ABA Statement on Court Ruling to Halt Compliance and Enforcement of CFPB Data Sharing Rule

"The U.S. District Court’s decision to stay compliance with the Consumer Financial Protection Bureau’s Section 1033 rule affirms the serious concerns raised by ABA and other stakeholders regarding the rule’s legal foundation, scope and impact on consumer privacy and data security. The court’s decision provides a necessary pause for the Bureau to engage meaningfully with stakeholders and address the rule's significant flaws while ensuring banks don’t have to invest time and resources to comply with an overbroad and legally flawed rule that is actively undergoing substantial revision. In the meantime, consumers will continue to reap benefits achieved without regulation thanks to industry standard-setting, innovation and partnerships that prioritize security, transparency and consumer control.

“We look forward to working with the CFPB to develop a revised rule that protects consumers, promotes innovation and ensures a level playing field across the financial ecosystem.”

Additional Background

Last week, ABA sent a detailed comment letter to the CFPB offering the following recommendations to make the revised data sharing rule more effective than the November 2024 version, which would benefit consumers, data-sharing stakeholders and regulatory agencies:

Limiting CFPB’s scope to its statutory authority and allowing market forces to address broader data-sharing issues.
Coordinating with federal banking agencies and the FTC to ensure proper data safeguarding.
Preserving data providers’ ability to conduct risk management, including due diligence on data aggregators and recipients.
Subjecting data aggregators and large fintechs to ongoing supervision to provide oversight on consumer privacy and data security requirements.
Applying consumer access rights to data held by all covered entities, including banks, credit unions, fintechs and data aggregators, while requiring explicit consumer consent for data sharing and prohibiting re-sharing without direct authorization from the original data provider to maintain security and liability alignment.
Distributing data-sharing obligations based on function rather than form, clarify terminology, and impose consistent requirements across all entities to ensure secure, limited and accountable use of consumer data.
Allowing data providers to charge fees for data access, consistent with the statute’s silence on fee restrictions.
Banning screen scraping, designating it as an Unfair, Deceptive, or Abusive Act or Practice (UDAAP), and allowing data providers to block such activity. In order to fully eradicate screen scraping, the CFPB must remove the exemption for small institutions, which if left in place would perpetuate unnecessary consumer risk and harm their competitiveness in an increasingly digital world.
Establishing a clear liability framework for data breaches and unauthorized activities.
Retaining prohibitions on secondary data uses, with clear examples of permissible and impermissible practices.
Requiring express, informed consumer consent, supported by a model form to ensure clarity and compliance.
Limiting industry standard-setting to data formats and strengthening the deference given for use thereof.
Setting new compliance dates at least two years after issuance of consensus standards for data formats.

###

About the American Bankers Association

The American Bankers Association is the voice of the nation’s $25 trillion banking industry, which is composed of small, regional and large banks that together employ approximately 2.1 million people, safeguard $19.7 trillion in deposits and extend $13.1 trillion in loans.

In Depth

Press Contact

Sarah Grano

(202) 663-5470

Contact Sarah

Useful Links

ABA Statement on Court Ruling to Halt Compliance and Enforcement of CFPB Data Sharing Rule

In Depth

Resources for the Media

Media Contacts

ABA Expert Photos

ABA Media Appearances

Media Credentials

Join Our Media Lists

RSS Feed