Certified Banking Data Privacy Law and Regulation - Module 7.pptx

Certified Banking Data Privacy Law and Regulation - Module 7.pptx

1. Data Privacy Law and Regulation Certification Dr. Kevin F. Streff Founder and Managing Partner 1

2. 2 Testified to Congress several times on behalf of banking and cyber Author of Data Privacy textbook Conducted training and education for examiners Done cybersecurity work in almost all states in the U.S. banking system for over 20 years Published in both banking and academic magazines and journals Regular speaker at banking conferences Leading technology, cyber, and privacy educator at Dakota State University and the ASP Academy™ Dr. Kevin Streff

3. Dr. Streff is not an attorney and is not providing legal advice 3

4. Agenda 4

5. Module 7 Cfpb 1033 ruleset 5

6. Who is the CFPB? The Consumer Financial Protection Bureau (CFPB) was created under the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank) as an independent agency of the United States federal government. Established just after the 2007-2008 financial crisis to protect consumers in the financial system, Dodd-Frank provides a single point of accountability for protecting consumers in the financial services sector from deceptive, unfair, or abusive practices. It also establishes consumer rights to take action against companies that break the law. It is vital to note that the CFPB is focused only on the financial sector. Its sole function is consumer protection in the financial industry. Member of FFIEC. 6

7. CFPB 1033 - Introduction The Consumer Financial Protection Bureau (CFPB) finalized its rulemaking for Dodd-Frank Act Section 1033 in October of 2024. Section 1033 introduces consumers’ personal financial data rights, including consumer access to financial records linked to the financial products and services involved. The proposed 1033 rule, which requires secure and consented data-sharing across products, affects an extensive range of financial institutions, fintechs, payment companies and authorized third-party data processors and recipients. 7

8. CFPB 1033 - Introduction In financial services, open banking is the new buzzword with an explosion in new product and service experiences. Fintech products for induvial and business consumers have driven the rise of open banking technology in the United States and around the globe. Every stakeholder in the financial services arena must reconsider what is possible when consumers and businesses have full control of their financial data. To date, the financial services company has been viewed as the owner in charge of consumer data and the shift to consumer-owned data stewardship models is underway, causing financial services companies to create new policies, operating procedures, consumer relationships, technologies, and training programs to help the consumer understand and operationalize their data ownership rights. 8

9. CFPB 1033 - Introduction The  Consumer Financial Protection Bureau  (CFPB) has embraced this movement with the long-awaited Dodd-Frank Section 1033 open banking rule, which will accelerate the adoption of open banking technologies and protect consumer interests as we move further into the digital future. This proposed rule was released October 22, 2024. The Dodd-Frank-Act’s Section 1033 institutes consumers’ right to access financial data associated with the financial products and services they use, such as loans, debit cards, deposits and checking accounts.  This data includes account details, demographic information, financial transactions, balances and more, and financial institution must comply with the rules put forward by CFPB 1033. 9

10. CFPB 1033 – Types of Information Transaction information – 24 months Account balances Payment information – tokenized account number Terms and conditions Upcoming bill information Basic account verification information Need to provide what is “commercially reasonable” 10

11. Data ownership is with the consumer not the financial institution Financial institutions must work to data transportability Financial institutions must provide transparency in: How data is used Who data is shared with Financial institutions must provide a mechanism to interact with the consumer to understand their data relationship 11 CFPB 1033

12. SUBPART A - GENERAL 1033.101 Authority, purpose, and organization. 1033.111 Coverage of data providers. 1033.121 Compliance dates. 1033.131 Definitions. 1033.141 Standard setting. 12 CFPB 1033

13. SUBPART B—OBLIGATION TO MAKE COVERED DATA AVAILABLE 1033.201 Obligation to make covered data available. 1033.211 Covered data. 1033.221 Exceptions. 13 CFPB 1033

14. SUBPART C—DATA PROVIDER INTERFACES; RESPONDING TO REQUESTS 1033.301 General requirements. 1033.311 Requirements applicable to developer interface. 1033.321 Interface access. 1033.331 Responding to requests for information. 1033.341 Information about the data provider. 1033.351 Policies and procedures. 14 CFPB 1033

15. CFPB 1033 SUBPART D—AUTHORIZED THIRD PARTIES 1033.401 Third party authorization; general. 1033.411 Authorization disclosure. 1033.421 Third party obligations. 1033.431 Use of data aggregator. 1033.441 Policies and procedures for third party record retention. 15

16. Timeline to Complete the Standard The CFPB has been working toward implementing this rulemaking since 2016.   Some key milestones include:  Published a set of consumer protection principles (2017)  Sponsored a symposium on consumer access to financial records (2020)  Released detailed documentation of rulemaking proposals and alternatives under consideration (2022)  Convened a Small Business Review Panel and issued a report of its findings (2023)  Published: October 2024 16 16

17. Implementation Timeline 17 17

18. Open Banking Initiative 18

19. CFPB 1033 is real and has real specific requirements Is big and takes time to implement Supports the movement to Open Banking, so all financial institutions need to implement 19

20. Dr. Kevin Streff American Security and Privacy, LLC Founder & Managing Partner www.americansecurityandprivacy.com [email protected] 605.270.4427 www.drstreff.com 20 ASP Academy ™