Data brokers could face stiffer regulations with proposed CFPB rule

Your name, credit score, income and other personal information is being collected, traded, and sold. 

Data brokers get your information from a variety of ways like when you register for a new app, sign up for a financial service, or post on social media. 

This data is paired with publicly available information to create a data profile. Our data profiles are called “consumer reports” and are sold to data brokers for big bucks. 

It’s a billion-dollar industry, but experts say it’s an industry operating with little regulation. 

“It's the Wild West,” said Truman Kain with the cyber-security company Huntress. 

Kain says this sensitive information about your finances, income, and health is used by creditors, insurers, landlords, and employers to make decisions about you. 

“One of the biggest issues is there's currently no oversight on how this data is used, how it's collected, what the data actually is, who it's being sold to, for what purpose,“ Kain said. 

A new proposed rule by the Consumer Financial Protection Bureau aims to rein in how your information is used. 

“The proposed rule kind of sets out a path to where you have visibility into the data that's being collected to you. Right now, it's a complete black box. You don't really know what data is out there,” Kain said. 

The proposed rule would require brokers to comply with some of the same regulations credit bureaus must follow. For example, data brokers selling information like your social security number, credit history, credit score, debt history, or income could only sell it if the buyer has what they call a permissible purpose. 

This would include things like evaluating your eligibility for credit, insurance, or employment. 

The new rule would also give you a chance to give clear consent on how your consumer report is used and give you the right to revoke consent. 

“At first glance, that might seem like, why is that important to make sure that this data being sold about me is accurate?

But because this information is used, for example, in a similar way to a credit report, you want to make sure that information is accurate about you so that you're not declined or denied,” Kain said. “And also, to make sure that you have visibility into the information about you that's out there to remain vigilant against things like identity theft.”

Kain points out this rule is a good first step in providing consumer protections but says more regulation is needed. 

“You know, what you would like to see is that you can opt out to having your data sold altogether. And that's going to take a while, but I think without this first step, we're not going to get there,” Kain said. “So, we're getting closer. This doesn't offer opt out rights, but it does kind of pave the way to greater transparency.” 

This proposed rule is currently in the comment period until March 3 of next year. 

After the comment period, the agency will decide whether to proceed with the rulemaking process.