Federal Authority on Consumer Finance Products' Leader May Leverage Financial Data Sharing to Boost Consumer Advantages

Federal Authority on Consumer Finance Products' Leader May Leverage Financial Data Sharing to Boost Consumer Advantages

The Consumer Financial Protection Bureau (CFPB), under its new director Rohit Chopra, has been urged to move forward on data portability rules to bolster consumer privacy and security. This push comes in light of Section 1033 of the Dodd-Frank Act, which authorized the CFPB to enact rules that would require financial institutions to provide consumers access to their financial records.

Chopra, a strong advocate for consumer rights, has emphasized the importance of people controlling their personal data. He has also highlighted the value of data portability, which refers to the ability of users to obtain and transfer a copy of their data from one data controller to another, in fostering competition, lowering switching costs, and unlocking opportunities for innovation in the financial sector.

Initially, the CFPB advanced a strong data portability rule for the financial sector. This rule sought to require banks with assets over $850 million to provide consumers fee-free access to their financial data via standardized APIs, prohibiting practices like screen-scraping, and enabling FinTechs to securely access consumer-authorized data to foster an open banking ecosystem.

However, in May 2025, the CFPB reversed this rule, citing it as "unlawful." This strategic shift away from aggressively disrupting traditional banks was met with criticism, as the CFPB remains legally obligated under Section 1033 to issue a rule enabling consumer data access in a standardized and usable format.

The absence of regulations outlining when financial institutions have an obligation to provide consumers access to their data can lead to restrictions and potential prevention of competition. To address this, the CFPB should clarify the data protection obligations for entities that transfer and receive consumer financial data.

Moreover, it is essential for the CFPB to develop clear expectations for principles on issues such as functionality, privacy, and security. The bureau should detail the measures that entities should have in place to verify the identity of their users, identify fraud, and report data breaches.

The CFPB can build off of the example set by the Department of Health and Human Services, which investigates and takes action against entities that restrict health data sharing, by prioritizing its role as an enforcement agency to ensure that financial institutions do not shirk their data portability responsibilities.

As the financial sector evolves, with banks starting to impose new fees on FinTech data access and threats to the economics of open banking, the CFPB's approach to data portability remains crucial. A revised data portability rule is expected to be narrower, less disruptive, and more favorable to banks’ preferences, but will still require safe, secure, and transparent consumer data access.

Chopra's top priority for the CFPB is to stimulate more competition in consumer financial markets. By expediting rulemaking for data portability, he can not only protect and empower consumers but also foster a more competitive and innovative financial sector.

1. The Consumer Financial Protection Bureau (CFPB), under its new director Rohit Chopra, should clarify the data protection obligations for entities that transfer and receive consumer financial data to address the absence of regulations.
2. Chopra's emphasis on people controlling their personal data includes valuing data portability, which refers to the ability of users to obtain and transfer a copy of their data, as it fosters competition, lowers switching costs, and unlocks opportunities for innovation in the financial sector.
3. The CFPB's development of clear expectations for principles on issues such as functionality, privacy, and security is essential, as it should detail the measures that entities should have in place to verify the identity of their users, identify fraud, and report data breaches.
4. A revised data portability rule from the CFPB is expected to be narrower, less disruptive, and more favorable to banks’ preferences, but will still require safe, secure, and transparent consumer data access.
5. Chopra's top priority for the CFPB is to stimulate more competition in consumer financial markets by expediting rulemaking for data portability, protecting and empowering consumers, and fostering a more competitive and innovative financial sector.

Read also: