The Consumer Financial Protection Bureau Calls for Closing Privacy Gaps in Financial Data

The Consumer Financial Protection Bureau Calls for Closing Privacy Gaps in Financial Data

The Consumer Financial Protection Bureau (CFPB) released a report on November 12, 2024, analyzing carve-outs and limitations in state privacy laws affecting financial institutions, according to an article by the Ballard Spahr firm. The CFPB expressed concern that privacy protections for financial information lag behind those in other sectors.

Currently, 18 states (19 including Florida’s thresholds) have passed comprehensive privacy laws. All contain exemptions for financial institutions, either at the entity level (excluding Gramm-Leach-Bliley Act (GLBA)-regulated entities entirely) or data level (exempting non-public personal information regulated under the GLBA). Additionally, these laws often exempt information governed by the Fair Credit Reporting Act (FCRA), leaving much financial data outside state privacy law protections.

The CFPB highlighted that federal laws like the GLBA do not provide consumer rights found in state privacy laws, such as rights to access, correct, or delete personal data. The report urges state policymakers to assess these gaps and consider extending protections to financial information.

This recommendation coincides with ongoing CFPB initiatives, such as the Open Banking Rule, which aims to enhance consumer privacy rights but faces potential challenges under a new administration. By encouraging states to close privacy gaps, the CFPB seeks to secure broader protections.

Notably, the Consumer Financial Protection Bureau challenges the assumption that the GLBA preempts state privacy laws from regulating financial data. If a state adopts this approach, it could significantly expand privacy law coverage, prompting operational changes in the financial sector. This shift would mark a transformative moment for privacy and risk management in financial institutions.