Credit card-financial background

Does the CFPB Know What's in Your Wallet?

The consumer protection agency is collecting vast swathes of credit card data.

Credit card-financial background

Does the CFPB really need all this credit card info?

By + More

Things got pretty heated on Jan. 28 when lawmakers questioned Richard Cordray — director of the Bureau of Consumer Financial Protection — about the bureau’s monitoring of more than 900 million U.S. credit card accounts. Cordray bristled at suggestions that the data could be used for unseemly purposes.

His confidence in the bureau’s current handling of the data does little to answer questions about why the CFPB is collecting such a large amount of data and whether one man’s pledges to keep sensitive consumer information secure are sufficient. An agency that operates without accountability to the American people should not be entrusted with their private financial data.

At the hearing, Cordray defended the massive data collection in several different ways. First, everyone else is doing it. That is an argument for looking at practices of other regulators, such as the Office of the Comptroller of the Currency, but old regulators’ bad habits are no excuse for new regulators to follow suit.

[See a collection of political cartoons on the economy.]

Second, Cordray explained that the banks from which the bureau collects data would rather provide all of it than a subset. The bureau’s consumer protection mandate demands that it not simply defer to whatever the big banks want. It ought to take into consideration consumers’ interests in keeping their data safe and private.

Cordray’s main justification for the massive data collection is that, without it, the CFPB cannot effectively conduct regulatory policy and monitor the markets for abuses. However, Thomas Stratmann, a Mercatus Center senior scholar and an economics professor at George Mason University, has estimated that the bureau could conduct a meaningful analysis of credit card markets with a sample of 1.4 million accounts and greatly reduce the potential for a large data breach. As Stratmann writes, “the CFPB is collecting much more data than necessary to conduct a valid statistical analysis of the consumer financial markets.”

Cordray dismissed Stratmann’s sampling suggestion. He also rejected the recommendation that consumers be permitted to opt out of the collection of their information. Instead, he argued that the bureau is not interested in individual cardholders, but the bureau tries “to aggregate as much as we can at a very high level.”

A 2012 contract solicitation by the bureau suggests otherwise. Explaining that “[l]oan level data is the critical enabler in the CFPB’s efforts to analyze and understand consumer behavior and the credit card marketplace,” the solicitation lists the “[a]ccount level data fields we expect to collect monthly.” The many fields of required information include the type of card, card balance, accountholder’s other relationships with the issuing bank, and the accountholder’s income, FICO score and payment history. When asked whether all of these data could be reverse engineered to identify individual consumers, Cordray responded honestly that it was a “complicated” issue.

[Read the U.S. News debate: Should the Dodd-Frank Act Be Repealed?]

Concerns about the bureau’s data collection are heightened by the agency’s flawed structure. The bureau’s budget is set outside of the constitutionally mandated appropriations process. Now that Cordray has been nominated by the president and confirmed by the Senate, he can run the agency for his five-year term without listening to input from anyone else. The bureau does not even have its own inspector general, but shares one with the Federal Reserve. As a result, neither the Fed nor the bureau gets the scrutiny it deserves.

Even Cordray’s congressional appearances need not be anything more than an annoyance to him, since Congress can only ask the bureau to provide information or change its ways. Congress’s lack of power over the regulator was clear at the hearing, when Cordray, objecting to a congressman’s “five-minute filibuster that resulted in no questions to me,” insisted on claiming time to make a statement while committee members waited for their turn to speak.

Had Cordray listened a little more closely, he would have understood that the hearing was not an indictment of his or the bureau’s good intentions. The problem is that there is nothing other than good intentions to prevent the agency from abusing its powers over American consumers.