Today, Americans for Tax Reform published a report by Vance Ginn, a former chief economist for the first Trump administration’s Office of Management and Budget and currently staff economist at Americans for Tax Reform, on the CFPB’s 1033 rule on data portability.
The rule mandates that financial institutions provide secure access to consumer data upon request to authorized third parties. Per the report:
The CFPB’s Section 1033 rule imposes sweeping obligations on financial institutions and third-party entities, fundamentally altering the financial data ecosystem. Unlike previous regulations, which primarily focused on protecting consumer privacy and regulating data use within traditional financial institutions, this rule mandates a standardized framework for sharing data across diverse entities, including fintech firms.
The report finds that while well-intentioned, the 1033 rule introduces significant risks to privacy, national security, and market competition. Uniform sharing protocols are not something any agency is equipped to monitor, and industry standards are a preferable alternative to administrative mandates.
Third parties, on the other hand, are subject to new certification requirements:
They must ensure that consumer data use, collection, and retention are limited to what is “reasonably necessary” to provide requested services. Additionally, data retention is capped at one year unless the consumer explicitly reauthorizes access. Privacy measures are emphasized, with the rule barring the use of consumer data for targeted advertising, cross-selling, or other secondary purposes without explicit consent. Compliance deadlines range from 2026 to 2030, depending on the financial institution’s size.
In addition to the compliance burden that is detrimental to free market competition, this mandate poses new risks to privacy and national security. Compelling financial institutions to share sensitive consumer information with third parties while failing to update Application Programing Interface (API) standards leaves consumer data newly vulnerable to data breaches in disparate systems. Prohibiting financial institutions from charging fees for access prevents them from indemnifying, even to a small degree, the hazards accompanying access mandates or paying for cybersecurity upgrades to that better secure customer data.
As for national security, opening American consumer data to the world invites hostile state and non-state actors to steal personal information:
Notably, nonbanks operating in countries with deficiencies in Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) standards, as identified by the Financial Action Task Force (FATF) grey list, could exploit these vulnerabilities to target Americans with fraudulent schemes. Moreover, the threat of state-controlled banking regimes, such as those in China, which have demonstrated a vested interest in collecting large datasets on U.S. citizens, underscores the need for stringent safeguards to mitigate risks of data exploitation and espionage.
The report goes on to recommend market-oriented alternatives to the data portability mandate, such as reaffirming the longstanding consumer consent requirement, standardized security requirements rather than uniform sharing protocols, and mandatory audits and enforcement. The report also recommends allowing market-based pricing for third-party access and encouraging industry standard consortia to develop best practices. Finally, to address national security concerns, the CFPB should discourage the storage or processing of consumer financial data in high-risk jurisdictions.
Read the full report here.