Joint Trades Letter to the CFPB regarding the Collection, Use, and Monetization of Consumer Payment and Other Personal Financial Data

Dear Acting Director Vought,

The American Bankers Association, America's Credit Unions, the Bank Policy Institute, and the Consumer Bankers Association (Joint Trades) appreciate the opportunity to respond to the Request for Information Regarding the Collection, Use, and Monetization of Consumer Payment and Other Personal Financial Data (Privacy RFI) issued by the Consumer Financial Protection Bureau (CFPB). The Privacy RFI seeks to better understand how companies that offer or provide consumer financial products or services collect, use, share, and protect consumers' personal financial data, such as data obtained as part of payment transactions. Members of the Joint Trades, which consist of traditional depository financial institutions (i.e., banks and credit unions), are committed to safeguarding the personal information of consumers and customers.

As an initial matter, we note that the Privacy RFI was issued and published in the Federal Register for comment under the CFPB's prior leadership during the period between the election on November 5, 2024, and Inauguration Day on January 20, 2025. As this RFI was issued under the previous Director's leadership and necessarily reflects the prior Administration's policy priorities, we respectfully state that the RFI should have been rescinded. Nonetheless, we are submitting a response to ensure that the current Administration is fully apprised of several relevant policy considerations.

The RFI indicates the CFPB is considering whether any regulatory actions "are warranted to protect consumer privacy," including changes to Regulation P or its model privacy form. In our experience, the privacy protections afforded by the Gramm-Leach-Bliley Act (GLBA) and its implementing Regulation P are fundamentally strong for highly regulated financial institutions. Should the Administration determine to move forward with any actions as contemplated under this RFI, we accordingly recommend that the CFPB focus its regulatory and examination resources in two main areas: (1) leveling the playing field between depository institutions and less regulated technology services providers; and (2) updating the model form to provide even more clarity to customers and financial institutions.

The RFI asks how the CFPB can strengthen data protections for consumers, including by ensuring "that all companies are 'playing by the same rules' with respect to consumer data when engaging in the same markets." GLBA via Regulation P creates a framework that provides consumers with transparency of how their information is shared with nonaffiliated third parties, while carefully ensuring that financial institutions can share data as needed for activities integral to the business of banking such as processing transactions, combating fraud, and adhering to legal requirements. Moreover, it affords an opportunity to opt out of other forms of sharing before such sharing can occur. Importantly, entities that receive data subject to the GLBA are bound to requirements and restrictions on data usage and downstream disclosure that are regulatorily prescribed—not dependent on contractual obligations.

Download the joint comment letter to read the full text