In a move to protect Americans' sensitive personal and financial information, the Consumer Financial Protection Bureau (CFPB) has proposed a rule to limit data brokers' ability to sell social security numbers and other sensitive data. The proposal comes in the wake of high-profile hacks affecting hundreds of millions of Americans, highlighting the need for stricter regulations on the sale of personal data.

Under the proposed rule, data brokers that sell information about consumers' income, credit history, credit score, or debt payments would be considered consumer reporting agencies. This would require them to comply with the Fair Credit Reporting Act (FCRA), a law that limits how these agencies can obtain and use the information provided in consumer reports. In essence, data brokers would be treated like credit bureaus and background check companies, which already have to comply with the FCRA.

CFPB director Rohit Chopra emphasized the urgency of the issue, citing the massive National Public Data breach earlier this year that leaked more than 200 million Social Security numbers onto the dark web. "These aren't just isolated incidents: they represent a systemic vulnerability in how our personal data is bought and sold," Chopra said. He also highlighted the national security implications, noting that foreign countries have gone to great lengths to obtain Americans' sensitive data, including the 2017 Equifax breach allegedly carried out by four members of China's military.

Chopra stressed that data brokers are making sensitive information available to anyone willing to pay a price, enabling scamming, stalking, and spying. "By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling these malicious activities," he said. The proposed rule aims to address this issue by requiring consumers to provide clear consent for data sharing and requiring data brokers to get explicit permission to sell sensitive personal or financial information.

The regulation is targeting private companies, not government operations. However, the CFPB is requesting comment on how to ensure government agencies continue to have "appropriate access" to this information. The agency will be accepting comments on the proposed rule until March 3rd, 2025. Despite potential pushback from the Trump administration, which has reportedly been looking at ways to rein in the CFPB's powers, the agency remains committed to protecting Americans' privacy and national security.

The proposal has significant implications for the data brokerage industry, which has long operated with minimal oversight. By requiring data brokers to comply with the FCRA, the CFPB is seeking to establish a higher standard for data protection and privacy. The move is also likely to spark a broader conversation about the role of data brokers in the digital economy and the need for stronger regulations to protect Americans' sensitive information.

As the CFPB navigates the comment period and potential pushback from the administration, one thing is clear: the proposed rule marks a significant step towards protecting Americans' privacy and national security in the digital age. With data breaches and cyber attacks on the rise, the need for stricter regulations on the sale of personal data has never been more pressing.