Most Oklahomans will be blissfully unaware of the hidden data economy pervasively documenting their lives without their consent. Swiping their card at a gas station, paying a monthly subscription for their child’s soccer practice or picking up a doctor’s prescription – all these examples represent information that could be floating around unprotected because of loose regulations “guarding” their privacy.
As a treasurer, accountant and consultant for multiple state and national organizations, I have been exposed to the consumer data that is available for purchase. The level of detail that is up for sale on regular Americans who know nothing about it is without question in breach of common-sense privacy expectations.
Section 1033 of the Dodd-Frank Act is currently under review with a rewrite from the Consumer Financial Protection Bureau (CFPB) expected to come. The outcome of this debate will decide how our sensitive financial data will be shared with companies like fintech apps and data aggregators and how safe we can feel that our privacy is protected.
The problem is exacerbated by the regulators we rely on not ensuring our data is protected by all parties who have access to it.
Banks and credit unions on the one hand are subject to strict data protection laws, requiring them to be accountable for how our data is collected, stored and handled. Customers are used to trusting these institutions with their data. There are other companies such as fintech and data aggregators who are not subject to the same data privacy requirements yet still have access to that same financial data.
This issue isn’t some arbitrary mishandling of website cookies showing which shoes you happen to be interested in. This data clearly outlines how you live your life, how often you pick up medical supplies and the intricate workings of the small business you operate.
This data is often picked up through consumers downloading and using payment platforms such as Stripe, Venmo or PayPal. These apps look very much like they are bank-adjacent: they are presented as secure payment methods that help you manage or transfer your money. It isn’t hard to see why regular Americans put their faith in such platforms to the sensitive data in the similar, secure way which we expect from our other financial institutions.
Lengthy terms and conditions sections are hardly common reading for your average person looking to quickly set up a payment to a friend for dinner the other night. Most people simply accept the terms and carry on with their daily lives without giving a second thought to how their information is stored or who it is sold to after the fact.
Permission to handle data, once granted, is often not retractable and the regulations around how it is handled for these big fintech companies doesn’t prohibit them from selling it on to the highest bidder.
As the CFPB considers this ruling, I urge them to establish one uniform security standard for every company with access to consumer financial data. All the companies given the availability to access our data should be charged with handling it properly. The costs associated with that should be part of their responsibility as service providers, and any companies that mishandle this data should be accountable.
A baseline of security across all businesses that have access to or profit from our consumer data will help give consumers confidence that quickly clicking accept on four pages of terms and conditions when downloading an app doesn’t lead to their data being sold to the highest bidder.
About the author: Pam Pollard is a consultant, accountant and treasurer for state and national organizations. She is based in Oklahoma.