LegiStorm

Summary:
Highlights


GAO reviewed the Consumer Financial Protection Bureau's (CFPB) new rule entitled "Required Rulemaking on Personal Financial Data Rights." GAO found that the final rule requires banks, credit unions, and other financial service providers to make consumers' data available upon request to consumers and authorized third parties in a secure and reliable manner, defines obligations for third parties accessing consumers' data, including important privacy protections, and promotes fair, open, and inclusive industry standards.

Enclosed is our assessment of CFPB's compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. If you have any questions about this report or wish to contact GAO officials responsible for the evaluation work relating to the subject matter of the rule, please contact Charlie McKiver, Assistant General Counsel, at (202) 512-5992.






View Decision



B-336873

December 3, 2024

The Honorable Sherrod Brown
Chairman
The Honorable Tim Scott
Ranking Member
Committee on Banking, Housing, and Urban Affairs
United States Senate

The Honorable Patrick McHenry
Chairman
The Honorable Maxine Waters
Ranking Member
Committee on Financial Services
House of Representatives

Subject: Consumer Financial Protection Bureau: Required Rulemaking on Personal Financial Data Rights

Pursuant to section 801(a)(2)(A) of title 5, United States Code, this is our report on a major rule promulgated by the Consumer Financial Protection Bureau (CFPB) entitled ?Required Rulemaking on Personal Financial Data Rights? (RIN: 3170-AA78). We received the rule on October 31, 2024. It was published in the Federal Register on November 18, 2024. 89 Fed. Reg. 90838. The effective date of the rule is January 17, 2025.

CFPB states that they issued the rule to carry out the personal financial data rights established by the Consumer Financial Protection Act of 2010 (CFPA), Public Law 111-203, title X, 124 Stat. 1376, 1955?2113 (July 21, 2010). CFPB states that the rule requires banks, credit unions, and other financial service providers to make consumers? data available upon request to consumers and authorized third parties in a secure and reliable manner, defines obligations for third parties accessing consumers? data, including important privacy protections, and promotes fair, open, and inclusive industry standards.

Enclosed is our assessment of CFPB?s compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. If you have any questions about this report or wish to contact GAO officials responsible for the evaluation work relating to the subject matter of the rule, please contact Charlie McKiver, Assistant General Counsel, at (202) 512-5992.


Shirley A. Jones
Managing Associate General Counsel

Enclosure

cc: Edward J. Lovett
Senior Congressional Liaison
Consumer Financial Protection Bureau

ENCLOSURE

REPORT UNDER 5 U.S.C. § 801(a)(2)(A) ON A MAJOR RULE
ISSUED BY THE
CONSUMER FINANCIAL PROTECTION BUREAU
ENTITLED
?REQUIRED RULEMAKING ON PERSONAL FINANCIAL DATA RIGHTS?
(RIN: 3170-AA78)

(i) Cost-benefit analysis

The Consumer Financial Protection Bureau (CFPB) prepared an analysis of the costs and benefits for this rule. See 89 Fed. Reg. 90838, 90956?82 (Nov. 18, 2024). The analysis includes a largely qualitative description of the benefits and costs to consumers and covered entities as well as potential impacts on insured depository institutions, insured credit unions, and consumers in rural areas. Id. The discussion also includes quantitative estimates for some specific types of impacts. Id.

(ii) Agency actions relevant to the Regulatory Flexibility Act (RFA), 5 U.S.C. §§ 603?605, 607, and 609

CFPB determined that this rule will have a significant economic impact on a substantial number of small data providers, data aggregators, and third parties (including entities using consumer?authorized data to underwrite loans, offer budgeting or personal financial management services, or facilitate payments), and prepared a Final Regulatory Flexibility Analysis. See 89 Fed. Reg. 90838, 90982?88.

(iii) Agency actions relevant to sections 202?205 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. §§ 1532?1535

As an independent regulatory agency, CFPB is not subject to the Act.

(iv) Agency actions relevant to the Administrative Pay-As-You-Go-Act of 2023, Pub. L. No. 118-5, div. B, title III, 137 Stat 31 (June 3, 2023)

Section 270 of the Administrative Pay-As-You-Go-Act of 2023 amended 5 U.S.C. § 801(a)(2)(A) to require GAO to assess agency compliance with the Act, which establishes requirements for administrative actions that affect direct spending, in GAO?s major rule reports. In guidance to Executive Branch agencies, issued on September 1, 2023, the Office of Management and Budget (OMB) instructed that agencies should include a statement explaining that either: ?the Act does not apply to this rule because it does not increase direct spending; the Act does not apply to this rule because it meets one of the Act?s exemptions (and specifying the relevant exemption); the OMB Director granted a waiver of the Act?s requirements pursuant to section 265(a)(1) or (2) of the Act; or the agency has submitted a notice or written opinion to the OMB Director as required by section 263(a) or (b) of the Act? in their submissions of rules to GAO under the Congressional Review Act. OMB, Memorandum for the Heads of Executive Departments and Agencies, Subject: Guidance for Implementation of the Administrative Pay-As-You-Go Act of 2023, M-23-21 (Sept. 1, 2023), at 11?12. OMB also states that directives in the memorandum that supplement the requirements in the Act do not apply to proposed rules that have already been submitted to the Office of Information and Regulatory Affairs, however agencies must comply with any applicable requirements of the Act before finalizing such rules.

As an independent regulatory agency, CFPB is not subject to the Act.

(v) Other relevant information or requirements under acts and executive orders

Administrative Procedure Act, 5 U.S.C. §§ 551 et seq.

On October 31, 2023, CFPB published a proposed rule. 88 Fed. Reg. 74796. CFPB stated that they received comments from various interested parties. See 89 Fed. Reg. 90838, 90843?53. CFPB responded to comments in the rule. Id.

Paperwork Reduction Act (PRA), 44 U.S.C. §§ 3501?3520

CFPB determined that this rule contains information collection requirements under the Act. See 89 Fed. Reg. 90838, 90988?89.

Statutory authorization for the rule

CFPB promulgated this rule pursuant to sections 5481, 5512, 5514, and 5533 of title 12, United States Code.

Executive Order No. 12866 (Regulatory Planning and Review)

As an independent regulatory agency, CFPB is not subject to the Order?s regulatory review procedures.

Executive Order No. 13132 (Federalism)

As an independent regulatory agency, CFPB is not subject to the Order.





Downloads







Full Report (4 pages)