Dear Acting Director Vought,
The American Bankers Association,[1] America’s Credit Unions,[2] the Bank Policy Institute,[3] and the Consumer Bankers Association[4] (Joint Trades) appreciate the opportunity to respond to the Request for Information Regarding the Collection, Use, and Monetization of Consumer Payment and Other Personal Financial Data (Privacy RFI) issued by the Consumer Financial Protection Bureau (CFPB).[5]The Privacy RFI seeks to better understand how companies that offer or provide consumer financial products or services collect, use, share, and protect consumers’ personal financial data, such as data obtained as part of payment transactions. Members of the Joint Trades, which consist of traditional depository financial institutions (i.e., banks and credit unions), are committed to safeguarding the personal information of consumers and customers.[6]
As an initial matter, we note that the Privacy RFI was issued and published in the Federal Register for comment under the CFPB’s prior leadership during the period between the election on November 5, 2024, and Inauguration Day on January 20, 2025. As this RFI was issued under the previous Director’s leadership and necessarily reflects the prior Administration’s policy priorities, we respectfully state that the RFI should have been rescinded. Nonetheless, we are submitting a response to ensure that the current Administration is fully apprised of several relevant policy considerations.
The RFI indicates the CFPB is considering whether any regulatory actions “are warranted to protect consumer privacy,” including changes to Regulation P[7] or its model privacy form. In our experience, the privacy protections afforded by the Gramm-Leach-Bliley Act (GLBA)[8] and its implementing Regulation P are fundamentally strong for highly regulated financial institutions. Should the Administration determine to move forward with any actions as contemplated under this RFI, we accordingly recommend that the CFPB focus its regulatory and examination resources in two main areas: (1) leveling the playing field between depository institutions and less regulated technology services providers; and (2) updating the model form to provide even more clarity to customers and financial institutions.
To read the full comment letter, please click here, or click on the download button below.
[1] The American Bankers Association is the voice of the nation’s $24.1 trillion banking industry, which is composed of small, regional and large banks that together employ approximately 2.1 million people, safeguard $19.2 trillion in deposits and extend $12.7 trillion in loans.
[2] America’s Credit Unions is the unified voice for not-for-profit credit unions and their more than 140 million members nationwide. America’s Credit Unions provides strong advocacy, resources and services to protect, empower and advance credit unions and the people and communities they serve. For more information about America’s Credit Unions, visit AmericasCreditUnions.org.
[3] The Bank Policy Institute is a nonpartisan public policy, research and advocacy group that represents universal banks, regional banks, and the major foreign banks doing business in the United States. BPI produces academic research and analysis on regulatory and monetary policy topics, analyzes and comments on proposed regulations, and represents the financial services industry with respect to cybersecurity, fraud, and other information security issues.
[4] The CBA is a member-driven trade association, and the only national financial trade group focused exclusively on retail banking—banking services geared toward consumers and small businesses. As the recognized voice on retail banking issues, CBA provides leadership, education, research, and federal representation for its members. CBA members operate in all 50 states. They include the nation’s largest bank holding companies as well as regional and super-community banks. Eighty-three percent of CBA’s members are financial institutions holding more than $10 billion in assets.
[5] https://www.federalregister.gov/documents/2025/01/15/2025-00811/request-for-information-regarding- the-collection-use-and-monetization-of-consumer-payment-and-other.
[6] “Members” in lieu of “customers” in the case of credit unions.
[7] https://www.ecfr.gov/current/title-12/chapter-X/part-1016.
[8] 15 U.S.C. 6804 et seq.; see
