Home      Login

Abstract: 

This article examines how existing federal consumer financial privacy laws in the United States, namely the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act, apply to the open banking ecosystem, particularly in light of the Consumer Financial Protection Bureau’s recently promulgated Personal Financial Data Rights rulemaking under Section 1033 of the Dodd-Frank Act. While these new rules require data providers and authorized third parties to implement several new consumer protections, they were crafted to work in conjunction with existing privacy laws. The overlap of these new rules with legacy privacy frameworks is examined to demonstrate how they work in tandem and how they will work going forward if the new rules are vacated through pending litigation. In some cases, the new rules introduce stricter limitations on the access, use, retention, and redisclosure of data than existing federal consumer financial privacy laws, raising complex operational questions for entities involved in the open banking ecosystem.

Keywords: Section 1033 of the Dodd-Frank Act; Personal Financial Data Rights Rule; Nonpublic Personal Information; Fair Credit Reporting Act and Open Banking Data

Affiliations:  1: McGlinchey Stafford, PLLC.