Data brokers could be banned from selling your personal data without a legal justification under a new proposal from the Consumer Financial Protection Bureau (CFPB). Over the summer, it was revealed that one of those brokers had been hacked, compromising the personal data of every person in the U.S., U.K., and Canada.
The proposed change would limit the sharing of sensitive data like your name and Social Security number by holding data brokers to the same rules as credit-checking agencies …
A law called the Fair Credit Reporting Act (FCRA) places significant limits on when credit reporting agencies can share your sensitive data. Data brokers — companies that make money by buying personal data and reselling it — are currently exempt from the law, and the CFPB wants to change that.
The Hill reports on the proposed change.
In a press conference to discuss the proposal, CFPB Director Rohit Chopra said the proposed rule “would make clear that many of these data brokers, like credit bureaus and background check companies, are subject to federal protections under the FCRA.”
“This means they will no longer be able to shirk their obligations and will have to adhere to the same consumer protections as the major credit bureaus, including accuracy requirements and giving consumers access to their own information.”
This will mean that any sensitive personal data sold by a broker will be treated as a sale of a consumer credit report and subject to the same restrictions. The key limitation is that the data can only be sold for legitimate purposes, such as to verify your eligibility for credit.
“This would mean that consumer reporting agencies could sell such information — so-called 'credit header' data — only if the user had a permissible purpose under the FCRA,” the CFPB said, describing specific purposes as “assessing a consumer's eligibility for credit, insurance,” and employment.
The CFPB says its proposal has broad support. One of the main concerns is that personal data can be bought by shell companies owned by criminals, who then use it to commit identity theft and other fraudulent activities.
While the new rule won't prevent data breaches like the one that happened over the summer, it will mean a significant reduction in the sale of personal data, and some brokers will likely be forced to go out of business.
Photo by Hack Capital on Unsplash
