Late Thursday, the CFPB outlined proposals to significantly restrict the way companies can access consumer data under the FCRA. Suggested changes include removing medical debt from credit reports, barring the sale of data for non-permissible purposes, as well as the inclusion of data brokers and aggregators under the FCRA. The plans follow an inquiry by the CFPB from March of this year that looked into data brokers and the types of information that is collected and sold. The bureau based its proposal on more than 7,000 comments it consequently received. The announcement of the proposal by CFPB Director Rohit Chopra, who was joined by Vice President Kamala Harris, focused heavily on how removing medical data from credit scores would help clean up inaccurate data, end coercive debt collection tactics and improve credit score predictiveness. Yet it was the second part of the proposal that sparked concern amongst banks and financial firms. Under the proposed changes, previously exempt companies, such as data brokers and aggregators, would be subject to the FCRA’s requirements. In real-world terms, this would mean that a wide range of companies that are not using data for credit purposes would now be designated as credit reporting companies. Under current regulations, the sale of credit report data is strictly limited for any other reason other than what Congress has specified as permissible purpose. The proposed changes would now bar credit report data from being sold for non-permissible purposes. Should data brokers and aggregators fall under the FCRA, these companies would have to give consumers the right to access and dispute their data, which could potentially disrupt the ecosystems of fraud prevention and customer identity verification that are currently in place. It would also leave the door open for class action lawsuits against data furnishers (such as banks), brokers and aggregators. The CFPB’s outline has now been supplied for initial comment to a panel of small businesses convened under the SBREFA. Once the comment period is complete, a final rule will be issued, which is not expected before 2025.