US states need to evaluate the gaps in their data privacy laws to ensure that Americans are safeguarded, especially as financial institutions increasingly seek to monetize customer data, according to the CFPB.
In the past six years, 18 states have enacted data privacy laws that enhance individuals’ control over their data and aim to minimize unnecessary data collection. However, these laws include exemptions linked to federal regulations governing financial data and related products and services.
The CFPB notes in a report that Americans are increasingly utilizing digital financial tools such as mobile banking and payment apps. These technologies offer companies unprecedented access to extensive data concerning consumers’ economic lives and behaviors. Financial institutions are leveraging information about individuals’ income, expenses, and account balances to create new revenue streams, including selling this data to third parties.
This year, companies like JPMorgan Chase and PayPal have announced initiatives to develop services that utilize customer data for improved advertising targeting. The CFPB emphasizes that existing federal rules governing financial data privacy “may not fully address the challenges posed by modern data surveillance.”
While states have the authority to enhance data privacy protections, many of them exempt data and financial institutions governed by federal regulations. The report suggests that states should take action to protect consumers in areas where federal law is lacking or ineffective.
“Consumers should have meaningful choice and an expectation of privacy regarding how their financial data is used, but large companies are increasingly harvesting and monetizing this sensitive data in mysterious ways,” said CFPB director Rohit Chopra. He also noted that due to exemptions in state law concerning this personal data, consumers are lacking essential protections for their financial privacy.