Home / Daily Dose / CFPB Puts Focus on Financial Companies’ Data Handling
Print This Post Print This Post

CFPB Puts Focus on Financial Companies’ Data Handling

The Consumer Financial Protection Bureau (CFPB) confirmed in a circular published today that financial companies may violate federal consumer financial protection law when they fail to safeguard consumer data. The circular provides guidance to consumer protection enforcers, including examples of when firms can be held liable for lax data security protocols.

"Financial firms that cut corners on data security put their customers at risk of identity theft, fraud, and abuse," said CFPB Director Rohit Chopra. "While many non-bank companies and financial technology providers have not been subject to careful oversight over their data security, they risk legal liability when they fail to take common sense steps to protect personal financial data."

The CFPB is increasing its focus on potential misuse and abuse of personal financial data. As part of these efforts, the CFPB circular explains how and when firms may be violating the Consumer Financial Protection Act with respect to data security. Specifically, financial companies are at risk of violating the Consumer Financial Protection Act if they fail to have adequate measures to protect against data security incidents.

Past data security incidents, including the 2017 Equifax data breach, have led to the harvesting of the sensitive personal data of hundreds of millions of Americans. In some cases, these incidents violated the Consumer Financial Protection Act, in addition to other laws. For example, in 2019, the CFPB charged Equifax with violating the Consumer Financial Protection Act to address misconduct related to data security.

Today’s circular also provides examples of widely implemented data security practices. The circular does not suggest that particular security practices are specifically required under the Consumer Financial Protection Act. However, the circular notes some examples where the failure to implement the following data security measures might increase the risk that a firm’s conduct triggers liability under the Consumer Financial Protection Act, including:

  • Multi-factor Authentication: Multi-factor authentication greatly increases the level of difficulty for adversaries to compromise enterprise user accounts, and thus gain access to sensitive customer data. Multi-factor authentication can protect against credential phishing, such as those using the Web Authentication standard supported by web browsers.
  • Adequate Password Management: Unauthorized use of passwords is a common data security issue, as is the use of default enterprise logins or passwords. Username and password combinations can be sold on the dark web or posted for free on the internet, creating risk of future breaches. For firms that are still using passwords, password management policies and practices allow for ways to monitor for breaches at other entities where employees may be re-using logins and passwords.
  • Timely Software Updates: Software vendors and creators, including open-source software libraries and projects, often send out patches and other updates to address continuously emerging threats. Upon announcement of these updates to address vulnerabilities, hackers immediately become aware that firms using older versions of software are potential targets to exploit. Protocols to immediately update software and address vulnerabilities once they become publicly known can reduce vulnerabilities.

To read the full Consumer Financial Protection Circular on data security, click here.

About Author: Demetria Lester

Demetria C. Lester is a reporter for DS News and MReport, with more than six years of writing experience. She has served as Editor-in-Chief at Northlake College and staff writer at her alma mater, the University of Texas at Arlington. She has covered events such as the Byron Nelson, Pac-12 Conferences, the Women in Dallas Film Festival, to freelance work with the Dallas Wings and D Magazine. Currently located in Dallas, Texas, she is an avid jazz lover and reader. She can be reached at [email protected]
x

Check Also

Priscilla Almodovar to Serve as Fannie Mae CEO

A financial services veteran, Almodovar brings more than 30 years of finance, real estate, and community development expertise and a strong commitment to affordable housing.