The Consumer Financial Protection Bureau yesterday released a report examining the current state of privacy protections for consumers’ financial data, focusing on federal and state regulations. The findings reveal significant gaps in consumer privacy, especially for financial information.
Why it matters: The CFPB’s report draws attention to how existing federal privacy protections, primarily governed by the Gramm-Leach-Bliley Act (GLBA) and the Fair Credit Reporting Act (FCRA), have limitations in safeguarding consumer financial data. These laws, enacted decades ago, provide financial institutions with broad latitude in using consumer data for purposes beyond traditional banking activities. Financial institutions are increasingly monetizing this data by selling it to third parties, such as advertising firms.
- Moreover, while many states have enacted new data privacy laws in recent years, these often exempt financial institutions or data subject to the GLBA and FCRA, leaving consumers’ financial information vulnerable compared to other sectors. This inconsistency could mean that any organization — whether in collections, lending, or payments — may be collecting and using consumer financial data without the level of oversight and consumer rights seen in other industries.
State-level privacy protections fall short: Eighteen states have passed new consumer privacy laws since 2018, designed to give consumers greater control over their personal data, such as the right to access, correct, or delete information. However, the CFPB report highlights that all these state laws include exemptions for financial institutions or data covered by the GLBA and FCRA, meaning consumer protections vary significantly depending on the type of data and the institution collecting it.
- The CFPB emphasized that states have the authority to extend these protections further and provide greater coverage for financial data, but to date, most states have not done so. This creates a regulatory gap where financial information is often less protected than other forms of consumer data, such as health or retail information.
What they said: “Consumers should have meaningful choice and an expectation of privacy about how their financial data is used, but large companies are increasingly harvesting and monetizing this sensitive data in mysterious way,” said CFPB Director Rohit Chopra.
