United States of America: Adopted Final Rule on Personal Financial Data Rights by Consumer Financial Protection Bureau

On 22 October 2024, the Consumer Financial Protection Bureau (CFPB) adopted the final rule on personal financial data rights. The rule mandates financial institutions to provide consumers with their data in a secure and usable format upon request. The rule provides consumers with the ability to switch to financial services that offer superior rates and services without incurring associated fees. Furthermore, the rule enforces privacy protections, requiring explicit consumer consent for data sharing and establishing mechanisms for revoking consent. The rule prohibits the unauthorised use of data and also prohibits the practice of "screen scraping." It is obligatory for financial providers to comply with the stipulated security and performance standards for data access. The rule applies to a range of financial products, including bank accounts, credit cards and payment apps, with compliance to be achieved in phases based on the size of the financial institution. Those providers classified as larger will be required to comply with the rule by April 2026. In contrast, smaller providers will have until 2030 to comply.