Analysis
CFPB Files Motion for Summary Judgment in Section 1033 Litigation
On Friday, May 30th, the CFPB filed a motion for summary judgment in Forcht Bank v. CFPB asking the court to vacate the entire rule implementing Section 1033 (Rule). The motion argues that the Rule is unlawful under the Administrative Procedure Act (APA) as it exceeds the agency’s statutory authority and is arbitrary and capricious. The CFPB states that the change in position is the result of the agency’s review of existing rules under Executive Order 14219 to ensure they are based on the best reading of the underlying statute and do not impose undue burdens on small businesses and impede private enterprise.
The CFPB agrees with the plaintiffs that the Rule is unlawful under the APA due to four aspects of the Rule:
1. The Rule unlawfully seeks to regulate open banking by mandating the sharing of data with “authorized third parties,” whereas Section 1033 is limited to ensuring that consumers can access their own data.
The CFPB argues that the Consumer Financial Protection Act (CFPA) does not authorize the agency to broadly regulate open banking by mandating that data providers share information with “authorized third parties.” When promulgating the Rule, the CFPB argued that this approach aligns with the CFPA’s definition of consumer (individual or an agent, trustee, or representative acting on behalf of an individual) notwithstanding using different vocabulary within the Rule (authorized third parties). In this motion, the CFPB now finds that the Rule stretches the definition of “consumer” “past its breaking point” and in particular, the CFPB’s reliance on “representative.” The CFPB’s motion argues that the term “representative” should be read in a similar manner to agent and trustee, yet under the Rule, there is no fiduciary relationship, duty of loyalty or special relationship between a consumer and an authorized third party. “To the contrary, an authorized third party as laid out in the rule is a commercial actor broadly allowed to use data for purposes beyond directly serving the consumer.” The Bureau argues that the agency exceeded its authority when it used the term “representative” as a hook to establish a comprehensive open-banking regulation, instead of adhering to the statutory authority to only make a consumer’s information available to that individual consumer or those who are “actually acting” as agents, trustees, or representatives on that individual’s behalf.
2. The Rule unlawfully prohibits data providers from recovering any fees to offset the burden that the Rule imposes on them.
The CFPB argues that the Rule exceeds the agency’s authority and is contrary to law because Section 1033 does not authorize the Bureau to prohibit banks from charging any fees for maintaining and providing access through the required developer interfaces. Similarly, now the CFPB believes the Rule is arbitrary and capricious because the CFPB failed to engage in reasoned decision making when it determined in a conclusory fashion that permitting data providers to charge any fee – even a reasonable one – would impede consumers’ right to access their data under Section 1033.
When promulgating the Rule, the CFPB justified this prohibition on the grounds that Congress did not authorize fees. In this motion, CFPB argues that it is equally true that Congress did not forbid fees – in other words, the statute is silent on the question of fees. The CFPB recognizes that the agency may have had the authority to prohibit fees in some instances where necessary to prevent evasion, but this Rule exceeds that authority by prohibiting all fees in all instances, no matter how costly the burden. Further, the Bureau failed to justify its reasoning that any fee would burden the right of consumers to obtain their information under Section 1033.
3. The Rule unlawfully places consumer data at risk.
The CFPB believes that the Rule does not comply with the APA’s reasoned decision making requirement because the agency failed to assess the cumulative effects of its individual decisions pertaining to the risks the Rule poses to consumer data as a result of its extensive data-sharing requirements. The CFPB argues that by expanding the scope of Section 1033 to encompass a vast data-sharing framework, the Rule invited greater risk to consumer privacy and data security. Examples of these risks cited by the CFPB include: (1) required disclosure of highly sensitive payment-initiation information; (2) permitting authorized third parties to outsource access to data collection to data aggregators; (3) the “lax” system for assessing and verifying authorized third parties’ security practices; and (4) failure to prohibit screen scraping. According to the motion, the CFPB “never adequately addressed the effect of those choices in combination on the risks to consumers’ sensitive financial data posed by the overall data-sharing framework.” This failure “renders the Rule inadequately justified” as the Rule poses unacceptable risk to the security of consumer data.
4. The Rule unlawfully sets tiered compliance deadlines without accounting for the development of consensus standards that would serve as indicia of compliance with the Rule itself.
Lastly, the Bureau argues that the Rule’s compliance deadlines are arbitrary and capricious because they unreasonably do not account for the development of consensus standards. The Rule acknowledged the possibility that consensus standards would not become available until after the relevant compliance dates. However, the Bureau declined to tie the compliance dates to the establishment of consensus standards.
For the above reasons, the Bureau asks the Court to vacate the entire Rule. In addition, the CFPB argues that the Rule should be vacated because the unlawful portions cannot be severed. The CFPB finds that the references to third parties and the risks to consumer data permeate the entire Rule, and the Court therefore cannot excise the portions of the Rule that are unlawful.
Next Steps
The Financial Technology Association (FTA) successfully intervened in this lawsuit, and it is anticipated that FTA will oppose this motion. After responses from the parties, the court will either grant or deny the CFPB’s motion. If the court grants the motion for summary judgment, the court could grant the motion on all the grounds cited by the CFPB or just some of them. A final summary judgment is appealable.
Some of the aspects of the Rule highlighted in the CFPB’s motion are easier to correct in a future rulemaking than others. For example, the tiered compliance dates and the fee prohibition are seemingly easier to fix. However, if the court grants a motion for summary judgment on the grounds that the Rule is unlawful in the mandating of sharing data with “authorized third parties,” much of the entire open banking framework will be upended. While unclear if or when the CFPB would pursue a future rule, such rule likely would be much narrower in scope and focus only on consumers’ access to data. Any rulemaking could be subject to further litigation as well as Congressional intervention. Further, the industry will continue to evolve. In short, the future of open banking will continue to be unsettled.