Treasury Report on Financial System Recommends Changes Involving Privacy

The U.S. Department of The Treasury issued a July 2018 report under Executive Order 13772 to President Donald J. Trump on A Financial System That Creates Economic Innovation. Among the recommendations for innovation among nonbank financials and FinTech were three that implicated the privacy of Americans:

– A federal data breach notification law that preempts state laws.
– A nationwide digital identity system spanning public and private entities.
– Regulation of data sharing to allow innovation between financial institutions and FinTech.

Privacy was not a stated reason for the report but it will continue to be an issue that interacts with efforts to facilitate economic growth for some time to come. The fact that it was discussed in the report shows what a central issue privacy has become in the United States this year.

Data Breach Law

The report notes that only 13 states have data security standards protecting financial data, and variations in state breach notification laws make compliance difficult. Instead, Treasury recommends that Congress enact a federal data security and breach notification law to protect consumer financial data and notify consumers of a breach in a timely manner. The components of such a law would:

– Protect consumer financial data;
– Ensure technology-neutral and scalable standards based on the entity’s size and activities; and
– Preempt state laws.

Digital Identity System

Treasury supports the adoption of a U.S. government digital identity system and the creation of a public-private partnership to implement it across the economy. According to the report, a nationwide digital identity system could reduce the risk from repeated exposure of Personally Identifiable Information (PII). Ultimately, it could strengthen the global economy by improving trustworthiness, security, privacy and convenience. To facilitate it, Treasury suggests leveraging the NIST guidelines and the REAL ID Act driver’s license regime.

Issues in FinTech Aggregation of Data

Treasury recommended changes in the interaction between consumers, their financial institutions and third-party data aggregators and FinTech applications acting on behalf of consumers. There has been a lot of innovation to allow a consumer access to their data in a useful format, but there remain issues that could benefit from regulation. For example, the report notes that the industry currently uses screen scraping with login credentials, posing cybersecurity and fraud risks. Treasury also suggested the development of consumer disclosures for the industry and a requirement to permit consumers to revoke their consent for access to their financial accounts and transaction data.

Implications for Privacy Regulation

There are going to be a lot of different ideas for the regulation of privacy as Congress beings to debate the language that should be signed into law. Many of the privacy bills in Congress so far have taken a comprehensive approach similar to the European Union’s General Data Protection Regulation (GDPR). However, there remains a lot of specific problems that may need addressed in individual industries. This would complicate the process of getting legislation adopted, but working through these issues during a comprehensive overhaul to privacy protections may ultimately result in a stronger bill and one that is better tailored to the individual problems of industry.

Other Blog Posts on Privacy Laws:

Chicago Considering Personal Data Collection and Protection Ordinance
Vermont Passes Data Broker Law – First in US!
New Mexico Privacy Bill Copies CCPA
New York Considering Privacy Law – Right to Know Act
New PIPEDA Rules for Data Breach Reporting in Canada

Improve Data Privacy for GDPR or CCPA with Clarip

The Clarip team and privacy management software are ready to meet your compliance automation challenges. Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo or speak to a member of the Clarip team.

If compliance with the California Consumer Privacy Act is your focus until 2020, ask us about our CCPA software. Handle automation of data subject access requests with our DSAR Portal, or provide the right to opt out of the sale of personal information with the consent software.

Need to improve your GDPR compliance solution? Clarip offers modular GDPR software that can fill in gaps in your privacy program. Choose from the data mapping software for an automated solution to understanding your data collection and sharing, conduct privacy risk assessments with DPIA software, or choose the cookie consent manager for ePrivacy.

Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo and speak to a member of the Clarip team.