The US government plans to rein in the vast data broker industry with new, privacy-focused regulations that aim to safeguard millions of Americans' personal information from data breaches, violent criminals and even artificial intelligence chatbots.
The coming proposal by the Consumer Financial Protection Bureau would extend existing regulations that govern credit reports, arrest records and other data to what the agency describes as the "surveillance industry," or the sprawling economy of businesses that traffic in increasingly digitized personal information.
The potential rules, which are not yet public or final, could bar data brokers from selling certain types of consumer information — including a person's income or their criminal and payment history — except in specific circumstances, the CFPB said.
The push could also see new restrictions on the sale of personal information such as Social Security numbers, names and addresses, which the CFPB said data brokers often buy from the major credit reporting bureaus to create their own profiles on individual consumers.
Issued under the Fair Credit Reporting Act, the regulations would seek to ensure that data brokers selling that sensitive information do so only for valid financial purposes such as employment background checks or credit decisions, and not for unrelated purposes that may allow third parties to use the data to, for example, train AI algorithms or chatbots, the CFPB said.
The announcement follows an agency study into the data broker industry this year that found widespread concerns about how consumer data is being collected, used and shared. The inquiry received numerous submissions from the public warning about the disproportionate risks that unregulated data sharing can have on minorities, seniors, immigrants and victims of domestic violence.
"Reports about monetization of sensitive information — everything from the financial details of members of the U.S. military to lists of specific people experiencing dementia — are particularly worrisome when data is powering 'artificial intelligence' and other automated decision-making about our lives," CFPB Director Rohit Chopra said in a statement. "The CFPB will be taking steps to ensure that modern-day data brokers in the surveillance industry know that they cannot engage in illegal collection and sharing of our data."
The CFPB's proposal will first be floated with a group of small businesses for feedback before being publicly unveiled in a formal rulemaking, the agency said.
The CFPB isn't the only US agency clamping down on the massive data industry. Last year, the Federal Trade Commission proposed a sweeping set of regulations that may restrict how all businesses collect and use consumer data, taking aim at what FTC Chair Lina Khan has described as the "persistent tracking and routinized surveillance of individuals."
The agency initiatives reflect how Congress has continually failed to produce a comprehensive, national-level consumer privacy law, despite years of lawmaker negotiations and the rise of privacy regulations overseas that increasingly affect US businesses.