed a rule it is saying will “accelerate a shift toward open banking,” where consumers would have control over data about their financial lives and would gain new protections against companies misusing their data.
In response, CUNA is saying it has "concerns" over the "access interfaces" the proposal would require credit unions to create.
The proposed Personal Financial Data Rights rule activates a dormant provision of law enacted by Congress more than a decade ago, according to the Bureau, and “would jumpstart competition by forbidding financial institutions from hoarding a person’s data and by requiring companies to share data at the person’s direction with other companies offering better products.”
In addition, the CFPB said the proposed rule would allow people to “break up with banks” that provide bad service and would forbid companies that receive data from misusing or wrongfully monetizing the sensitive personal financial data.
‘Inconsistent’ Data Access
In announcing its proposal, the CFPB said that currently “people’s access to their financial data is inconsistent from one financial institution to another. Even among companies that do share data at a customer’s request, the terms of the sharing vary greatly.
“This lack of norms in the market allows incumbents to play games to their own customers’ detriment – including hiding or obscuring important data points like prices,” the CFPB continued. “This undercuts the ability of small or upstart institutions to compete with incumbents, even when people want their data shared.”
‘Power to Share Data’
Under the proposed Personal Financial Data Rights rule, the CFPB said people would have the power to share data about their use of checking and prepaid accounts, credit cards, and digital wallets.
“This would allow them to access competing products and services without worrying that their data might be collected, used, or retained to serve commercial interests over their own,” according to the CFPB. “Importantly, people could be certain that their data would be used only for their own preferred purpose—and not for financial institutions or tech companies to surveil and manipulate.”
What Consumers Would Get
The CFPB said the proposed Personal Financial Data Rights rule would ensure that consumers:
- Get their data free of junk fees. “Banks and other providers subject to the rule would have to make personal financial data available, at no charge to consumers or their agents, through dedicated digital interfaces that are safe, secure, and reliable.”
- Have a legal right to share their data. “People would have a legal right to grant third parties access to information associated with their credit card, checking, prepaid, and digital wallet accounts,” the CFPB said. “This type of data can help firms provide a wide range of products and services, including cash flow-based underwriting that stands to improve pricing and access across credit markets. When these firms offer a desired product or service, people would be able to switch providers more easily. They would also be able to more conveniently manage accounts from multiple providers.”
- Can walk away from bad service. “Not only would the proposed rule increase competitive forces among financial institutions, it would also enable people to walk away from bad services and products,” according to the Bureau. “People can become trapped by providers that hold their data, but this proposal would allow them to more easily shift their data to a competitor offering better or lower priced products and services.”
Additional Protections
According to the CFBP, the proposed Personal Financial Data Rights rule would also protect the interests of both consumers and financial firms through:
- Robust protections to prevent unchecked surveillance and misuse of data. “Companies that people authorize to access data on their behalf would have to agree to certain important conditions. Third parties could not collect, use, or retain data to advance their own commercial interests through actions like targeted or behavioral advertising. Instead, third parties would be obligated to limit themselves to what is reasonably necessary to provide the individual’s requested product.”
- Meaningful consumer control. “The proposal would also give people the right to revoke access to their data. When a person revokes access, the proposal would require that data access end immediately, and deletion would be the default practice. Access can be maintained for no more than one year, absent the individual consumer’s reauthorization.”
- A move away from risky data collection practices. “Many companies currently access consumer data through screen scraping, which often requires people to share their usernames and passwords with third parties,” the CFPB said. “This proposal seeks to move the market away from these risky data collection practices.”
- Fair industry standard-setting. “Instead of providing detailed technical standards, the rule contains several requirements to ensure industry standards are fair, open, and inclusive. The CFPB intends to assess future standards developed by the private sector under the terms described in the rule.”
Implementation in Phases
The CFPB said that under the proposal, the requirements would be implemented in phases, with larger providers being subject to them much sooner than smaller ones. In addition, the many community banks and credit unions that have no digital interface at all with their customers would be exempt from the rule’s requirements.
The proposed rule is the first proposal to implement Section 1033 of the Consumer Financial Protection Act, which charged the CFPB with implementing personal financial data sharing standards and protections.
The CFPB said it intends to cover additional products and services in future rulemaking.
The full proposal can be read here.
CUNA: Concerns Over "Access Interfaces"
In response to the proposal, CUNA President and CEO Jim Nussle issued a statement saying, “CUNA supports credit union members’ and consumers’ ability to access and share their personal financial data while ensuring that the information remains safe, secure, accurate, and private. We are concerned with this proposal, particularly that it would require credit unions to create, maintain, and service interfaces for third parties to access member data, but prohibit charging a fee for services provided. At a time when credit unions are being hit with increasing costs just to serve their communities, we’re very disappointed with requiring credit unions to divert time and resources away from member services to subsidize and provide free services to third parties’ competing businesses.”
CUNA said the proposal fails to impose proper safeguards to protect consumers from bad actors by only requiring the baseline level of identity information without any oversight or supervision for compliance with the rule of these third-party actors. Furthermore, the Bureau requires financial institutions to shoulder the burden of verifying and authenticating not only the legitimacy of these third parties, but the authorization requests from the consumer without any clear allocation of liability to fraudulent actors, CUNA stated.
CUNA said it will be engaging with the Bureau over the coming months to ensure the interests of credit unions are appropriately represented in the final rule.
CUNA noted it submitted comments on the Outline of Proposals and Alternatives to the CFPB’s Small Business Advisory Review Panel in January, including a number of recommendations encouraging innovation to improve consumer experience.
Just Because It’s Autumn Doesn’t Mean Falling for Schemes to Overcharge You for CU Industry News. Instead, Try This Crisp Offer
The biggest, best and freshest news reporting in credit unions remains free! Each morning CUToday.info delivers its daily Fresh Today news update offering the latest headlines and breaking news right to your email, with the easy-to-read headlines format allowing you to click on the stories that interest you most in order to learn more. So stop paying those bank-fee-like subscription prices from other so-called “news”” publications!
If you haven’t yet signed up for the new email solution on which CUToday.info has partnered with ResponseGenius, you can do so here. Signing up requires less than one minute of your time—and it’s free!
Please note that after signing up you may need to go to your Spam/Junk folder and mark the morning headlines email as safe. CUToday.info does not provide its list of readers and emails to outside parties, and we will not be contacting you to sell you an extended warranty or sending you any links so you may cash in on an inheritance you didn’t know was coming.
And did we mention it’s free?