On December 3, the CFPB released a proposed rule to amend Regulation V, which implements the FCRA in an attempt to have the FCRA cover the activities of data brokers by amending the definitions of “consumer reports” and “consumer reporting agencies.” The rule would also prohibit all consumer reporting agencies including data brokers from selling information for non-FCRA purposes and limit the transmission of information that could be used for targeted marketing purposes or to facilitate scams, fraud, stalking or harassment.

Specifically, the proposed rule would, among other things: (i) expand coverage to companies that assemble or evaluate consumer credit information for the purpose of furnishing reports to third parties; (ii) describe the conditions for furnishing a consumer report with the consumer’s written permission; (iii) set forth conditions for furnishing consumer reports for permissible purposes based on “a reasonable belief about a person’s intended use.”

Additionally, the CFPB proposed rule would restrict the sharing of medical information. However, the Bureau’s attempts to regulate the sharing of medical information has been the subject of a previous CFPB “advisory opinion” (covered by InfoBytes here) which has faced multiple litigation attempts against it (covered here and here).

The NPRM follows a 2023 Request for Information (covered by InfoBytes here) which sought additional insight into the data broker industry. Comments on the CFPB’s proposed rule must be received by March 3, 2025.