As consumers, we leave trails of personal data all over the internet. And collecting and selling it is big business. Sensitive information, like our Social Security numbers, incomes and credit scores, are often sold by so-called data brokers to the highest bidder. Sometimes that’s a bank, sometimes it’s a scammer.
This month, the federal Consumer Financial Protection Bureau proposed a rule that would crack down on the practice. It would bar companies from selling sensitive data or hold them to the same legal standards that apply to credit reporting agencies. Rohit Chopra, director of the CFPB, explained the proposal in more detail to Marketplace’s Meghan McCarty Carino.
The following is an edited transcript of their conversation.
Rohit Chopra: About 60, 70 years ago, we actually had the same problem of private detectives and other investigators researching all of us and creating files for sale about us. And people were really nervous about what could happen if this data was misused or if it had inaccurate information. That’s why when it comes to your credit report you have the right to look at it, you have the right to dispute incorrect information, and the companies creating them must make sure that the information in them is accurate.
Meghan McCarty Carino: So data brokers would be restricted in buying and selling the most sensitive data, or they would basically be considered like a credit bureau?
Chopra: Yes, so what we’re trying to make sure is that information, like your income, your Social Security number, this is really only shared for legitimate purposes, like accessing a loan offer. It can’t be used simply to sell our data to scammers who might be targeting older adults and others in financial distress, and it certainly shouldn’t be used to sell to state actors who are looking to collect information about U.S. citizens for nefarious purposes.
McCarty Carino: So what are the implications of a data broker falling under the standards of a credit bureau?
Chopra: Well, they’ll just have to come clean and not sell data that is not allowed under the law. They’ll have to make sure that if they’re maintaining information about your debt payments or other financial information, that they’re ensuring that that’s accurate, that they’re allowing you to dispute improper information, and they’re getting some meaningful consent for sharing that information as well, rather than burying permissions in fine print. The key here is that we don’t want these data brokers evading long-standing law on the books by pretending they’re something different.
McCarty Carino: This proposed rule has met some resistance from some law enforcement groups. They’ve argued this could inhibit their ability to access certain information to solve criminal cases or in counterterrorism efforts. What’s your response to those concerns?
Chopra: Well, our proposed rule is very clear in that it would preserve existing pathways created by federal law to access this information for legitimate law enforcement, counterterrorism and counterintelligence. But we actually are hearing a lot from law enforcement about the need for this rule. In some circumstances, we’ve seen how judges and police officers are targeted by those who may be defendants in criminal proceedings, finding their information through data brokers and going to their homes. States like West Virginia and New Jersey have passed their own laws to make sure that data brokers are not being used as a tool to dox and harass law enforcement officials. We also know that state actors overseas are eager to find out who is working in intelligence agencies. We want to make sure that sensitive data about personnel protecting our national security are not being sold to the highest bidder overseas. We’ve also seen how members of the military, how their sensitive information is being trafficked by data brokers in ways that could cause our country some real harm. So we’ve really been focused on making sure that our work is advancing our national security and protecting people against crime.
McCarty Carino: You know, there are a number of state-level data privacy laws, including in California. How might this intersect with those?
Chopra: A lot of those laws are pretty interesting. Some of them exclude companies that are covered under the Fair Credit Reporting Act or other financial privacy laws. So one of the things that we’ve noticed is that some companies actually want to say that they are credit reporting companies or financial companies to be exempted from those state laws because they perceive that some of the financial privacy laws are weaker. And what we’re trying to do is also stop some of that arbitrage by making sure that there are some meaningful safeguards under federal law as well.
McCarty Carino: From the consumer side, what would this look like? Would consumers appreciate any change?
Chopra: Well, what’s really important is that consumers right now don’t even know all of the data and sensitive information being collected about them. We’re essentially living in a world of digital surveillance where companies can match our contact lists with our social media activity, with our location and our income, and even sometimes knowledge about our job and job performance. That data really is something that people don’t expect is being sold and auctioned off. I think even if people don’t know about this underworld of data brokers, they know that their data shouldn’t be weaponized against them. So I think that they may not even need to see much change in order to benefit from it. Now, of course, if they find out that data brokers are maintaining incorrect information about them, they’ll have some important legal rights under the law to challenge it.
McCarty Carino: This rule was proposed about a month and a half before the administration is going to change. The CFPB is taking comments until March. What does that change in administration mean for the potential future of this rule?
Chopra: Well, one of the things that has been really gratifying about the issue of data brokers and advancing data privacy, it really knows no political stripes. It’s really about people and consumers and our national security up against well-funded companies. And we’ve seen in state after state, regardless of what party controls it, real, meaningful efforts to rein in some of these corporate surveillance practices and to better protect consumer privacy. So it is one of the rare areas of agreement that we need much more action, and the CFPB’s data broker rule will be one key part of that.
