Comments of EPIC, NCL, and CFA on the Protecting Americans from Harmful Data Broker Practices Notice of Proposed Rulemaking

The Electronic Privacy Information Center (EPIC), National Consumers League, Consumer Federation of America, and the undersigned organizations submit these comments in response to the Consumer Financial Protection Bureau (“CFPB” or “the Bureau”)’s proposed rules on Protecting Americans from Harmful Data Broker Practices, published on December 3, 2024.

EPIC is a public interest research center in Washington, D.C., established in 1994 to secure the fundamental right to privacy in the digital age for all people through advocacy, research, and litigation.[1] EPIC has long advocated for privacy rights and robust safeguards to protect consumers. As EPIC has previously detailed, data brokers frequently engage in exploitative data collection, retention, and sharing practices and enable other harmful uses of personal data.[2] EPIC has called on regulators to rein in the abusive practices of brokers, including through the use of data minimization rules under which personal data can only be collected, used, or disclosed as necessary to fulfill purposes consistent with reasonable expectations of consumers.[3] EPIC has also fought for greater transparency and oversight of how companies collect, use, and disseminate personal data[4] and stricter enforcement to safeguard the rights of consumers.[5]

EPIC supports the CFPB’s efforts to regulate the collection and dissemination of personal information through its Fair Credit Reporting Act (FCRA) rulemaking. EPIC has previously engaged with the Bureau’s work on this issue through our January 2023 comments on the CFPB’s Rulemaking on Personal Financial Data Rights,[6] our February 2023 coalition letter regarding credit header data,[7] our July 2023 comments in response to the Bureau’s Request for Information regarding data brokers,[8] our October 2023 comments in response to the Bureau’s Small Business Advisory Review Panel for Consumer Reporting Rulemaking Outline of Proposals,[9] and our August 2024 Comments on the CFPB’s proposed rules on the Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information.[10]  We commend the Bureau for proposing rules which will strengthen protections for consumers.

The National Consumers League (NCL) is a nonprofit, nonpartisan consumer advocacy organization representing consumers and workers on marketplace and workplace issues since its founding in 1899. Headquartered in the District of Columbia, NCL provides government, businesses, and other organizations with the consumer’s perspective on concerns including fraud, privacy, child labor, food safety, healthcare, and telecommunications. Since 1992, NCL has accepted thousands of consumer complaints each year through its anti-scam project, Fraud.org.

The Consumer Federation of America (CFA) is an association of over 250 non-profit consumer organizations that was established in 1968 to advance the consumer interest through research, advocacy, and education.

With this comment, we recommend refinements to the CFPB’s proposals and identify additional provisions the Bureau should include in its final rule.

[1] About Us, EPIC, https://epic.org/about/ (2023).

[2] EPIC, Comments on CFPB Request for Information Regarding Data Brokers and Other Business Practices Involving the Collection and Sale of Consumer Information, 88 Fed. Reg. 16,951 (Jul. 14, 2023) [hereinafter “July Data Broker Comments”]; EPIC, Comments on CFPB Small Business Advisory Review Panel for Consumer Reporting Rulemaking Outline of Proposals (Oct. 30, 2023) [hereinafter “October SBREFA Comments”].

[3] See, e.g., Consumer Reps. & EPIC, How the FTC Can Mandate Data Minimization Through a Section 5 Unfairness Rulemaking (2022), https://epic.org/wp-content/uploads/2022/01/CR_Epic_FTCDataMinimization_012522_VF_.pdf.  

[4] See, e.g., Big Data: Privacy Risks and Needed Reforms in the Public and Private Sectors: Hearing Before the H. Comm. on House Admin., 117th Cong. 53 (2022), https://epic.org/documents/hearing-on-big-data-privacy-risks-and-needed-reforms-in-the-public-and-private-sectors/ (statement of Caitriona Fitzgerald, Deputy Director, EPIC); EPIC, Comments on CFPB Inquiry into Big Tech Payment Platforms, 86 Fed. Reg. 61,182 (Dec. 21, 2021), https://epic.org/documents/epic-comments-on-cfpb-inquiry-into-big-tech-payment-platforms/.

[5] See, e.g., EPIC, Comments on CFPB Request for Information on the Equal Credit Opportunity Act and Regulation B, 85 Fed. Reg. 46600 (Oct. 2, 2020), https://epic.org/wp-content/uploads/apa/comments/EPIC-CFPB-Oct2020-AI-ML.pdf.   

[6] EPIC, Comments to CFPB on the Consumer Financial Data Rights Rulemaking (Jan. 25, 2023) [hereinafter “January Financial Data Rights Comments”].

[7] Coalition Letter to CFPB Requesting Broad Consumer Financial Market Correction, Beginning with an Advisory Opinion Regarding Credit Header Data (Feb. 8, 2023), https://epic.org/wp-content/uploads/2023/02/2023-02-08-Coalition-Letter-to-CFPB.pdf [hereinafter “Credit Header Letter”].

[8] July Data Broker Comments.

[9] October SBREFA Comments.

[10] EPIC, Comments to CFPB on the Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information, CFPB-2024-0023 (Aug. 13 2024), https://epic.org/documents/comments-of-epic-to-the-cfpb-on-the-prohibition-on-creditors-and-consumer-reporting-agencies-concerning-medical-information/.