ABA Calls on CFPB to Suspend Data Sharing Rule Compliance Dates and Undertake Major Revisions

The American Bankers Association today submitted a detailed comment letter in response to the Consumer Financial Protection Bureau’s Advance Notice of Proposed Rulemaking regarding the reconsideration of the Personal Financial Data Rights rule under Section 1033 of the Dodd-Frank Act. 

In the letter, ABA commends the CFPB’s leadership for recognizing the need to revise the November 2024 PFDR rule, which ABA describes as “overbroad and built on a dubious legal foundation.” ABA also urges the Bureau to take immediate formal action to suspend all compliance dates, noting that it is unreasonable for institutions to invest time and resources to comply with a rule that is actively undergoing substantial revision.

The letter featured new national survey data, which found that most adults believe that data shouldn’t be shared if it could put consumers at risk (80%), that all organizations holding consumer data should follow the same sharing rules (76%), and that data aggregators that are monetizing the data obtained from banks should share in the operating costs (70%). The survey, conducted by Morning Consult on behalf of ABA, also found that eight-in-10 consumers (80%) said companies shouldn’t use data they obtain from banks to train AI models or develop new products and services without explicit consumer consent. 

The letter offers recommendations to the CFPB to make the revised rule more effective than the November 2024 version, which would benefit consumers, data-sharing stakeholders and regulatory agencies. ABA’s recommendations for the re-proposed rule include:

• Limiting CFPB’s scope to its statutory authority and allowing market forces to address broader data-sharing issues.

• Coordinating with federal banking agencies and the FTC to ensure proper data safeguarding.

• Preserving data providers’ ability to conduct risk management, including due diligence on data aggregators and recipients.

• Subjecting data aggregators and large fintechs to ongoing supervision to provide oversight on consumer privacy and data security requirements.

• Applying consumer access rights to data held by all covered entities, including banks, credit unions, fintechs and data aggregators, while requiring explicit consumer consent for data sharing and prohibiting re-sharing without direct authorization from the original data provider to maintain security and liability alignment.

• Distributing data-sharing obligations based on function rather than form, clarify terminology, and impose consistent requirements across all entities to ensure secure, limited and accountable use of consumer data.

• Allowing data providers to charge fees for data access, consistent with the statute’s silence on fee restrictions.

• Banning screen scraping, designating it as an Unfair, Deceptive, or Abusive Act or Practice (UDAAP), and allowing data providers to block such activity. In order to fully eradicate screen scraping, the CFPB must remove the exemption for small institutions, which if left in place would perpetuate unnecessary consumer risk and harm their competitiveness in an increasingly digital world.

• Establishing a clear liability framework for data breaches and unauthorized activities.

• Retaining prohibitions on secondary data uses, with clear examples of permissible and impermissible practices.

• Requiring express, informed consumer consent, supported by a model form to ensure clarity and compliance.

• Limiting industry standard-setting to data formats and strengthening the deference given for use thereof.

• Setting new compliance dates at least two years after issuance of consensus standards for data formats.

Read the full comment letter.