Several high-ranking lawmakers who rarely agree on anything found common ground at a hearing Tuesday in support of consumers’ right to control their own financial data.
Lawmakers on both sides of the aisle questioned the widespread practice of
Several lawmakers cited data that shows consumers have little, if any, understanding of the way many fintechs and data aggregators access customer account data by scraping the information with a consumer’s login credentials.
“People aren’t aware that [screen scraping] is going on. They should be told. There should be options presented to them,” said Rep. Blaine Luetkemeyer, R-Mo., at a hearing of the committee's Task Force on Financial Technology. “The first way to protect people's privacy and information is to be honest with them upfront and say this is what's happening with your information and how we're accessing it.”
House Financial Services Committee Chairwoman Maxine Waters, D-Calif., said the hearing titled, “Preserving the Right of Consumers to Access Personal Financial Data,” showed that there was common ground among Democrats and Republicans.
“It seems as if I am agreeing with Luetkemeyer for the first time since we have served on this committee together,” Waters said. Leutkemeyer and Waters have served on the House committee together for 10 years.
Enormous amounts of data about an individual’s personal and financial information are now collected, stored and often sold to third parties by financial services companies. The data is used to sell products and services that allow consumers to manage their personal finances and perform other tasks such as setting goals for how to save money.
The Gramm-Leach-Bliley Act allows consumers to opt out of having their data shared. But several experts and lawmakers said consumers rarely read the small typeface buried in agreements stating that they can revoke their consent.
Waters said consumers should have the ability to opt in to data-sharing.
“I want to know about opt-out as opposed to opt-in,” Waters said. “Most people don’t know … that if you don’t opt out, your information is shared with a third party, the third party is sharing information with somebody else, [and] somebody else shares the information and then you get all these solicitations.”
Other lawmakers expressed concern that the industry is light years ahead of regulatory policy.
"We all agree on the importance of protecting consumers' control over their own financial data," said Rep. Stephen Lynch, D-Mass. "But there's a question whether both regulators and policymakers alike are moving fast enough to address the uncertainties in this area. I'm not convinced that we are."
The CFPB currently is in the thick of writing a data-sharing rule, required by the Dodd-Frank Act, that aims to clarify standards for how fintechs access bank account data. Banks have long objected to screen scraping even as banks and aggregators have been moving toward partnerships to send data to fintechs using application programming interfaces.
Lawmakers directed many of their questions at Tom Carpenter, director of public affairs and marketing at the Financial Data Exchange, a Reston, Va., nonprofit that is working to set technology standards.
Carpenter got the most flack over screen-scraping issues. FDX is trying to move the industry toward APIs and away from screen scraping, but he noted that the latter is still the more common route by which a fintech provider accesses a customer's account data.
Screen scraping is "an old technology, it's not a perfect technology, [but] it also is what is delivering the innovation that we have today in the competitive financial services market,” Carpenter said. “I would argue that without the ability of a consumer to access and share their own data via screen scraping, we would not have had the explosion of competition in financial services.”
Consumer advocates, meanwhile, are urging the CFPB to establish supervision authority over large data participants including the three major credit bureaus: Equifax, Experian and TransUnion.
Chi Chi Wu, a staff attorney at the Consumer Law Center, asked lawmakers at the hearing to transfer the data security authority in the Gramm-Leach-Bliley Act over credit bureaus and data aggregators to the CFPB.
“We think the consumer should have maximum control over their own data,” said Wu. “The nightmare scenario is a system where every consumer ... is forced to give up their privacy and allow each creditor, lawyer, insurance [company], landlord and government agency a direct and permanent digital pipeline to their bank account data. It's up to the regulators and ultimately Congress to make sure that this data promotes consumer welfare without hurting our interests.”
