FinRegLab responds to Senate Banking Committee invitation for feedback on data privacy, protection, and collection

The Honorable Mike Crapo The Honorable Sherrod Brown

U.S. Senate Committee on Banking, Housing, & Urban Affairs

534 Dirksen Senate Office Building

Washington, D.C. 20510

Re: Request for feedback on the collection, use, and protection of sensitive information by financial regulators and private companies

Dear Chairman Crapo and Ranking Member Brown,

Thank you for the opportunity to comment on the collection, use, and protection of sensitive information by financial regulators and private companies. As you highlight in your request, the growth and use of data is increasing exponentially in the American economy and specifically within its financial systems. This data has the potential to benefit consumers and the broader economy in myriad ways, but Americans are rightly concerned about how their data is collected, how such data is secured and protected, and how they can control its use.

We at FinReglab support work to foster a system that encourages responsible innovation, access to financial services, and protection of consumer data. Established in 2018, FinReglab is an independent, nonpartisan innovation center that tests new technologies and uses of data to drive the financial services sector toward a responsible and inclusive marketplace. Through our research and policy discourse, we facilitate collaboration across the financial ecosystem to inform public policy and market practices and provide firms with a safe space to evaluate how technology and data innovations can serve policy goals and meet regulatory requirements.

The Market Context

The Committee’s inquiry focuses on an essential and timely question. Since Congress has last addressed the protections afforded consumer financial data under federal law, the American financial system and broader economy have undergone multiple transformations with regard to technology, markets, and consumer behavior. These changes have created the preconditions for innovations that could potentially benefit consumers and the broader economy in a number of ways. Some estimates project that just a few large innovations in consumer finance, insurance, and real estate based on the use of “open” data and related technology could add $210 billion to $280 billion per year in global economic value, with substantial amounts of that increase flowing to consumers through improvements in product design, pricing, informed decision-making, and other changes.¹

To take one example, data-based innovations have the potential to help to improve the estimation of credit risk. Innovations of this kind fall primarily into two categories: (1) advanced analytic techniques for underwriting (e.g., machine learning) and (2) new underwriting data (e.g., incorporating “cash-flow data” or data from the applicant’s prepaid card or deposit accounts that has not traditionally been included in third-party credit scores). By using these approaches, lenders seek to reduce the number of qualified applicants denied under conventional underwriting models and to reduce the overall likelihood of default for approved applicants. These effects, if proven and considered together, promise to expand access to credit and reduce the cost of credit over large lending portfolios and the system as a whole.

FinReglab has been particularly focused on evaluating the potential impacts of these innovations on underserved populations. For the 30-40 million people who are considered thin- or no-file applicants for credit,² data and technology may enable banks and non-banks to perform more effective and efficient evaluations of credit risk. They may also be helpful to consumers who have experienced past negative credit history to help demonstrate to creditors that they are stabilizing their financial health. Evaluation of patterns detectable in cash-flow data – such as consistent rent payments or average account balances – can provide lenders with a much more nuanced, accurate, and complete picture of a market segment which otherwise would be hard if not impossible to assess for credit risk.

However, as part of evaluating the use of expanded data in underwriting, it is important to note that these benefits are dependent on such issues as the security and accuracy of consumers’ cash-flow data, the process by which lenders obtain access to that data, and their use of such data in responsible ways to the benefit of both consumers and the broader economy. These questions are implicated in the Committee’s request for comment.

FinReglab’s Research on The Use of Cash-Flow Data in Consumer and Small Business Underwriting

FinReglab is currently engaged in an experiment examining the effect of using cash-flow data to determine eligibility for consumer and small business loans. In particular, we are analyzing data from five fintech lenders to evaluate whether underwriting models that consider cash-flow data – for example, history from deposit accounts – expand the pool of applicants approved for loans. We are analyzing loan-level data to evaluate how cash-flow data may help lenders better assess the credit risk of thin-file borrowers, as compared to the effectiveness of traditional credit data in underwriting those borrowers. We are also exploring the effects of cash-flow based eligibility determinations on particular populations who have been historically underserved.³

This empirical research is paired with deep consideration of the policy and regulatory implications of the use of cash-flow data in consumer and small business lending. In this part of our work, we formed working groups to identify and consider critical policy and regulatory matters in the following areas: the credit information ecosystem, fair and inclusive access to credit, and consumer-facing data issues. Each working group included diverse stakeholders, such as large financial institutions, fintech lenders, data aggregators, consumer advocates, and legal experts. Federal regulators participated in these working groups as observers.

Our research report, to be released this spring, will provide the results of our analysis of cash­ flow-based eligibility determinations and consider various policy options to address related changes in the landscape with regard to data, technology, and consumer privacy needs. We believe that many of the foundational consumer protection and prudential issues raised in our report will be relevant to the Committee’s inquiry into data privacy, protection, and collection:

• Adapting to an Evolving Credit Information Ecosystem: The use of cash-flow data in consumer and small business lending depends on the transfer of financial data to a lender that is not already providing transaction account services to the applicant. Indeed, much of the effort to develop innovative approaches to evaluating eligibility and creditworthiness using cash-flow data is currently concentrated in companies outside the banking system. Such firms typically seek authorization from a customer or applicant and their account credentials, either directly or through technology intermediaries called data aggregators, to acquire account data from financial services products held by other financial institutions. Whether this evolving data ecosystem is and/or should be covered under existing laws, such as the Fair Credit Reporting Act (FCRA) and the Gramm-Leach-Bliley Act (GLBA), or if a new policy framework is warranted is the subject of considerable debate. A network of bilateral commercial contracts between data sources and data aggregators on the one hand and data aggregators and end users of data on the other are the emerging mechanism by which firms are allocating responsibility to ensure the accuracy, security, and permissible use of the data that is shared. Ensuring critical policy objectives­ including transparency and consistent application – in this system is important and warrants deeper examination.

• Consumer Control: Empowering consumers to understand and exercise control over the use of their financial data is an important lever in a more open and diverse financial services sector. This principle may take many forms in policy: allowing consumers to select the accounts from which a lender can access data, enabling consumers to review the data that will be shared through an aggregator and correct errors, and/or defining mechanisms for resolving disputes about accuracy or misuse of shared data throughout the product lifecycle. Each option raises significant consumer protection and prudential issues which need to be evaluated against a changing landscape of privacy expectations.

• Obtaining Informed Consent: Credit transactions, like almost all commercial agreements, require consent of the parties. Using cash-flow data to supplement or replace traditional underwriting raises important questions about what information a consumer applicant needs to know about the transfer and use of such data for the consumer’s consent to be meaningful. Further, in the context of cash-flow-based underwriting, disclosures to the consumer take on a second layer of importance. The financial institution providing data also relies on the consumer’s authorization – even though it cannot dictate its contents – to determine the scope of the applicant’s authorization and the specific purpose for which the data can be used.

Conclusion

In light of these policy issues, we believe that an important first step is a thoughtful evaluation of the existing laws that implicate protection of consumer financial data, particularly the FCRA and GLBA, as well as differing stakeholders’ views of policy to govern this emerging sector. We expect to publish our report on the use of cash-flow data in consumer and small business underwriting this spring, where you will find more information on our approach to data-driven policy research and the findings from our research on the use of cash-flow data in consumer and small business lending.

Thank you for the opportunity to provide our perspective on issues concerning data privacy, protection, and collection.

Best regards,

Kelly Thompson Cochran

Deputy Director and Chief Program Officer

FinRegLab

Prior to joining FinRegLab, Kelly helped to stand up the Consumer Financial Protection Bureau, where she served most recently as the Assistant Director for Regulations. In that capacity, she oversaw rulemaking and guidance activities under the Dodd-Frank Act, Electronic Fund Transfer Act, and various other federal consumer financial laws. Kelly previously was counsel at WilmerHale, where she advised financial institutions on a wide range of legal and regulatory matters including product development, compliance, enforcement, and litigation. Kelly also conducted research on financial services innovation, community reinvestment, and other topics at the University of North Carolina at Chapel Hill.

endnotes