Comments of EPIC to the CFPB On the Small Business Advisory Review Panel for Consumer Reporting Rulemaking

Introduction

The Electronic Privacy Information Center (EPIC) submits these comments in response to the Consumer Financial Protection Bureau (CFPB or the Bureau)’s Small Business Advisory Review Panel for Consumer Reporting Rulemaking Outline of Proposals and Alternatives Under Consideration (Outline), published on September 15, 2023.

EPIC is a public interest research center in Washington, D.C., established in 1994 to secure the fundamental right to privacy in the digital age for all people through advocacy, research, and litigation. EPIC has long advocated for privacy rights and robust safeguards to protect consumers. As EPIC has detailed in previous comments, data brokers frequently engage in exploitative data collection, retention, and sharing practices and enable other harmful uses of personal data. EPIC has called on regulators to rein in the abusive practices of brokers, including through the use of data minimization rules under which personal data can only be collected, used, or disclosed as necessary to fulfill purposes consistent with reasonable expectations of consumers. EPIC has also fought for greater transparency and oversight into how companies collect, use, and disseminate personal data and stricter enforcement to safeguard the rights of consumers.

EPIC supports the CFPB’s efforts to regulate the collection and dissemination of personal information through rulemaking. EPIC has previously engaged with the Bureau’s work on this issue through our January 2023 comments on the CFPB’s Rulemaking on Personal Financial Data Rights, our February 2023 coalition letter regarding credit header data, and our July 2023 comments in response to the Bureau’s Request for Information regarding data brokers. We commend the Bureau for proposing rules which will strengthen protections for consumers. With this comment, we recommend refinements to the CFPB’s proposals and identify additional provisions the Bureau should include in its final rule.

EPIC’s Comments