RSSThe Consumer Financial Protection Bureau will propose rules this year to ensure data brokers follow the Fair Credit Reporting Act, Director Rohit Chopra said April 2.
The proposal would define a data broker selling certain types of consumer data as a consumer reporting agency. Selling data which includes consumer payment history, income or criminal records would be considered a consumer report and trigger requirements to ensure accuracy, handle disputes of inaccurate information and ban other misuse.
“There was a time where the dominant thinking was something like this: In order to protect national security, invasive and unlimited data collection should be the norm,” Chopra said. “In untangling the concerning reports and credible threats we find today, it may be just the opposite.”
Chopra said customer data sold to foreign adversaries poses counterintelligence, national security and blackmail risks. Chopra cited three alleged instances of identity theft and misuse of account information from China-based groups, including the 2015 intrusion into major health insurer Anthem; 2017 Equifax breach; and 2018 breach at Marriott. In 2020, the Justice Department charged four members of the Chinese Liberation Army with being behind the Equifax breach to receive personal data on 145 million Americans.
“When Americans’ health information, financial information and even their travel whereabouts can be assembled into detailed dossiers, it’s no surprise this raises risks when it comes to safety and security,” Chopra noted.
Data brokers can allegedly facilitate the targeting of private citizens by allowing groups to purchase lists that match certain categories and acquire records for only pennies per person, allowing relatively small investments to enable mass collection.
“Data brokers make this easy by assigning users to categories,” Chopra said. “Reporting and reviews of online markets suggest data brokers can help entities target ‘decision-makers at government organizations primarily engaged in national security and international affairs’ and ‘military service-members and government employees.’ Data brokers also support targeting of specific geographic locations like government or military installations.”
