Global: Industry Groups Call for Enhanced Data Protection Measures in CFPB’s Open Banking Rules

Two industry groups, The Clearing House Association and Bank Policy Institute, have expressed concerns that the Consumer Financial Protection Bureau’s (CFPB) proposed open banking rules lack sufficient safeguards for consumer data protection.

In October, the CFPB introduced its long-awaited open banking rule with the goal of enhancing competition in the US banking and payments sector. The rule requires consumer financial service providers to share data, based on user direction, with other entities in the ecosystem providing more appealing products and services.

However, The Clearing House Association and Bank Policy Institute argue that the proposed rules fall short in safeguarding sensitive consumer financial data and ensuring that data recipients adhere to the regulations.

The industry groups advocate for extending many of the protective requirements outlined in the proposed rule—such as those related to consumer authorization and permissible uses of consumer data—to all third parties and aggregators in the ecosystem, covering all types of data.

They specifically call for a prohibition on screen scraping once a data provider has established a developer interface. The groups emphasize the importance of maintaining the security of consumers’ personal and financial information during sharing between financial institutions and third parties, as well as when stored externally.

Furthermore, they recommend that the CFPB directly impose requirements on third parties and data aggregators, clearly express its intent to supervise these entities for compliance and define liability for unauthorized transactions or failure to protect consumer data.

The industry groups also propose that data providers be allowed to receive compensation from third parties to recover their “commercially reasonable costs and a margin to cover the cost of enabling data sharing.”

In response to the proposed rule, the American Fintech Council has raised separate concerns, particularly regarding limitations imposed on data providers and third parties regarding the acceptable use of consumer data.

While the CFPB aims to finalize open banking rules by 2024, earlier this year, it cautioned against large firms attempting to control their open banking standards.