Kim Phan, a partner in Troutman Pepper’s Consumer Financial Services Practice Group, was quoted in the March 24, 2023 Law360 article, “CFPB’s Data Broker Probe Hints At Potential Rule Expansion.”

The CFPB “may be trying to legislate by regulation,” said Kim Phan, a partner in Troutman Pepper’s privacy and cyber practice group. “The Fair Credit Reporting Act has been around for 50-plus years … and there are specific definitions of what a consumer reporting agency is and what a consumer report is.”

“Data brokers have taken the definitions, and they operate their business outside of those definitions,” Phan continued. “If the CFPB wants to make data brokers into consumer reporting agencies, it needs to amend the law, not the regulation.”

…

As the CFPB’s request acknowledges, many companies that trade in consumer data strive to limit their exposure to the FCRA’s complex compliance obligations. That can often involve carefully structuring activities to avoid bumping up against those requirements wherever possible, Phan said.

“A lot of the larger companies out there in this space separate their businesses internally between FCRA products and non-FCRA products,” she said. “They have divided their internal operations based on their understanding of the FCRA’s reach, so if you change that [reach], it could have broad impacts across the industry.”

…

Phan noted that the CFPB’s press release announcing the inquiry described the FCRA as applying to “data brokers,” while the request for information’s questions about data accuracy and privacy point to the types of consumer protections that CFPB may be interested in rolling out more widely, she said.

“Accuracy requirements, having a dispute process, requiring reinvestigation by furnishers — there’s an entire framework for FCRA compliance that [the bureau] could be hoping to impose onto data brokers,” Phan said. “Would that be fought in litigation? Absolutely.”