Today, the White House hosted a roundtable on data broker practices that harm consumer privacy, in particular, selling “credit header data,” which can contain sensitive personal information such as name, Social Security number, and date of birth. Simultaneously, the Consumer Financial Protection Bureau (CFPB) announced it will propose new regulations to limit the operations of data brokers under the Fair Credit Reporting Act (FCRA). This move aims to safeguard consumer rights and privacy while bringing data brokers under more stringent control.

Data brokers vacuum up and sell personal information, often without our explicit consent, and sometimes even without our knowledge or awareness. These brokers often rely on data with an unknowable chain of custody, mixing together data from a variety of sources, and often relying on blanket permissions from parties that are not authorized to grant them.

The CFPB’s initiative reinforces the need for high quality data collection practices, in particular, the need to collect purpose and use consent alongside data attributes. Many digital product owners would never consider selling their customer data, but the reality is that personal data often leaks from poorly constructed and monitored APIs.

Internal and external teams often have access to sensitive data over APIs, including marketing and data analytics teams. These new rules further highlight the need to limit customer data exposure with better tooling.

This comes on the heels of the Securities and Exchange Commission (SEC) adopting new rules earlier this month that require companies to disclose cybersecurity incidents on Form 8-K within just four business days.

There’s no question the regulatory cost of mishandling sensitive customer data is increasing.

For most API product teams, the challenge has been they don’t have a good understanding of API misconfigurations; and they can’t control data flow at a granular enough level.

At Contxt, we know that trust starts with discovery. Our first step is always to understand what data actually flows over your APIs.

Once we have established a baseline, we empower you to collect and document the intended purpose of data usage. This aligns with the CFPB's goal of ensuring companies comply with authorized data uses, as specified by the FCRA.

Then, Contxt's capabilities extend beyond data collection and reporting. We enable you to enforce proper usage downstream, ensuring that the data's purpose remains consistent throughout its journey.

To learn more about Contxt's capabilities and how we can help your business prepare for the dynamic regulatory environment, sign up for an account for free.