Dear Acting Director Vought: 

My name is Solveig Singleton, and I am a policy analyst for consumer financial services at the Cato Institute’s Center for Monetary and Financial Alternatives. I welcome this opportunity to comment on the Personal Financial Data Rights Reconsideration of the Consumer Financial Protection Bureau (CFPB or the Bureau), which addresses financial data sharing obligations—or “open banking”—under Section 1033 of the Dodd Frank Act. The Cato Institute is a public policy research organization dedicated to the principles of individual liberty, limited government, free markets, and peace. The Center for Monetary and Financial Alternatives identifies, studies, and promotes alternatives to centralized, bureaucratic, and discretionary financial regulatory systems. The opinions I express here are my own. 

The Bureau must amend the Final Rule to support balanced rules consistent with the language of the Dodd-Frank Act, and to avoid unauthorized, unnecessary, and harmful intervention in financial services markets. The best policy would be for the Bureau to revise the open banking rules to narrow their scope to fiduciaries and/​or to allow data providers to charge commercially reasonable fees, without price regulation.

Question Set 1: The Scope of Who May Make a Request on Behalf of a Consumer 

Question 1. What is the plain meaning of the term “representative?” Does the PFDR Rule’s interpretation of the phrase “representative acting on behalf of an individual” represent the best reading of the statutory language? Why or why not?

Answer 1: The best reading of “representative” limits the term to fiduciaries. Section 1033 of the Dodd-Frank Act requires covered entities to make information relating to transactions between the covered entity and a consumer available to the consumer, in a standardized format. The Act defines consumer as “an individual or an agent, trustee, or representative acting on behalf of an individual.”

The ordinary meaning of “representative” depends on context: it can refer to an elected legislator, a lawyer, a consumer advocate, or a sales consultant. Elsewhere in the Dodd-Frank Act, the terms “legal representative,” and “authorized representative” appear. This might weakly imply that “representative” appearing without qualification has a broader meaning. However, in the context of a list that begins with “agent” and “trustee,” the best reading of “representative” would be to mean someone whose duties parallel those of an agent or a trustee, such as one who holds a power of attorney. This would usually mean a fiduciary. 

As the first open banking laws were introduced in Europe in 2015, it is improbable that the legislators who drafted the Dodd-Frank Act in 2009 understood “representative” to mean “another company providing financial services to the consumer or companies that aggregate data on behalf of such a company.” Such an idea would also have been controversial because of its implications for competition, security, and privacy. Lack of discussion of this issue in 2009 and 2010 suggests that Section 1003 had more limited scope. Furthermore, Congress did not amend the liability rules applicable to situations in which financial institutions share data with third parties; the liability rules in the Gramm-Leach-Bliley Act are designed for a situation in which a financial institution voluntarily agrees to share data with a third party and are ill-suited to situations where the financial institution has no choice. Other countries with broad open banking regimes have revised their liability rules to suit the open banking context. These factors show that the CFPB’s 2024 PFDR got ahead of Congress.

Arguably, extending open banking to nonfiduciaries could benefit consumers by opening the financial sector to more competition and innovation: furthermore, open banking rules would speed the end of screen scraping. However, Congress, not the CFPB, should initiate major changes in financial services policy.