EPIC, NCL, CFA, and Others Urge CFPB to Rein in Harmful Data Broker Practices 

In a comment filed with the Consumer Financial Protection Bureau (CFPB) today, EPIC, the National Consumers League (NCL), and Consumer Federation of America (CFA) urged the CFPB to finalize rules that would protect consumers from harm caused by data brokers. The filing details how data brokers impose severe harm by degrading privacy, threatening national security, enabling scams and fraud against consumers, putting public officials and survivors of domestic violence in danger, and exacerbating discrimination against immigrant populations. 

To address these and other harms flowing from the data broker industry, the comment urges the CFPB to finalize its proposed rules clarifying that many data brokers fulfill the definition of consumer reporting agencies under the Fair Credit Reporting Act (FCRA)—and that data brokers must therefore follow the FCRA’s rules. “The FCRA imposes important requirements on CRAs pertaining to data collection, sales, and retention for the purpose of creating and disclosing consumer reports,” the comment explains. “Extending FCRA coverage to data brokers would mitigate many of the downstream consumer privacy, safety, and economic harms that the data broker industry causes.”  

The comment also supports the CFPB’s proposed rules to clarify that certain personal data, often referred to as “credit header data,” constitutes a consumer report when collected for the purpose of preparing a consumer report. The groups also recommend that the CFPB clarify that using consumer reports for targeted marketing and advertising violates the FCRA and that the CFPB adopt a definition of “de-identified data” that best protects consumer privacy. 

Beyond expressing support for the CFPB’s proposed rules, the groups also recommend that the CFPB include additional provisions in the final rule, including data security protections, know-your-customer protocols, protections against the use of alternative data in credit scoring models, banning the use of credit reports in tenant screening determinations, and banning the use of pre-conviction criminal proceeding information in credit reports. 

The comment was joined by eight civil society organizations, including the Brennan Center for Justice, the Center on Race and Digital Justice, Check My Ads Institute, Fight for the Future, Just Futures Law, Mijente, National Consumer Law Center, and UltraViolet Action. 

EPIC has played a leading role in developing the authority of regulators to safeguard the rights of consumers and ensure the protection of personal data. EPIC has long fought for meaningful restrictions on the data broker industry and has supported the CFPB’s efforts to make good on the protections of the FCRA. EPIC shared expertise and feedback on earlier stages of the CFPB’s data brokers rulemaking; backed the CFPB’s proposed ban on listing medical debt on credit reports; joined a coalition of organizations calling on the CFPB to clarify that “credit header data” like phone numbers and social security numbers are not exempt from the FCRA; and defended the CFPB against baseless attacks.