บทถอดความฉบับเต็มของ Your Data, Your Choice? Consumer Rights and Privacy in the Open Banking Debate

00:03:52.000 --> 00:03:57.080 about today that potentially is pro competition pro consumer, and 70 00:03:57.120 --> 00:04:01.039 that's section ten thirty three, which gives to a consumer, 71 00:04:01.120 --> 00:04:07.520 which is defined quite broadly in Dodd Frank, access to 72 00:04:08.199 --> 00:04:11.879 their data. And what that means is that while you 73 00:04:11.960 --> 00:04:16.879 don't have as much competition between financial institutions, you can 74 00:04:16.959 --> 00:04:22.000 have competition between products. So the consumer, because they have 75 00:04:22.079 --> 00:04:26.800 access to their data, is able to unbundle products and 76 00:04:27.560 --> 00:04:31.079 use the information at their bank in order to get 77 00:04:31.120 --> 00:04:35.800 a mortgage or to get a line of credit, or 78 00:04:35.839 --> 00:04:38.439 to transfer funds into a different account. 79 00:04:38.720 --> 00:04:40.680 And this is a very common phenomenon there. 80 00:04:40.800 --> 00:04:46.040 CPB says they're over one hundred million consumers using open 81 00:04:46.120 --> 00:04:49.439 banking now. So this is an essential part of our 82 00:04:49.720 --> 00:04:50.680 financial lives. 83 00:04:50.759 --> 00:04:53.319 If you've used Venmo to. 84 00:04:53.240 --> 00:04:56.839 Pay your babysitter for some other purpose, that is data 85 00:04:56.920 --> 00:05:01.519 that is interacting with your bank account and transferred to 86 00:05:01.959 --> 00:05:06.839 the bank account of the recipient in order to transfer 87 00:05:06.920 --> 00:05:07.639 those funds. 88 00:05:07.800 --> 00:05:10.240 If you're applying for a mortgage. 89 00:05:09.759 --> 00:05:12.240 Now it used to be you had to send in 90 00:05:12.639 --> 00:05:15.920 mortgage statements every three months throughout the process and then 91 00:05:15.920 --> 00:05:16.399 at the end. 92 00:05:16.639 --> 00:05:18.240 Now the mortgage company in many. 93 00:05:18.079 --> 00:05:22.319 Cases has access to that data throughout the life cycle 94 00:05:22.680 --> 00:05:28.759 of that application and loan, which simplifies that that process. 95 00:05:29.399 --> 00:05:33.959 So this provision has been in statute since DoD Frank 96 00:05:34.160 --> 00:05:38.040 and the provision says consumers have this right to their 97 00:05:38.120 --> 00:05:40.279 data subject to rulemaking. 98 00:05:39.759 --> 00:05:42.560 By the Bureau. Well, the Bureau has never put out 99 00:05:43.079 --> 00:05:47.120 a rule until the Biden administration. During the Trump administration, 100 00:05:47.279 --> 00:05:50.959 there was a Treasury Fintech report that said this is 101 00:05:51.040 --> 00:05:56.879 really the lynchpin of fintech, this consumer access right, and 102 00:05:56.920 --> 00:05:59.439 that should be pursued by the CFPB. And then in 103 00:05:59.560 --> 00:06:03.759 Trump on the CFPB put out an advanced notice of 104 00:06:03.839 --> 00:06:06.199 rule making saying, hey, we'd like to get some comments. 105 00:06:06.240

--> 00:06:07.920 We're thinking about doing a rule making. 106 00:06:08.360 --> 00:06:14.000 The Biden administration finalized a rule, there was immediately litigation. 107 00:06:13.920 --> 00:06:18.480 Over that rule and that rule was stayed. 108 00:06:19.439 --> 00:06:24.639 And then the CFPB in Trump too said initially we're 109 00:06:24.680 --> 00:06:28.920 going to do an interim rule, and now they've reportedly said, 110 00:06:28.959 --> 00:06:32.480 according to Bloomberg Law, we're going to do full notice 111 00:06:32.480 --> 00:06:35.920 and comment on a rule making, so we're going to 112 00:06:36.000 --> 00:06:39.360 start kind of the process over again, which means the 113 00:06:39.399 --> 00:06:43.360 implementation of this rule the Biden rotele would have been 114 00:06:43.399 --> 00:06:47.279 implemented in April or mid twenty twenty six, depending on 115 00:06:47.319 --> 00:06:51.360 the type of institution. The finalization and the implementation of 116 00:06:51.399 --> 00:06:55.600 any rule is going to take a while, Probably twenty 117 00:06:55.680 --> 00:06:59.399 six there'll probably be a litigation, so maybe we're looking 118 00:06:59.439 --> 00:07:03.680 at something that so this is we're not at the 119 00:07:03.759 --> 00:07:06.879 end of this process. We're probably at the seventh or 120 00:07:06.920 --> 00:07:12.040 seventh or eighth inning. So sorry for the extended monologue 121 00:07:12.120 --> 00:07:14.560 to start out the procedural history, but it's it's not 122 00:07:14.680 --> 00:07:17.560 quite a simple procedural history, but I think that's a 123 00:07:17.600 --> 00:07:18.959 fair statement of where we are now. 124 00:07:20.000 --> 00:07:25.639 Cleuly, well, thank you, Professor Zawiki. Given the history that 125 00:07:26.319 --> 00:07:30.399 Paul so Pitholi put together there for us, what do 126 00:07:30.439 --> 00:07:33.279 you think is the major issues at stake here as 127 00:07:33.720 --> 00:07:38.639 CFPB looks to finalize rulemaking around ten thirty three, and 128 00:07:38.639 --> 00:07:40.480 who would be some of the winners and losers of 129 00:07:40.519 --> 00:07:42.040 the different directions that they might go. 130 00:07:42.639 --> 00:07:45.759 So in the a NPR that the CFPD put out, 131 00:07:46.560 --> 00:07:50.800 they identified four questions that they were really seeking information on, 132 00:07:51.759 --> 00:07:55.199 which is, who's a representative, how should costs be assessed, 133 00:07:55.600 --> 00:08:00.120 how should they process concerns about data security? And how 134 00:08:00.160 --> 00:08:03.920 should they process up data security with respect to the 135 00:08:04.000 --> 00:08:07.199 to the companies really, and then data privacy with respect 136 00:08:07.199 --> 00:08:11.319 to consumers. That consumers more or less are getting their 137 00:08:11.319 --> 00:08:15.800 information used for things that they wanted to and not so. 138 00:08:16.319 --> 00:08:18.759 As Paul said, this

is new, but in some sense 139 00:08:18.839 --> 00:08:23.720 what is going on here years old information is what 140 00:08:23.920 --> 00:08:27.720 consumer finance is all about. Joseph Stiglitz won the Nobel 141 00:08:27.800 --> 00:08:30.519 Prize for, among other reasons, for pointing out the idea 142 00:08:30.560 --> 00:08:35.840 of asymmetric information in consumer credit markets. And what we 143 00:08:35.879 --> 00:08:41.879 saw historically was that banks, your incumbent provider, basically knew 144 00:08:41.879 --> 00:08:45.080 more about you than any other provider, right they had 145 00:08:45.080 --> 00:08:47.200 a relationship with you. They knew if the how much 146 00:08:47.279 --> 00:08:49.080 was in your checking account, they knew if you were 147 00:08:49.080 --> 00:08:51.960 paying your bills, that sort of thing. And so basically 148 00:08:52.039 --> 00:08:55.559 what that did was it gave an advantage to whoever 149 00:08:55.600 --> 00:09:00.759 your current bank was what came along because other banks 150 00:09:00.799 --> 00:09:02.799 would wonder, well, why don't you just get a loan 151 00:09:02.840 --> 00:09:04.440 from that guy, Why do you got to come to us? 152 00:09:04.960 --> 00:09:07.240 And so this is what we called the adverse selection 153 00:09:07.480 --> 00:09:11.080 problem as well as the information asymmetry problem. So what 154 00:09:11.159 --> 00:09:15.559 happened over time was we saw information sharing arise. We 155 00:09:15.600 --> 00:09:18.200 call them credit bureaus right, and we call it FIKO. 156 00:09:18.320 --> 00:09:22.240 And basically what happened was creditors were able to share 157 00:09:22.279 --> 00:09:29.879 information about consumers that provided enough information for other banks 158 00:09:30.440 --> 00:09:32.360 to be willing to take a chance, right to be 159 00:09:32.440 --> 00:09:35.120 willing to lend you money because that now all the 160 00:09:35.159 --> 00:09:37.799 information wasn't just contained in the hands of whichever bank 161 00:09:37.840 --> 00:09:39.320 happened to be the bank that you had to have 162 00:09:39.440 --> 00:09:41.879 to have. But in those old days, what we saw was, 163 00:09:41.919 --> 00:09:45.840 because of that advantage that bank had, financial services tend 164 00:09:45.879 --> 00:09:48.159 to be bundled. You tend to get everything from your 165 00:09:48.159 --> 00:09:51.559 same bank, whether it was the local credit union where 166 00:09:51.600 --> 00:09:53.360 you get your car loan and your mortgage, or the 167 00:09:53.360 --> 00:09:56.480 big bank or whatever. What we've seen, as Paul talked about, 168 00:09:56.639 --> 00:10:02.559 is over time, now technologies allow us to unbund those services, 169 00:10:02.840 --> 00:10:05.240 so consumers can get a savings account here, and a 170 00:10:05.240 --> 00:10:07.960 credit card there, and a personal loan there, and a 171 00:10:07.960 --> 00:10:11.639 car loan there all these different things that people have, 172 00:10:12.000 --> 00:10:16.360 but the information problem is still there. FICO is a 173 00:10:16.399 --> 00:10:19.200 way of getting around that, but it doesn't do everything. 174 00:10:19.519 --> 00:10:22.120 That's the opportunity we have with this ten thirty three 175 00:10:22.200 --> 00:10:25.679 rule making is to kind of supercharge that flow of 176 00:10:25.759 --> 00:10:30.399 information where consumers can use that information to power them 177 00:10:30.440 --> 00:10:35.120 to get more competition, more choice, lower prices, more inclusion 178 00:10:35.919 --> 00:10:39.480 in the light. So the key part of this thing 179 00:10:39.559 --> 00:10:42.639 turns on this question of who can get access to 180 00:10:42.679 --> 00:10:48.639 the information. What they call the representative issue becausesent in 181 00:10:48.720 --> 00:10:52.039 dot brank, consumers defined as an agent, trustee, or a 182 00:10:52.159 --> 00:10:56.480 representative of the consumer. And so the question is how 183 00:10:56.519 --> 00:11:00.440 broad is that? Now I'm going to leave aside what 184 00:11:00.559 --> 00:11:03.559 is you know, Paul mentioned that there will probably be litigation. 185 00:11:03.799 --> 00:11:06.759 I think call she could probably post a you know, 186 00:11:06.960 --> 00:11:10.279 ninety nine percent likelihood. The only question will be how 187 00:11:10.279 --> 00:11:15.360 many litigations will be will be filed on this. But 188 00:11:15.639 --> 00:11:17.039 one of the big issues is going to be the 189 00:11:17.039 --> 00:11:22.759 definition of representative. Whatever they decide as a representative, one 190 00:11:22.799 --> 00:11:24.919 side or the other or both sides are going to sue. 191 00:11:25.000 --> 00:11:31.399 Right the data you know, data companies, fintech companies, they're 192 00:11:31.440 --> 00:11:34.440 going to want to have representative find very broadly so 193 00:11:34.480 --> 00:11:37.039 that they can act on behalf of the consumer. Banks 194 00:11:37.080 --> 00:11:39.919 are arguing that it's very narrow so that's really only 195 00:11:40.000 --> 00:11:41.679 the consumer can do it. I'm not going to pick 196 00:11:41.759 --> 00:11:44.200 sides in that. I'm going to talk more about the 197 00:11:44.279 --> 00:11:47.360 larger questions and the larger policy questions and how we 198 00:11:47.399 --> 00:11:51.480 can we can think about this. Right now, let's start 199 00:11:51.519 --> 00:11:54.200 up with the first question, which is whose data is 200 00:11:54.240 --> 00:11:56.519 that which you mentioned in the beginning, Will, And I 201 00:11:56.559 --> 00:11:59.200 think that's how we traditionally thought of this, but I 202 00:11:59.200 --> 00:12:01.799 think that's the wrong way to think about this. The 203 00:12:01.879 --> 00:12:06.799 reality is this information called data, call it information is 204 00:12:06.919 --> 00:12:11.919 jointly produced by both consumers and the companies. And I think,

really, 205 00:12:12.559 --> 00:12:16.080 you know, and so there's three principles that should guide this. First, 206 00:12:16.519 --> 00:12:20.639 recognizing that the information is jointly produced, it's not produced. 207 00:12:20.720 --> 00:12:24.720 It's not just the consumer, it's not just the company. Second, 208 00:12:25.279 --> 00:12:29.559 producing information is useful only if it can be transmitted, leveraged, 209 00:12:29.720 --> 00:12:32.720 used by consumers at low cost or what we call 210 00:12:32.759 --> 00:12:37.080 low transaction cost and law and economics to improve consumer welfare. 211 00:12:37.440 --> 00:12:42.679 And the third is who owns the data? Who it 212 00:12:42.720 --> 00:12:47.120 belongs to is less important for most consumers than how 213 00:12:47.159 --> 00:12:50.960 it is to be used, right, And what consumers want 214 00:12:51.159 --> 00:12:53.960 is the data to be used generally for things that 215 00:12:54.000 --> 00:12:58.799 benefit them, but not misused for things that that hurt them. Right. 216 00:12:59.120 --> 00:13:01.679 So let's unpack to those things a little bit. It's 217 00:13:01.679 --> 00:13:04.440 take a good example, an old example of the idea 218 00:13:04.480 --> 00:13:08.039 that consumers don't own their data pub aut credit reporting 219 00:13:08.360 --> 00:13:12.799 exactly where I started, Right, The consumer doesn't own their 220 00:13:13.240 --> 00:13:16.519 information about whether they pay their bills or not. Right. 221 00:13:16.759 --> 00:13:22.159 We have a massive credit reporting system where furnishures, creditors 222 00:13:22.519 --> 00:13:27.519 report to a centralized database as to whether you're paying 223 00:13:27.519 --> 00:13:31.039 your bills or not. Right. That is a miracle. That 224 00:13:31.120 --> 00:13:33.360 system is a miracle. I mean you think about the 225 00:13:33.399 --> 00:13:36.799 fact you could walk into a car dealership right now 226 00:13:36.919 --> 00:13:40.879 and walk out later with a car and it's seventy 227 00:13:40.919 --> 00:13:44.679 thousand dollars loan. Right, simply because of the miracle of 228 00:13:44.679 --> 00:13:48.879 instant credit, which is driven by this comprehensive credit system 229 00:13:49.399 --> 00:13:52.720 that we have. Why do we have that? Because consumers 230 00:13:53.240 --> 00:13:56.759 aren't the only exclusive owners of their information, right it. 231 00:13:56.799 --> 00:13:59.799 It's used by other creditors. And if a consumer can 232 00:14:00.159 --> 00:14:02.480 rolled their information, they would say, Okay, you can only 233 00:14:02.519 --> 00:14:05.600 report good stuff, not bad stuff, right, which is not 234 00:14:05.639 --> 00:14:08.600 a system that works. And so what we want is 235 00:14:08.799 --> 00:14:12.559 a system where the information could be used well. It 236 00:14:12.559 --> 00:14:15.759 can be used to benefit all consumers, to growe competition 237 00:14:15.840 --> 00:14:19.279 and the like. And sometimes that means recognizing that there's 238 00:14:19.320 --> 00:14:21.720 a joint production and the joint way that the different 239 00:14:21.720 --> 00:14:26.399 parties can use this information. And we've seen that going 240 00:14:26.399 --> 00:14:28.759 all the way back on credit reporting, and that's how 241 00:14:28.759 --> 00:14:30.960 we got out of this box of people being trapped 242 00:14:31.000 --> 00:14:35.039 with their current banks. Right. The second thing is that 243 00:14:35.039 --> 00:14:37.440 we have to make it easy for consumers to be 244 00:14:37.480 --> 00:14:41.200 able to use it. Again leaving aside the legal issue, 245 00:14:41.200 --> 00:14:43.279 but if the idea is is that the consumer has 246 00:14:43.360 --> 00:14:46.440 to go in and get it and download it and 247 00:14:46.480 --> 00:14:49.960 take it to shop around on their own, that's not 248 00:14:50.039 --> 00:14:53.919 really very helpful, right. And this is why consumers have 249 00:14:54.519 --> 00:14:57.960 had these gotten these data data aggregators, why they turn 250 00:14:58.039 --> 00:15:01.159 to fintech companies is Paul said, I think you said 251 00:15:01.159 --> 00:15:04.360 one hundred million consumers or something, right. People use these 252 00:15:04.399 --> 00:15:07.200 things all the time. They provide value. Consumers want to 253 00:15:07.240 --> 00:15:09.519 have these, which is we want to come back to 254 00:15:10.039 --> 00:15:12.840 the third point is is what consumers really care about, 255 00:15:12.879 --> 00:15:15.440 I think is how their data is used in particularly 256 00:15:15.879 --> 00:15:19.519 misuse of data. Think about those reams and reams of 257 00:15:20.120 --> 00:15:23.919 gram Leach blily notices you get every spring, right, could 258 00:15:23.960 --> 00:15:27.159 you imagine sitting down and reading every gram Leach Blidly 259 00:15:27.840 --> 00:15:32.519 report you get from every financial institution. One estimate was 260 00:15:32.600 --> 00:15:36.480 that if consumers read all of the privacy policies of 261 00:15:37.840 --> 00:15:40.120 things they interact with, it would take two hundred and 262 00:15:40.200 --> 00:15:44.960 forty four hours, ten days of straight reading without sleep, 263 00:15:45.639 --> 00:15:48.879 just to read all of the privacy policies of everything 264 00:15:48.919 --> 00:15:52.639 you have. Right, people aren't reading them right. People don't 265 00:15:52.759 --> 00:15:57.000 care really whose data is, they care how it's being used. 266 00:15:57.080 --> 00:15:59.799 They just don't want it to be misused. And so 267 00:15:59.840 --> 00:16:03.320 I would say that's what the focus that should should 268 00:16:03.360 --> 00:16:05.360 should be on here. So what does this mean? I 269 00:16:05.360 --> 00:16:09.080 think this means that in general, we want to err 270 00:16:09.159 --> 00:16:12.720 on the side of defining representative and consumer as broadly 271 00:16:12.799 -->

00:16:16.039 as possible, subject to the other concerns we have data 272 00:16:16.080 --> 00:16:19.039 security and data privacy, but as a policy matter, I 273 00:16:19.080 --> 00:16:20.639 think we want to have it be as broad as 274 00:16:20.720 --> 00:16:25.519 possible to also allow flexibility for new things that consumers 275 00:16:25.559 --> 00:16:27.960 might want to do with it, new entities that might 276 00:16:27.960 --> 00:16:31.799 come along. In the twenty eighteen during Trump won twenty 277 00:16:31.840 --> 00:16:35.799 eighteen Treasury report endorsed this idea of a broad definition 278 00:16:35.879 --> 00:16:40.960 of information. And one thing I've other to say is, 279 00:16:41.240 --> 00:16:44.240 it's not just financial benefits. I learned, as I've learned 280 00:16:44.240 --> 00:16:49.120 over time, here's a fascinating thing that the ability to 281 00:16:49.200 --> 00:16:55.080 pull together and aggregate information is fascinating. It turns out 282 00:16:55.679 --> 00:17:01.919 that monitoring an elderly person's financial affairs can actually predict 283 00:17:02.600 --> 00:17:09.000 dementia better than a doctor that noticing irregularities and changes 284 00:17:09.119 --> 00:17:13.440 in people's payments, shopping and other financial behaviors which can 285 00:17:13.480 --> 00:17:16.039 be drawn from pulling from a variety of different sources. 286 00:17:16.400 --> 00:17:18.920 And there's actually things you can do now where you 287 00:17:18.960 --> 00:17:22.519 can set up your your elderly parents through one of 288 00:17:22.559 --> 00:17:26.000 these systems that will monitor their finances and give you 289 00:17:26.039 --> 00:17:28.880 a red flag if they're starting exhibit signs of dementia. Right, 290 00:17:29.039 --> 00:17:31.640 I mean, this information is incredibly powerful, not just for 291 00:17:31.680 --> 00:17:35.000 a financial purpose. Right. The second thing is the cost, 292 00:17:35.079 --> 00:17:37.519 And this is where a lot of the frictions are 293 00:17:37.559 --> 00:17:41.160 going to be right. And so the first thing is 294 00:17:41.279 --> 00:17:45.200 dot frank and you know does not require any institution 295 00:17:45.440 --> 00:17:49.240 to collect and hold any particular body of data. Right, 296 00:17:49.480 --> 00:17:52.240 So that is whatever they whatever they do whatever they're 297 00:17:52.240 --> 00:17:56.480 required to do. This only relates to how who they 298 00:17:56.519 --> 00:17:58.640 make it available to and how they want to make 299 00:17:58.640 --> 00:18:02.559 it available. Right, So, as the a MPR specifically and 300 00:18:02.640 --> 00:18:04.599 correctly notes, what we really want to know is what 301 00:18:04.680 --> 00:18:08.839 is the marginal cost of providing access to this not 302 00:18:08.960 --> 00:18:12.400 but not the total cost. Right in the same way 303 00:18:12.480 --> 00:18:15.000 that as you were talking about earlier, in credit reporting, 304 00:18:15.759 --> 00:18:20.720 creditors furnishers already collect data, then they share even though 305 00:18:20.720 --> 00:18:22.720 there's a cost to them, they basically share it for 306 00:18:22.759 --> 00:18:25.519 free with the credit reporting agencies in order to make 307 00:18:25.519 --> 00:18:30.559 the system work better. Right now, you might just say, well, 308 00:18:30.640 --> 00:18:33.920 let them bargain over it. Well, we already tried that 309 00:18:34.559 --> 00:18:36.920 and it didn't work out very well, which is when 310 00:18:36.960 --> 00:18:40.000 the CFDb originally said they were basically going to get 311 00:18:40.119 --> 00:18:43.519 rid of it. Reportedly, although I don't know if it's 312 00:18:43.559 --> 00:18:48.880 been confirmed. Reportedly, Chase alone, Chase Bank alone told Plaid 313 00:18:49.039 --> 00:18:51.720 alone that they were going to demand three hundred million 314 00:18:51.839 --> 00:18:56.680 dollars in fees for Plaid to access Chase system, which 315 00:18:56.720 --> 00:19:00.480 is about seventy five percent of plaids revenue for twenty 316 00:19:00.519 --> 00:19:06.240 twenty four. Right, that's one bank and one data aggregating 317 00:19:06.839 --> 00:19:10.000 company right now, multiply that across. And so what I 318 00:19:10.039 --> 00:19:14.079 think we see here is the contracting doesn't work. And 319 00:19:14.359 --> 00:19:17.440 my personal view this is sort of ad hoc, this 320 00:19:17.559 --> 00:19:20.599 is not proven, But I think the big banks have 321 00:19:20.640 --> 00:19:24.519 a control over data here that gives them essentially a 322 00:19:24.559 --> 00:19:27.480 monopoly power, and they have an incentive to try to 323 00:19:28.000 --> 00:19:32.400 charge extract very high fees. They have an incentive to 324 00:19:32.400 --> 00:19:38.240 make their systems incompatible and basically keep consumers, keep consumers trapped. 325 00:19:38.279 --> 00:19:41.279 And so I think allowing just a contract like that 326 00:19:41.720 --> 00:19:43.319 is going to lead to this kind of hold up 327 00:19:43.319 --> 00:19:45.039 behavior and that sort of thing. And so I think 328 00:19:45.319 --> 00:19:50.599 there is a role here for some sort of government 329 00:19:50.799 --> 00:19:54.519 control over price. That gives me heartburn just to say it, 330 00:19:55.039 --> 00:19:58.400 but and I might be less enthusiastic about that if 331 00:19:58.400 --> 00:20:01.200 I hadn't seen what already happen when we tried it 332 00:20:02.079 --> 00:20:04.640 without that. Right, the last thing I'll say on data 333 00:20:04.680 --> 00:20:09.960 security and data privacy is consumers obviously want this, right, 334 00:20:10.160 --> 00:20:14.079 Consumers want this, and nowadays, when we don't have a 335 00:20:14.119 --> 00:20:16.640 system for doing it, consumers have come up with workarounds, 336 00:20:16.680 --> 00:20:20.200 these screen scrapers and things like that. Right, this isn't 337 00:20:20.240 --> 00:20:25.359

cause a lot of cost, They're not super secure from 338 00:20:25.359 --> 00:20:27.599 what I can tell, the idea here is is let's 339 00:20:27.599 --> 00:20:30.200 create a low cost, low friction system that's also more 340 00:20:30.240 --> 00:20:32.480 secure than what we have. And so if you try 341 00:20:32.519 --> 00:20:34.480 to lock this down too tight and you make it 342 00:20:34.480 --> 00:20:37.119 too difficult to do this, I'll tell you exactly what's 343 00:20:37.160 --> 00:20:40.799 going to happen. Consumers are going to want to want workarounds, right, 344 00:20:41.079 --> 00:20:43.119 and what we could very well end up with is 345 00:20:43.160 --> 00:20:45.720 if we don't make this flexible enough, if we don't 346 00:20:45.759 --> 00:20:49.640 make this information available at reasonable cost to consumers so 347 00:20:49.720 --> 00:20:52.119 they can use it for their benefits, people are going 348 00:20:52.200 --> 00:20:54.480 to come up with workarounds that could very well be 349 00:20:54.640 --> 00:20:59.119 less secure. Screen scraping was a workaround the system we 350 00:20:59.200 --> 00:21:03.960 had would say be much better if we would deal 351 00:21:04.039 --> 00:21:08.279 with if we were just recognize this has value to consumers, 352 00:21:08.559 --> 00:21:12.400 recognize the way this market works. The final thing I'll 353 00:21:12.400 --> 00:21:15.359 say is on data privacy for consumers. As I said, 354 00:21:15.759 --> 00:21:19.279 I don't think this old model of pretending like consumers 355 00:21:19.319 --> 00:21:23.000 are read and consent to everything that they're signing and 356 00:21:23.079 --> 00:21:26.359 understand everything that does doesn't seem to be a system 357 00:21:26.480 --> 00:21:28.960 that's that's realistic. Right. Every time I go to a 358 00:21:28.960 --> 00:21:32.160 website and I get that pop up about this website 359 00:21:32.240 --> 00:21:34.880 uses cookies. All I think to myself is, if I 360 00:21:34.920 --> 00:21:37.440 ever meet the guy who designed that, and we end 361 00:21:37.519 --> 00:21:40.200 up we meet in a dark alley somewhere, only one 362 00:21:40.240 --> 00:21:43.359 of us is coming out alive, right, because everybody knows 363 00:21:43.400 --> 00:21:46.240 that's ridiculous. Everybody knows you don't read it. The data 364 00:21:46.279 --> 00:21:48.240 show everybody doesn't read it. So I think what we 365 00:21:48.319 --> 00:21:51.599 want to have is a system that police is misuse, 366 00:21:52.000 --> 00:21:55.440 that puts fences around that limits, you know, sort of 367 00:21:55.440 --> 00:21:58.519 what decisions consumers have to make, but at the same 368 00:21:58.559 --> 00:22:03.599 time allows this to be fluid, allows it to be secure, 369 00:22:03.839 --> 00:22:04.880 allows it be low cost. 370 00:22:04.960 --> 00:22:08.720 Thanksfesser, I'll tell you I think good news for you 371 00:22:08.839 --> 00:22:11.599 and the guy you're going to beat up in the alleys. 372 00:22:11.599 --> 00:22:14.480 I'm pretty sure that guy's in Europe somewhere, so because 373 00:22:14.480 --> 00:22:18.440 that's certainly a case unfortunately of European regulations being here 374 00:22:18.440 --> 00:22:19.200 in the United States. 375 00:22:19.319 --> 00:22:19.799 Exactly. 376 00:22:20.799 --> 00:22:23.759 So you actually jumped far ahead. I'm going through the 377 00:22:23.839 --> 00:22:25.920 questions I had, and you covered so much there, So 378 00:22:26.039 --> 00:22:28.359 let me make sure that I get us onto a 379 00:22:28.400 --> 00:22:30.480 topic that's still at the leading edge of the conversation. 380 00:22:31.039 --> 00:22:35.920 But for Paul moving over, you know, the professor just 381 00:22:35.960 --> 00:22:39.599 sort of introduced the concept of these fees being sort 382 00:22:39.599 --> 00:22:42.119 of one of the leading edge questions of Rule ten 383 00:22:42.200 --> 00:22:44.799 thirty three and how it's going to be enforced or 384 00:22:44.839 --> 00:22:46.880 how the rule is going to is going to come out. 385 00:22:46.920 --> 00:22:50.960 My understanding is historically the banks have not been charging 386 00:22:51.039 --> 00:22:55.480 fees post the passage of Dodd frank in ten thirty three. 387 00:22:55.880 --> 00:22:59.559 More recently that used the argument, I won't call it 388 00:22:59.599 --> 00:23:02.720 an excu use. Well, for the sake of this discussion, 389 00:23:02.920 --> 00:23:06.200 will say they're completely right that in order to avoid 390 00:23:06.359 --> 00:23:10.680 people scraping data that they thought was a screen scraping, 391 00:23:10.720 --> 00:23:14.000 which for those who are that's a term of art 392 00:23:14.640 --> 00:23:17.519 for folks. That's when you have a third party program 393 00:23:17.519 --> 00:23:20.400 you give your log in credentials to. Because there is 394 00:23:20.440 --> 00:23:24.039 no API, there's no interface directly for Plaid or Mint 395 00:23:24.440 --> 00:23:26.920 or Calci or any of these other third party services 396 00:23:27.160 --> 00:23:30.599 to directly log in to the back end of a 397 00:23:30.640 --> 00:23:33.119 banking website. They log in through the front end the 398 00:23:33.119 --> 00:23:36.200 same way a retail user would log in, and then 399 00:23:36.240 --> 00:23:38.759 they use an AI system or an algorithm to simply 400 00:23:38.799 --> 00:23:42.119 scrape the information that they're looking for to confirm your 401 00:23:42.160 --> 00:23:45.720 account balance or whatnot. And this is the way that 402 00:23:45.799 --> 00:23:49.039 a lot of third party services were getting access to 403 00:23:49.079 --> 00:23:52.720 the data that they didn't have a right to, but 404 00:23:52.759 --> 00:23:56.519 the retail consumer had a right to share with them 405 00:23:56.960 --> 00:24:00.480 under ten thirty three. Seeing the issues with that, the 406 00:24:00.640 --> 00:24:07.240 banks created back end processes that allowed companies like

Kelsey 407 00:24:07.359 --> 00:24:11.920 and Plaid and Meant to interact directly computer to computer 408 00:24:12.480 --> 00:24:15.519 without the go between of sort of this visual data scraping, 409 00:24:15.519 --> 00:24:19.400 and that allowed for a lot more consumer protection around 410 00:24:19.400 --> 00:24:23.480 security and privacy. That said, they are now using that 411 00:24:24.440 --> 00:24:27.759 to some extent to argue why they should be allowed 412 00:24:27.759 --> 00:24:32.359 to charge access fees. To what extent, Paul, do you 413 00:24:32.480 --> 00:24:35.480 find that to be a coherent or good argument for 414 00:24:35.519 --> 00:24:38.960 them recovering costs. Certainly there must be some costs associated 415 00:24:39.000 --> 00:24:41.480 with that kind of thing, But to what extent are 416 00:24:41.559 --> 00:24:44.799 those good arguments? Or is this something that we don't 417 00:24:44.880 --> 00:24:47.519 let banks charge, like a user fee for people when 418 00:24:47.519 --> 00:24:50.400 they come in to a bank and a wheelchair, even 419 00:24:50.440 --> 00:24:53.599 though they are costs associated with conforming to the American 420 00:24:53.680 --> 00:24:58.119 with Disabilities Act. We simply made certain decisions around physical 421 00:24:58.160 --> 00:25:01.799 fair access that or the bank itself is going to 422 00:25:01.839 --> 00:25:04.519 subsidize everyone being able to get in and out of 423 00:25:04.559 --> 00:25:07.359 the bank. Is this similar to that type of situation 424 00:25:07.400 --> 00:25:09.599 where we simply say, hey, part of running a bank 425 00:25:09.920 --> 00:25:14.039 is running a server that allows third parties good easy access, 426 00:25:14.079 --> 00:25:17.799 secure access, private privacy based access. Or is there an 427 00:25:17.880 --> 00:25:19.839 argument that they should be able to recoup some of 428 00:25:19.880 --> 00:25:22.200 these costs because this is sort of an extraordinary service 429 00:25:22.240 --> 00:25:24.960 or something that we want them to compete on, you know, 430 00:25:25.079 --> 00:25:27.440 like how many tellers they have at the front of 431 00:25:27.480 --> 00:25:29.559 a bank or something like that. What would you say 432 00:25:29.599 --> 00:25:29.799 to that. 433 00:25:30.599 --> 00:25:33.440 Yeah, So I think this is something that the Bureau 434 00:25:33.480 --> 00:25:39.599 will probably address in rulemaking, and if it's litigated, I 435 00:25:39.599 --> 00:25:42.640 think it goes back to some of the statutory terms 436 00:25:42.720 --> 00:25:48.599 that Professor Zuwiki mentioned. So the ten thirty three doesn't 437 00:25:48.680 --> 00:25:54.880 say anything about fees, and what it says is information 438 00:25:55.440 --> 00:25:59.519 is shall be made available to the consumer upon request. 439 00:26:00.400 --> 00:26:03.920 So if you're the bank, you read that as upon 440 00:26:04.039 --> 00:26:07.519 request plus some money, And if you're the consumer or 441 00:26:07.559 --> 00:26:10.359 the fintech, you say, well, it just says upon request. 442 00:26:10.480 --> 00:26:12.440 So this is just something that you need to do 443 00:26:12.599 --> 00:26:15.240 as part of a bank will as you are indicating. 444 00:26:15.319 --> 00:26:19.440 Dodd Frank adds all kinds of costs to operating a bank. 445 00:26:20.039 --> 00:26:22.279 This is one of them. Unlike some of the other 446 00:26:22.319 --> 00:26:23.759 costs in DoD for rank. 447 00:26:23.839 --> 00:26:27.440 There's a very good argument that this one is pro competitive, 448 00:26:29.119 --> 00:26:34.880 and so that's the extent I would say of what 449 00:26:34.960 --> 00:26:38.839 the statute says about the fee. This also gets into 450 00:26:38.920 --> 00:26:42.720 the one of the other issues that Professor Zuiki mentioned, 451 00:26:42.799 --> 00:26:45.720 which is the definition of consumer. And if you look 452 00:26:45.799 --> 00:26:51.240 up the statutory definition of consumer, it says trustee, agent 453 00:26:52.160 --> 00:26:57.000 or representative. And so from the fintech and I think 454 00:26:57.039 --> 00:27:02.400 the consumer perspective, you would say, well, a representative is 455 00:27:02.720 --> 00:27:06.480 somebody that I authorize to access my data. If you 456 00:27:06.480 --> 00:27:09.880 look at the bank comments, they say, well, a trustee 457 00:27:10.039 --> 00:27:13.240 and an agent both have some kind of fiduciary relationship, 458 00:27:13.519 --> 00:27:16.440 and so we read representative to also. 459 00:27:16.200 --> 00:27:18.359 Require a fiduciary relationship. 460 00:27:18.440 --> 00:27:21.000 Of course, the response to that is, well, what's a 461 00:27:21.079 --> 00:27:25.839 representative with a fiduciary relationship that's not an agent. So 462 00:27:25.880 --> 00:27:29.559 now the terms are redundant. So this is really one 463 00:27:29.640 --> 00:27:35.519 of those fascinating statutory interpretation questions that if Justice Scalia 464 00:27:35.559 --> 00:27:37.960 we're still on the court and this goes up to him, 465 00:27:37.960 --> 00:27:41.480 you might get a really fantastic opinion. There are lots 466 00:27:41.519 --> 00:27:45.680 of Justice Scalia disciples on the appellate Court, so maybe 467 00:27:45.680 --> 00:27:48.680 we'll get something similar there, But I think the best 468 00:27:48.759 --> 00:27:52.359 reading is going to be that representative has to mean 469 00:27:52.440 --> 00:27:56.519 something different than agent. So I don't think it's going 470 00:27:56.599 --> 00:27:58.359 to have to it's going to require that level of 471 00:27:58.400 --> 00:28:03.240 fiduciary relationship. It's going to requires something. But the consent 472 00:28:03.359 --> 00:28:07.000 that you provide as a consumer I think is probably 473 00:28:07.000 --> 00:28:12.440 going to be sufficient based on the statutory language. And 474 00:28:12.480 --> 00:28:16.440 then also the last sentence in the first section of

475 00:28:16.519 --> 00:28:19.640 Section A, which is the information shall be made available 476 00:28:19.680 --> 00:28:23.759 in an electronic form usable by consumers. Well, if you're 477 00:28:23.839 --> 00:28:28.200 charging a fee that's three quarters of the provider's revenue, 478 00:28:28.720 --> 00:28:32.799 that's not usable. If you're just allowing the consumer to 479 00:28:32.880 --> 00:28:37.559 download some kind of spreadsheet, that's not usable. So that 480 00:28:37.960 --> 00:28:42.559 sentence is going to require, I think, a broader definition 481 00:28:42.720 --> 00:28:46.160 of the term representative, and it's also going to inform 482 00:28:46.319 --> 00:28:51.160 a lot of the other discussions around fees and security 483 00:28:51.240 --> 00:28:55.359 and quantities of information, which on the bank side, they're 484 00:28:55.359 --> 00:28:58.119 going to try to restrict every one of those, I think, 485 00:28:58.200 --> 00:29:03.799 to make the product as uncompetitive as possible again so 486 00:29:03.920 --> 00:29:06.680 folks can stay in this walled garden. And then the 487 00:29:06.680 --> 00:29:09.119 consumer fintech side, of course, is going to try to 488 00:29:09.160 --> 00:29:13.640 be expansive to make the products as competitive as possible. 489 00:29:15.079 --> 00:29:18.599 Thank you, professor. I have a follow up question you 490 00:29:18.720 --> 00:29:24.200 mentioned the obviously it gives you heartburn to say that 491 00:29:24.359 --> 00:29:27.359 letting the banks compete amongst themselves for the you know, 492 00:29:27.519 --> 00:29:29.359 being able to provide serve of Hey, you know, we 493 00:29:29.400 --> 00:29:31.519 interact with plaid the best, or we interact with ment 494 00:29:31.559 --> 00:29:36.039 the best. When that has been tested, what's actually turned 495 00:29:36.039 --> 00:29:37.920 out is that they use the fees it would appear 496 00:29:38.400 --> 00:29:41.480 to put up walls. They obviously can't say you can't 497 00:29:41.480 --> 00:29:44.960 have the information, but they can charge a toll that's 498 00:29:45.000 --> 00:29:48.240 so high that effectively they've cut off the road to 499 00:29:48.279 --> 00:29:52.240 what extent. You know, I know somebody who's passionate like 500 00:29:52.279 --> 00:29:55.799 you about the idea of free markets operating well. To 501 00:29:55.880 --> 00:29:59.480 what extent is DoD franketself responsible for that in the 502 00:29:59.559 --> 00:30:02.759 sense that and Paul hinted at this a little bit 503 00:30:02.759 --> 00:30:05.039 at the beginning that after the pass of Dodd Frank, 504 00:30:05.599 --> 00:30:09.359 the entrance of new banks into the industry as competition 505 00:30:09.480 --> 00:30:13.200 basically slowed to a trickle or non Do you think 506 00:30:13.200 --> 00:30:16.440 that that's the core fundamental problem that the existing large banks. 507 00:30:16.480 --> 00:30:18.960 I think the top five make up something like forty 508 00:30:19.039 --> 00:30:21.839 or forty five percent of bank service market share in 509 00:30:21.880 --> 00:30:23.519 the United States, which I think this is the highest 510 00:30:23.759 --> 00:30:27.359 market concentration we've ever seen. Do you think that's part 511 00:30:27.400 --> 00:30:29.440 of the problem or do you think it's just inherent 512 00:30:29.960 --> 00:30:35.119 in this question of information sharing that each bank, because 513 00:30:35.119 --> 00:30:37.720 they want to force you into this bundled services package, 514 00:30:37.759 --> 00:30:39.079 is going to put up walls. So even if we 515 00:30:39.160 --> 00:30:44.519 had a less congealed market in banking, we'd still have 516 00:30:44.880 --> 00:30:46.640 you still see that wall of guarden issue. And then 517 00:30:46.640 --> 00:30:48.480 I have a follow up question to that, which is 518 00:30:48.759 --> 00:30:51.839 you use the FICO score as an example of where 519 00:30:52.720 --> 00:30:56.279 information sharing has increased consumer choice, which is obviously is 520 00:30:56.279 --> 00:30:58.680 the nation's oldest consumer protection organization, is the thing I 521 00:30:58.720 --> 00:31:02.720 care most about. But was that could could you finish 522 00:31:02.799 --> 00:31:05.599 the analogy for us? There was that something that government 523 00:31:05.640 --> 00:31:08.880 regulation enabled or aided? Or is that something that is 524 00:31:08.920 --> 00:31:12.119 an example of where information sharing has helped And this 525 00:31:12.279 --> 00:31:14.359 is just an example where we want to make sure 526 00:31:14.400 --> 00:31:17.519 Rule ten thirty three continues to enable information sharing in 527 00:31:17.519 --> 00:31:19.920 a different area. But did government regulation play a role 528 00:31:19.960 --> 00:31:21.240 in the FICHO squirrel? 529 00:31:21.720 --> 00:31:24.519 Yeah, it's a great example. So let me take each year. 530 00:31:24.680 --> 00:31:30.599 Things first about the market power, So what I would say, 531 00:31:30.799 --> 00:31:35.119 is you know it's by by standard anti trust standards. 532 00:31:35.880 --> 00:31:39.160 It doesn't you know, with standard and our trust standards. 533 00:31:39.440 --> 00:31:42.279 You know, might say we got enough competition, right, we 534 00:31:42.279 --> 00:31:49.599 don't have so much you know, sort of accumulation, that consolidation, 535 00:31:49.880 --> 00:31:52.480 that there's a problem in the market. What I see 536 00:31:52.519 --> 00:31:56.640 here though, is with respect to this market and the 537 00:31:56.680 --> 00:32:04.079 control over information, is it's almost every American interacts one 538 00:32:04.079 --> 00:32:06.880 way or another with one of these big institutions. Right. 539 00:32:07.480 --> 00:32:09.720 Maybe you don't have a bank account at Chase, but 540 00:32:09.839 --> 00:32:13.440 you probably have a credit card right, or City or whatever, 541 00:32:14.440 --> 00:32:18.240 and

so each of them may have control over different 542 00:32:18.240 --> 00:32:21.720 bits of your information. And so where this differs, I 543 00:32:21.759 --> 00:32:26.079 think from FICO, right, or the credit reporting system is 544 00:32:26.720 --> 00:32:30.519 in that world, all the creditors benefit, right, you put in, 545 00:32:30.720 --> 00:32:34.400 you take out, and basically in order, you know, and 546 00:32:34.440 --> 00:32:37.119 there's a reciprocal flow of information where everybody uses this. 547 00:32:37.279 --> 00:32:39.960 What we have here is it seems like they do 548 00:32:40.000 --> 00:32:42.920 have an incentive create a walled garden, right, Which is 549 00:32:42.960 --> 00:32:46.920 what it looks like to me sometimes is that if 550 00:32:47.400 --> 00:32:49.759 a big bank wants new customers, they just buy a 551 00:32:49.799 --> 00:32:54.359 medium sized bank. Right. They are really compete for customers 552 00:32:55.279 --> 00:32:57.359 generally in the way we think about it. And so 553 00:32:57.440 --> 00:32:59.880 here what we have is you don't have the reciprocal 554 00:33:00.039 --> 00:33:04.039 low of information. You've got one group that has more 555 00:33:04.079 --> 00:33:09.559 information and another group of FinTechs, smaller providers, competitors who 556 00:33:10.079 --> 00:33:12.720 would benefit from getting that information more than the big 557 00:33:12.759 --> 00:33:15.119 banks can get the information from them, right, And so 558 00:33:15.200 --> 00:33:18.079 I think that lost to kind of that reciprocal flow 559 00:33:18.079 --> 00:33:21.920 of advantage, I think creates a different bargaining situation, a 560 00:33:21.920 --> 00:33:25.559 different market structure that might otherwise be the be the case. 561 00:33:26.359 --> 00:33:29.759 You're just a note on that. So one way to 562 00:33:29.799 --> 00:33:32.319 think about that is it's not so much that there 563 00:33:32.359 --> 00:33:35.559 is too much concentration in the banking industry itself, although 564 00:33:35.559 --> 00:33:38.200 you do note that depending on how you want to 565 00:33:38.240 --> 00:33:40.440 chop up the market or talk about what services, there 566 00:33:40.440 --> 00:33:42.359 may be people who are banking at much smaller banks 567 00:33:42.519 --> 00:33:44.759 but still interact with the larger banks through a credit 568 00:33:44.759 --> 00:33:47.200 card or something like that. So putting that aside for 569 00:33:47.200 --> 00:33:51.319 saying it's almost as if the banking industry itself, as 570 00:33:51.400 --> 00:33:55.480 the incumbent party, has a strong incentive to keep out 571 00:33:55.559 --> 00:33:59.319 competition to the industry. Things that would innovate in the 572 00:33:59.359 --> 00:34:02.759 same way that you know, movie theaters had a strong 573 00:34:02.799 --> 00:34:04.920 incentive had they been able to do anything about it 574 00:34:04.960 --> 00:34:07.359 to hurt Netflix or something like that. If

if they, 575 00:34:07.440 --> 00:34:09.400 if they had had an entry point to block the 576 00:34:09.440 --> 00:34:13.159 consumer from from consuming movies through streaming, they probably would 577 00:34:13.159 --> 00:34:15.920 have taken every advantage to do so, even if there 578 00:34:15.960 --> 00:34:18.639 was plenty of competition amongst movie theaters or something like that. 579 00:34:18.719 --> 00:34:19.840 Is that kind of what you're saying. 580 00:34:20.239 --> 00:34:23.760 That's that's great, You're saying it better than me. So 581 00:34:23.960 --> 00:34:25.440 that was kind of what I was saying. You said 582 00:34:25.440 --> 00:34:28.440 it perfectly. I love the analogy. I think the analysis 583 00:34:28.679 --> 00:34:31.960 is just right. And do I have a lot of 584 00:34:31.960 --> 00:34:36.519 evidence for no, but the observation of what happened with 585 00:34:36.719 --> 00:34:39.440 Chase and Plaid, assuming that's true, and I haven't seen 586 00:34:39.480 --> 00:34:43.480 a doubt DEALTA is consistent with that explanation, right, And 587 00:34:43.519 --> 00:34:45.960 there's no reason to think that's a flow in any 588 00:34:46.280 --> 00:34:49.000 other way, right, which is the banks, the big banks 589 00:34:49.000 --> 00:34:52.760 get very little benefit from sharing this information with competitors, 590 00:34:53.559 --> 00:34:56.719 and you know you would expect that that they wouldn't 591 00:34:56.800 --> 00:35:01.280 right now with respect to FIKO, And it actually goes 592 00:35:01.280 --> 00:35:03.000 to what the cost should be here, right, So there's 593 00:35:03.199 --> 00:35:06.960 an interesting question. And the Paul's remarks were terrific in 594 00:35:07.079 --> 00:35:10.599 terms of fleshing this out. One of the interesting things is, Okay, 595 00:35:10.639 --> 00:35:13.159 so you've got the bank, you've got the consumer, and 596 00:35:13.199 --> 00:35:18.239 then you've got say the fintech company. Now, during the 597 00:35:18.320 --> 00:35:20.760 Biden administration, they just that everybody gets it for free. 598 00:35:20.840 --> 00:35:25.599 That might actually be a plausible answer, right, which is, 599 00:35:26.400 --> 00:35:29.440 you know, the credit scoring system is free to the consumer. 600 00:35:30.280 --> 00:35:32.480 I benefit from the fact that all those guys out 601 00:35:32.519 --> 00:35:35.400 there bear cost on reporting on whether or not you're 602 00:35:35.440 --> 00:35:39.000 a deadbeat or not, right, and I just benefit from 603 00:35:39.000 --> 00:35:42.360 that for free. Right, So zero cost might be an 604 00:35:42.400 --> 00:35:45.760 answer here, right, even if it's not zero cost and 605 00:35:45.840 --> 00:35:47.599 may just be one of these things that we say 606 00:35:47.679 --> 00:35:50.760 this is the easiest way to do it. I'm not 607 00:35:50.840 --> 00:35:54.679 pre judging that, but an argument could be made for 608 00:35:54.800 --> 00:35:57.960 that to just have the cost kind of

diffused through 609 00:35:58.079 --> 00:36:00.519 throughout the system. But there is an interest in question. 610 00:36:00.639 --> 00:36:02.559 Is if you take the basic cost, right, most of 611 00:36:02.559 --> 00:36:06.840 the costs of the collecting holding the data, you know, 612 00:36:07.039 --> 00:36:09.360 and the banks have their own you know, the banks 613 00:36:09.360 --> 00:36:11.880 have their own incentives to do that, to collect a 614 00:36:11.880 --> 00:36:14.880 lot of data, hold that use it for their own purposes. Now, 615 00:36:14.920 --> 00:36:17.159 let's say that you read the statute that says the 616 00:36:17.159 --> 00:36:20.440 consumer gets it for free. Right, so there may be 617 00:36:20.480 --> 00:36:24.480 a marginal cost from the consumer doing it, but that 618 00:36:24.519 --> 00:36:26.880 there's no cost of that, then the question would be 619 00:36:27.119 --> 00:36:30.719 what would be the additional, even more marginal cost of 620 00:36:30.840 --> 00:36:34.320 allowing a representative to get the information on behalf of 621 00:36:34.320 --> 00:36:39.000 the consumer. We can get talking about relatively small numbers 622 00:36:39.039 --> 00:36:41.159 at that point, And I'm not saying they'll necessarily say 623 00:36:41.159 --> 00:36:43.719 the consumer gets it for free, but if the consumer 624 00:36:43.760 --> 00:36:45.519 gets it for free, it would kind of be funny 625 00:36:45.920 --> 00:36:48.719 if then you could charge the representative of the consumer 626 00:36:49.519 --> 00:36:53.000 to If there's not really much more more cost on this, 627 00:36:53.800 --> 00:36:55.480 I just want to say one last thing, and Paul's 628 00:36:55.639 --> 00:36:59.000 remarks are great, and I just want to elaborate one 629 00:36:59.000 --> 00:37:01.480 point out what he said, which is not just sort 630 00:37:01.480 --> 00:37:04.360 of where we are today with you know, representative ages. 631 00:37:04.480 --> 00:37:07.000 We need to think about creating a framework for where 632 00:37:07.000 --> 00:37:10.840 we're going, right, We need to think about a framework 633 00:37:10.880 --> 00:37:16.440 for agentic AI for example, right where where a consumer 634 00:37:17.000 --> 00:37:21.480 you know, basically hires a an AI that is going 635 00:37:21.480 --> 00:37:24.239 around searching for them, you know, all the you know, 636 00:37:24.360 --> 00:37:26.519 all the all these sorts of things. And so to 637 00:37:26.559 --> 00:37:30.039 think about what a representative might be today, what a 638 00:37:30.079 --> 00:37:32.800 consumer might want a year from now, two years from 639 00:37:32.800 --> 00:37:37.039 now might be even broader, might raise new concerns and 640 00:37:37.039 --> 00:37:39.199 that sort of thing. And so I think as they're 641 00:37:39.239 --> 00:37:41.880 doing this, I think they want to keep a framework 642 00:37:41.920 --> 00:37:48.119 that's flexible enough two allow whatever comes along, which, you know,

643 00:37:48.159 --> 00:37:51.039 the rate of innovation for how consumers are using these 644 00:37:51.039 --> 00:37:53.840 things I think is very fast, and so I think 645 00:37:53.880 --> 00:37:58.960 that too augurs for a relatively broad definition of representative 646 00:37:58.960 --> 00:38:01.760 in the rule. And then you could always use you know, 647 00:38:03.960 --> 00:38:08.199 policy statements other sorts of tools to clarify sort of 648 00:38:08.239 --> 00:38:10.880 what the rules are with these very different things. And 649 00:38:10.920 --> 00:38:13.519 then the same thing with the pricing. If you start 650 00:38:13.519 --> 00:38:17.880 trying to micromanage costs, that might go up or go 651 00:38:18.039 --> 00:38:20.960 down over time as banks, for example, start to use 652 00:38:21.039 --> 00:38:24.440 AI and so that reduces their cost perhaps right well, 653 00:38:24.519 --> 00:38:27.199 increasing security. Are we going to constantly be updating what 654 00:38:27.239 --> 00:38:30.119 the cost will be is these technologies come along. So 655 00:38:30.199 --> 00:38:32.800 I think, you know, we want to have a very flexible, 656 00:38:32.800 --> 00:38:34.960 broad framework here to allow that evolution. 657 00:38:36.280 --> 00:38:39.679 If I can just jump in on that one element 658 00:38:39.679 --> 00:38:43.639 that I think is relevant here is how incredibly valuable 659 00:38:43.719 --> 00:38:47.639 this consumer information is. As Todd has said, the bank 660 00:38:47.719 --> 00:38:51.719 that has this consumer information it's useful not just for underwriting, 661 00:38:51.840 --> 00:38:54.480 for cash flow, under for writing and functions. 662 00:38:55.119 --> 00:38:59.719 But every institution is aggregating. 663 00:38:59.119 --> 00:39:01.639 The data that they have about their users and then 664 00:39:02.199 --> 00:39:05.400 selling it to various folks, banks, to this, et cetera. 665 00:39:06.599 --> 00:39:10.440 And it's a reasonable policy choice, I think for the 666 00:39:10.440 --> 00:39:13.039 government to come in and say, Okay, consumer, you just 667 00:39:13.119 --> 00:39:16.960 gave something really valuable to this institution. They're going to 668 00:39:17.039 --> 00:39:20.239 make money from it, and they're also going to have 669 00:39:20.280 --> 00:39:23.079 an obligation to give you some of the benefit of 670 00:39:23.119 --> 00:39:26.920 that information. And I think that's kind of the balance 671 00:39:26.960 --> 00:39:28.960 that ten thirty three is striking. 672 00:39:29.039 --> 00:39:30.199 It's an early. 673 00:39:29.920 --> 00:39:34.239 Recognition that data is very valuable and the consumer should 674 00:39:34.280 --> 00:39:36.239 have some access and some benefit from it. 675 00:39:37.320 --> 00:39:41.760 That's a great point, Paul. Following on from that, my 676 00:39:41.840 --> 00:39:43.880 understanding is that a number of banks have sort of 677 00:39:43.920 --> 00:39:47.599 already reached tentative

agreements with some of these third party providers. Obviously, 678 00:39:47.960 --> 00:39:50.960 Professor you mentioned one sort of notorious example where they 679 00:39:51.000 --> 00:39:54.559 had demanded an insane fee structure that sort of would 680 00:39:54.559 --> 00:39:58.119 have destroyed plaids business model, But I think they since 681 00:39:58.159 --> 00:40:01.599 then some of their requests have fallen a little bit. 682 00:40:02.840 --> 00:40:06.519 How should the CFP be be thinking about this. If 683 00:40:06.719 --> 00:40:09.400 there are agreements in place between these banks, obviously a 684 00:40:09.440 --> 00:40:12.480 regulation would override those. If it turns out the ten 685 00:40:12.559 --> 00:40:16.199 thirty three according to CFPB prevents those and they'll be abrogated. 686 00:40:16.239 --> 00:40:20.000 But in terms of what the professor was just saying, 687 00:40:20.639 --> 00:40:24.519 creating a flexible framework that allows for innovation to occur, 688 00:40:24.960 --> 00:40:29.039 how should policy makers in your view be thinking about 689 00:40:29.159 --> 00:40:31.840 those fee structures. Would you just say, no fees whatsoever, 690 00:40:31.920 --> 00:40:33.880 this is just part of running a bank. Or do 691 00:40:33.920 --> 00:40:36.360 you think you allow some sort of you know, cost 692 00:40:36.800 --> 00:40:40.119 sharing but no profit or do you say, I like 693 00:40:40.280 --> 00:40:42.199 the point that you just made, you're sort of already 694 00:40:42.280 --> 00:40:44.719 making the amount of money that it takes to do 695 00:40:44.760 --> 00:40:46.760 all this because you're selling the data yourself. You had 696 00:40:46.760 --> 00:40:49.599 to build the database obviously, and the ability for people 697 00:40:49.599 --> 00:40:53.199 to ping the database in order to sell the information yourself. 698 00:40:53.239 --> 00:40:56.559 When a retail person a user of the bank is 699 00:40:56.599 --> 00:40:59.119 not requesting it, but you're selling it to a third party, 700 00:40:59.159 --> 00:41:01.679 so that someone could ostensibly try to sell, you know, 701 00:41:02.760 --> 00:41:07.079 T shirts to one of their customers, how should the 702 00:41:07.159 --> 00:41:10.960 CPPV be thinking about those questions? And then also following 703 00:41:11.000 --> 00:41:16.159 on from that, if the revised Open Banking Rule does 704 00:41:16.199 --> 00:41:19.760 not address data access fees directly through caps or other constraints. 705 00:41:20.199 --> 00:41:23.079 What kinds of legal challenges or disputes would you expect 706 00:41:23.239 --> 00:41:26.280 from FinTechs and third party providers? So we already mentioned 707 00:41:26.280 --> 00:41:27.920 obviously this thing is going to there's be a lot 708 00:41:27.960 --> 00:41:30.559 of litigation around this. What do you expect around the 709 00:41:30.800 --> 00:41:34.360 fee structure? If they don't say anything, or even. 710 00:41:34.239 --> 00:41:36.119

If they do it is just for me or Paul. 711 00:41:36.719 --> 00:41:38.400 I was gonna say, Paul, but if you want to 712 00:41:38.440 --> 00:41:39.800 leave up and on them. 713 00:41:41.199 --> 00:41:44.800 It's as a tough, tough question to predict how this 714 00:41:45.039 --> 00:41:48.679 is going to shape out. I think the ecosystem is 715 00:41:48.760 --> 00:41:51.400 developed to the extent that the banks have a little 716 00:41:51.400 --> 00:41:55.920 bit more of an incentive to be reasonable. I think 717 00:41:56.119 --> 00:41:58.760 the customers at this point, I would be upset if 718 00:41:58.800 --> 00:42:02.079 I couldn't use VENMO from an account, I would probably 719 00:42:02.079 --> 00:42:05.199 stop putting money in that account. Or if I got 720 00:42:05.199 --> 00:42:07.920 to notice that says, hey, this transaction is going to 721 00:42:07.960 --> 00:42:11.280 cost you twenty dollars, because that's essentially the fee that 722 00:42:11.360 --> 00:42:14.199 this bank charges us to be able to access your money. 723 00:42:15.639 --> 00:42:18.679 You know, bank accounts are incredibly sticky, and Professor Zuiki 724 00:42:18.760 --> 00:42:21.320 has done research on this, so it would take some 725 00:42:21.360 --> 00:42:26.519 pretty horrible customer experiences, So I. 726 00:42:26.480 --> 00:42:29.239 Think there is an incentive there. 727 00:42:29.360 --> 00:42:33.159 I don't it's probably not not enough to reach an 728 00:42:33.239 --> 00:42:39.000 optimal price from the consumer perspective, you know, going back 729 00:42:39.039 --> 00:42:42.440 to something that came up earlier, it's that clear to 730 00:42:42.480 --> 00:42:45.239 me that you really need a rule for I mean, 731 00:42:45.280 --> 00:42:47.960 ten thirty three is I don't think it needs a 732 00:42:48.039 --> 00:42:50.000 rule to be in effect. I think if you had 733 00:42:50.000 --> 00:42:52.920 someone running the CFPB who wanted to bring an enforcement 734 00:42:52.960 --> 00:42:56.840 action about whether the consumer was genuinely able to use 735 00:42:56.880 --> 00:43:00.400 the information and whether it was available upon request, I 736 00:43:00.440 --> 00:43:03.519 think they could at least start that investigation and maybe 737 00:43:03.599 --> 00:43:08.920 bring an enforcement action without a rule. And I know 738 00:43:09.000 --> 00:43:11.360 at some points I think that has sort of colored 739 00:43:11.360 --> 00:43:14.880 these negotiations between the banks and the FinTechs, that they 740 00:43:14.880 --> 00:43:19.360 didn't want to do something totally totally outrageous and sort 741 00:43:19.360 --> 00:43:23.239 of spur the CFPB to step in and do that. Now, 742 00:43:23.280 --> 00:43:26.840 with most aspects of CFPB jurisdiction, the state ags can 743 00:43:26.920 --> 00:43:30.559 also enforce it. With this, it's a little bit trickier 744 00:43:30.599 --> 00:43:35.440 because the age authority usually hinges on an enumerated statute 745 00:43:35.559 -->

00:43:38.159 or the ut app authority or rule making, so there's 746 00:43:38.199 --> 00:43:42.079 no rule making. This probably doesn't count as an enumerated statute, 747 00:43:42.119 --> 00:43:44.239 so it's not clear that the AGS can enforce it. 748 00:43:44.320 --> 00:43:47.239 I think their authority here's a little shakier than it 749 00:43:47.280 --> 00:43:51.639 is elsewhere. But depending on what the CFPB does, and 750 00:43:51.679 --> 00:43:56.199 certainly if there's a rule in place, that could change. 751 00:43:56.280 --> 00:43:59.360 And so you could see you could see some enforcement 752 00:43:59.400 --> 00:44:01.800 from that direction as well. 753 00:44:03.360 --> 00:44:04.800 Question from the crowd that I was going to throw 754 00:44:04.800 --> 00:44:06.000 to you, but I want to give you a chance 755 00:44:06.039 --> 00:44:08.639 to respond to Paul if you had any comments on that. 756 00:44:11.199 --> 00:44:14.079 Yeah, I think you know what to to emphasize. I 757 00:44:14.119 --> 00:44:17.719 think one thing Paul said, and I think to rephrase 758 00:44:17.760 --> 00:44:22.119 it to your question, which is, uh, when when Chase 759 00:44:22.159 --> 00:44:25.480 did that, it got it got people's attention, it got 760 00:44:25.480 --> 00:44:30.119 the CFPB's attention. And you know, I don't know what's 761 00:44:30.360 --> 00:44:33.480 going on in the boardroom when they're negotiating these things, 762 00:44:33.840 --> 00:44:36.320 but if I were them, I think the threat of 763 00:44:36.840 --> 00:44:40.480 the CFPD bringing the hammer down would cause them to 764 00:44:40.480 --> 00:44:44.000 be a little more reasonable, uh, in whatever they are 765 00:44:44.079 --> 00:44:48.760 negotiating to reach some sort of resolution. And without that, 766 00:44:49.159 --> 00:44:51.159 you know, the question would be would we still have 767 00:44:51.679 --> 00:44:55.920 the same situation. The second thing is is you know, 768 00:44:56.320 --> 00:44:59.639 what is the right cost I just I don't know 769 00:45:00.039 --> 00:45:03.519 who has that information? I don't, right, But I do 770 00:45:03.599 --> 00:45:08.679 think the cfp B has framed the question correctly. Which 771 00:45:08.760 --> 00:45:11.920 is the question I think should be marginal cost? It 772 00:45:11.960 --> 00:45:15.039 should be what are the cost here in addition to 773 00:45:15.159 --> 00:45:19.360 what they already do to collect the data, store the data, 774 00:45:19.480 --> 00:45:24.239 keep the data secure? Right? And I don't know if 775 00:45:24.280 --> 00:45:26.559 that's a lot. I don't know if that's a little uh, 776 00:45:26.840 --> 00:45:28.880 but but I think you know, that would be a 777 00:45:28.960 --> 00:45:32.320 question the CFPB would would have to would have to 778 00:45:32.360 --> 00:45:35.159 look at, right. And again, I think personally the real 779 00:45:35.239 --> 00:45:37.880 question would be, is what is the marginal cost of 780 00:45:37.920 --> 00:45:43.800 allowing representatives on behalf of consumers if, for example, the consumer, 781 00:45:43.880 --> 00:45:46.320 if we decide for policy reasons that the consumers should 782 00:45:46.360 --> 00:45:49.280 be allowed to get access to their information for free, 783 00:45:49.800 --> 00:45:52.639 what would be the additional follow on cost of allowing 784 00:45:52.639 --> 00:45:54.840 somebody else to get at it? And that could turn 785 00:45:54.880 --> 00:45:58.639 out to be, you know, relatively small marginal cost. I 786 00:45:58.719 --> 00:45:59.239 just don't know. 787 00:46:00.079 --> 00:46:03.039 And to that point Todd, the statute says the consumer 788 00:46:03.079 --> 00:46:07.559 gets the information in a machine readable format, which is 789 00:46:07.559 --> 00:46:10.559 interesting and a couple of respects. One is, if you've 790 00:46:10.559 --> 00:46:13.559 seen a machine readable file as a consumer, that doesn't really. 791 00:46:13.400 --> 00:46:14.079 Do you any good. 792 00:46:14.880 --> 00:46:18.360 So the implication is that this is going to somebody 793 00:46:18.519 --> 00:46:20.840 who has a machine who can read this file, which 794 00:46:20.840 --> 00:46:24.119 is probably not you, which is another argument that this 795 00:46:24.239 --> 00:46:26.639 means an authorized representative. 796 00:46:26.840 --> 00:46:31.199 But also, you know, that's a fair I think even the. 797 00:46:31.199 --> 00:46:34.639 Banks would concede anything that's going directly to the consumer 798 00:46:34.719 --> 00:46:38.119 that has to be provided by for free, and then 799 00:46:38.599 --> 00:46:41.079 this really does fold into the definition of who is 800 00:46:41.400 --> 00:46:44.480 a representative and whether that has to be provided to 801 00:46:44.519 --> 00:46:47.360 them is free. But if we're already including machine readable 802 00:46:47.400 --> 00:46:50.639 formats as something that has to be provided for free 803 00:46:51.159 --> 00:46:54.519 to the consumer, then I think we're looking at the 804 00:46:54.519 --> 00:46:58.119 marginal cost on top of that, and at this point 805 00:46:58.400 --> 00:47:03.199 I'm not sure if it's that rate of a cost, 806 00:47:03.480 --> 00:47:08.280 and maybe that mitigates toward the price being free or 807 00:47:08.320 --> 00:47:12.000 close to it. The other area that's going to be 808 00:47:12.159 --> 00:47:17.320 fought over is around security and quantities of data. So 809 00:47:17.400 --> 00:47:19.880 if you have to if you have an API, but 810 00:47:20.000 --> 00:47:21.599 the bank says, oh, you know what, we're going to 811 00:47:21.679 --> 00:47:24.000 have to you're just going to have to reauthenticate this 812 00:47:24.159 --> 00:47:26.920 every week, or you could see somebody playing hardball and 813 00:47:26.960 --> 00:47:29.280 saying you have to reauthenticate it every time you log 814 00:47:29.320 --> 00:47:31.639 in and so it's essentially worthless and it can't be 815

00:47:31.760 --> 00:47:33.840 used for a lot of the functions that you mentioned 816 00:47:33.840 --> 00:47:37.920 around account monitoring that also destroys the functionality. 817 00:47:38.039 --> 00:47:40.280 So you have a fee that could destroy. 818 00:47:40.000 --> 00:47:43.800 The functionality and then an ostensible security purpose that could 819 00:47:43.840 --> 00:47:48.800 also destroy the functionality. So that's another area where the 820 00:47:48.880 --> 00:47:52.760 CFPP is going to have to impose some parameters to 821 00:47:52.840 --> 00:47:54.320 prevent that from being abused. 822 00:47:55.559 --> 00:47:57.239 Sure, I've got a question, and I think i'll kick 823 00:47:57.280 --> 00:48:00.559 to you here. Anonymous attendee centus a question. In the 824 00:48:00.599 --> 00:48:05.119 telecom sector, mandatory sharing at marginal cost pricing didn't work 825 00:48:05.119 --> 00:48:08.480 out too well, inded litigation and a lot of clee 826 00:48:08.639 --> 00:48:12.199 c entrants who did regulatory arbitrage for a wild and failed. 827 00:48:12.679 --> 00:48:16.320 Given that negotiated APIs have been growing and screen scraping 828 00:48:16.440 --> 00:48:19.400 is falling simply because of demand, aren't we giving up 829 00:48:19.400 --> 00:48:20.639 on markets prematurely? 830 00:48:21.119 --> 00:48:21.239 Now? 831 00:48:21.280 --> 00:48:23.800 I'll admit I know nothing about any of the stuff 832 00:48:23.840 --> 00:48:26.039 you just said in the telecottom industry, so I hope 833 00:48:26.079 --> 00:48:28.639 you have some frame of reference for that. But seeing 834 00:48:28.679 --> 00:48:30.800 as I know you are a generally ardent defender of 835 00:48:30.840 --> 00:48:32.800 the free market, I will let you argue for why 836 00:48:32.880 --> 00:48:34.159 this is a notable exception. 837 00:48:35.039 --> 00:48:39.760 Well, now I don't know that much about Telecom either, 838 00:48:39.880 --> 00:48:48.119 but that's a fascinating example, and you know it's I mean, 839 00:48:48.119 --> 00:48:52.039 it could be true, right, I mean you know, I'm 840 00:48:52.280 --> 00:48:57.519 inferring the potential for abuse simply from largely this observation 841 00:48:57.599 --> 00:49:00.840 of what happened when the threat of CFPB action was 842 00:49:00.880 --> 00:49:04.480 not was not was not there. And maybe that's enough, right, 843 00:49:04.559 --> 00:49:08.599 Maybe that's enough of a catalyst to reach to reach 844 00:49:08.960 --> 00:49:14.000 negotiated agreements. I would I'd be fascinated to know more 845 00:49:14.079 --> 00:49:19.320 about the Telecom example on how that evolved. You know 846 00:49:19.360 --> 00:49:23.840 what you know, what's what's you know cool about this, right? 847 00:49:24.000 --> 00:49:27.199 Is that you know this isn't This is a movement 848 00:49:27.280 --> 00:49:30.800 towards open banking, but it's not complete open banking, right, 849 00:49:31.360 --> 00:49:35.920 easily portable bank accounts, as Paul was saying, Right, but 850 00:49:36.119 --> 00:49:38.400 Telecom has always seemed to be modeled to that. Right. 851 00:49:38.719 --> 00:49:42.159 The idea that you could change your cell phone provider 852 00:49:42.199 --> 00:49:46.519 and keep the same cell phone number kind of revolutionized 853 00:49:46.519 --> 00:49:49.199 that entire market, right, because it was very costly to 854 00:49:49.320 --> 00:49:52.039 switch he probably more costly as to switch bank accounts. 855 00:49:52.400 --> 00:49:54.199 And so I think, you know that's I think the 856 00:49:54.239 --> 00:49:56.559 long term vision for this. I'm not sure the ten 857 00:49:56.639 --> 00:50:01.360 thirty three is itself necessarily an open banking statuted, but 858 00:50:01.599 --> 00:50:05.159 sure is a step in the direction towards open banking, 859 00:50:05.679 --> 00:50:10.679 greater portability, greater uh, the sort of frictionless ability of 860 00:50:10.679 --> 00:50:13.960 consumers to move their finances to to the to the 861 00:50:13.960 --> 00:50:15.079 best to the best deal. 862 00:50:16.360 --> 00:50:18.760 And I take to add to that, I'd go back 863 00:50:18.800 --> 00:50:21.880 to the professor's earlier point, where you're talking about a 864 00:50:21.920 --> 00:50:25.440 group of banks. 865 00:50:24.039 --> 00:50:26.000 That are all. 866 00:50:26.360 --> 00:50:30.960 Competing against FinTechs who have a completely different regulatory structure. 867 00:50:31.280 --> 00:50:36.480 We're offering products in direct competition, and the banks have 868 00:50:36.800 --> 00:50:40.280 all of the data, and so I don't that's just 869 00:50:40.280 --> 00:50:43.920 not an even playing field for negotiations. It's we're starting 870 00:50:43.920 --> 00:50:47.199 out with an incredibly inefficient market, and we can argue 871 00:50:47.199 --> 00:50:49.159 about what you need to do to make it efficient. 872 00:50:49.239 --> 00:50:51.440 But I don't think you could just say, from this 873 00:50:51.679 --> 00:50:58.159 very slanted floor, we're going to expect something efficient to occur, and. 874 00:50:59.679 --> 00:51:02.679 I just don't think that's realistic. 875 00:51:03.519 --> 00:51:06.880 And that reminds me another point of tension is going 876 00:51:06.920 --> 00:51:09.159 to be the quantity of data. 877 00:51:08.880 --> 00:51:11.960 That the consumer has access to, and. 878 00:51:11.920 --> 00:51:14.239 So the at the surface level, the fight will be 879 00:51:15.119 --> 00:51:18.119 you know, the bank saying well, there's we've got all 880 00:51:18.159 --> 00:51:21.760 this very confidential information about a consumer that the consumer 881 00:51:21.800 --> 00:51:23.039 would not want this closed. 882 00:51:23.320 --> 00:51:24.800 And if you get into the weeds of what. 883 00:51:24.719 --> 00:51:27.639 The fight is, the information that the bank doesn't want 884 00:51:27.639 --> 00:51:30.960 to turnover is the interest rate on the loan, right, 885 00:51:31.840

--> 00:51:34.159 That's what they don't want it to turn over because 886 00:51:34.239 --> 00:51:37.119 then somebody can say, well, or the you know, calculate 887 00:51:37.159 --> 00:51:40.360 the APR, you could make less, you know, you could 888 00:51:40.360 --> 00:51:43.159 pay less if you had this product over here. And 889 00:51:43.239 --> 00:51:48.639 I think that information, the pricing information concerning the product 890 00:51:48.760 --> 00:51:53.239 is very clearly covered under ten thirty three. So that's 891 00:51:53.360 --> 00:51:57.559 another area of friction in these negotiations, and that's an 892 00:51:57.599 --> 00:52:00.320 area where I think the consumers and FinTechs on very 893 00:52:00.360 --> 00:52:04.480 strong grounds as far as having access to that pricing. 894 00:52:06.000 --> 00:52:09.079 We've got about eight minutes or so left on this 895 00:52:09.280 --> 00:52:11.559 on this, and uh, I want to make sure to 896 00:52:11.559 --> 00:52:13.440 give you both a chance to sort of wrap up 897 00:52:13.480 --> 00:52:17.320 your thoughts but also to make predictions and your own 898 00:52:17.320 --> 00:52:20.880 out opinion on what should be the best outcome. So 899 00:52:21.840 --> 00:52:24.880 I started first with with Paul, start with you first, 900 00:52:24.880 --> 00:52:28.360 professor to end, what do you think is the best 901 00:52:28.400 --> 00:52:32.079 outcome for consumers if you were writing any rulemaking, and 902 00:52:32.119 --> 00:52:34.199 then what do you think is actually going to happen? 903 00:52:34.239 --> 00:52:36.079 What do you predict the CFPD is actually going to. 904 00:52:36.079 --> 00:52:38.320 Do me first? 905 00:52:38.719 --> 00:52:40.519 Yes, you first, professor, Okay, all right? 906 00:52:42.239 --> 00:52:46.119 Uh well, I think obviously the CFPB should you know, 907 00:52:46.360 --> 00:52:50.199 use my approach to this, right, And I think it's 908 00:52:50.360 --> 00:52:54.480 actually important. I think there's there's key recognitions here. And 909 00:52:54.719 --> 00:52:58.280 you know, we've been operating and certainly during the Biden administration, 910 00:52:58.800 --> 00:53:01.519 but we've basically been operating reading in a fifty year old, 911 00:53:01.880 --> 00:53:06.000 analog paper based way of thinking about this thing. Right. 912 00:53:06.440 --> 00:53:09.760 This idea of that we're going to give you notice 913 00:53:10.039 --> 00:53:14.039 and you're going to consent to how your information is 914 00:53:14.159 --> 00:53:19.199 used is ridiculous, right, People people don't do it. They 915 00:53:19.280 --> 00:53:22.400 just get lost in a blizzard of these meaningless things. 916 00:53:22.760 --> 00:53:25.559 You know, it could be somewhere in there I consented 917 00:53:25.599 --> 00:53:30.639 that you know, my you know, you can repossess my 918 00:53:30.800 --> 00:53:33.519 dog if I don't pay my credit card bill. Right, 919 00:53:33.559 --> 00:53:35.960 I'd have no

idea. I mean, the idea that well, 920 00:53:36.079 --> 00:53:37.840 you know you had a chance to read it and 921 00:53:37.880 --> 00:53:41.039 you signed it means you consent that that's just nonsense, right. 922 00:53:41.079 --> 00:53:44.960 I think we need to recognize how complicated the world 923 00:53:45.079 --> 00:53:47.880 is how people get information alike, and create a new 924 00:53:47.920 --> 00:53:50.960 framework that does that. Secondly, create a new framework that 925 00:53:51.039 --> 00:53:55.199 recognizes the modern reality of how people do banking. They 926 00:53:55.239 --> 00:53:59.679 do it a lot of different ways. This unbundling that's 927 00:54:00.039 --> 00:54:02.480 it's come about, and that sort of thing can create 928 00:54:02.559 --> 00:54:06.039 a framework that is modern to get beyond this old 929 00:54:06.119 --> 00:54:10.000 Natorites worldview that we've been trapped in in the like, 930 00:54:10.360 --> 00:54:13.119 I think, you know two things that I think are 931 00:54:13.119 --> 00:54:15.800 going to still be sticky things that they have to 932 00:54:15.840 --> 00:54:21.559 work out is sort of having to deal with sort 933 00:54:21.559 --> 00:54:24.960 of verification of the representative on behalf of the consumer. Right. 934 00:54:25.440 --> 00:54:27.920 So one of the things that you were talking about 935 00:54:27.920 --> 00:54:30.760 when you talked about how the screen scraping works is 936 00:54:30.960 --> 00:54:32.519 when they were trying to go through the front door, 937 00:54:32.760 --> 00:54:34.639 basically you would have to give these guys your log 938 00:54:34.679 --> 00:54:37.639 in information, right, which could create all kinds of havoc 939 00:54:38.039 --> 00:54:40.199 so that they could basically log in as you. 940 00:54:40.880 --> 00:54:41.079 Right. 941 00:54:41.960 --> 00:54:45.480 But sort of these questions of do you if you 942 00:54:45.679 --> 00:54:50.039 if you get say a you know, a data aggregator, 943 00:54:51.760 --> 00:54:54.679 what can they take? How can they use it? Right? 944 00:54:54.960 --> 00:54:56.920 You kind of in some sense have to move the 945 00:54:57.079 --> 00:55:00.719 contracting question one step adjacent which is we're talking about 946 00:55:00.719 --> 00:55:03.000 the aggregator related to the bank, but now you have 947 00:55:03.039 --> 00:55:05.559 to have a whole nother framework of sort of dealing 948 00:55:05.639 --> 00:55:08.360 with sort of data aggregators and what they can do, 949 00:55:08.440 --> 00:55:10.239 what they can use, and the kind of you know, 950 00:55:10.320 --> 00:55:13.280 some extent we reproduce some of these things. Is more 951 00:55:13.280 --> 00:55:16.519 and more people rely on these data aggregators to collect information. 952 00:55:16.920 --> 00:55:19.159 How long can they use it right? How long does 953 00:55:19.199 --> 00:55:22.480 the verification work for with them in the like? I 954 00:55:22.480 --> 00:55:25.159 think the second thing will be a challenge about is 955 00:55:25.199 --> 00:55:28.000 you know, they set up the API, not just sort 956 00:55:28.000 --> 00:55:31.039 of what the what the standard? You know, what the 957 00:55:31.079 --> 00:55:33.679 standard is, the standard setting, but how do we set 958 00:55:33.679 --> 00:55:37.960 the standard right? Making sure that whatever standard sitting organization 959 00:55:38.039 --> 00:55:40.360 we come up with is not dominated by the big banks, 960 00:55:40.360 --> 00:55:44.039 for example, who have an incentive to create very expensive 961 00:55:44.519 --> 00:55:47.719 processes that small banks may not be able to to 962 00:55:47.920 --> 00:55:50.559 you know, be buried in the regulatory costs or something 963 00:55:50.639 --> 00:55:54.599 like that. So whether it's a you know, private organization, 964 00:55:55.280 --> 00:55:58.199 whether it's a voluntary organization right thinking through that and 965 00:55:58.280 --> 00:56:02.119 I don't have a good answer to that, but I 966 00:56:02.119 --> 00:56:05.440 think that'll be the other another nut that'll be challenging 967 00:56:05.440 --> 00:56:08.719 for them to crack but I think we'll come up 968 00:56:08.760 --> 00:56:13.159 with something that you know, especially if you look back 969 00:56:13.199 --> 00:56:17.840 that twenty eighteen Treasury report, it's pretty bullish on fintech 970 00:56:18.239 --> 00:56:20.400 data aggregators and the like, and so I think it 971 00:56:20.400 --> 00:56:24.280 will be a pretty dramatic change of direction to retreat 972 00:56:24.320 --> 00:56:27.079 from that at this point when now you kind of 973 00:56:27.079 --> 00:56:29.599 have an opportunity to implement those ideas. 974 00:56:30.760 --> 00:56:33.760 So I think as far as what the CFPB is 975 00:56:33.840 --> 00:56:36.920 going to do, I think it's all going to hinge 976 00:56:37.000 --> 00:56:41.079 on the meaning of this turn representative, and I think 977 00:56:41.280 --> 00:56:46.400 the right meaning of that is authorized third parties and 978 00:56:47.000 --> 00:56:49.719 wants to see if he recognizes that, then all the 979 00:56:49.800 --> 00:56:55.000 pro consumer language about usability and upon request and so 980 00:56:55.079 --> 00:56:58.559 forth is going to lead to a very pro consumer 981 00:56:59.280 --> 00:57:03.719 regulation and with low fees and a lot of accessibility. 982 00:57:03.880 --> 00:57:07.280 So if that definition is interpreted the way I think 983 00:57:07.280 --> 00:57:09.440 it will be, then we're going to end up with 984 00:57:09.480 --> 00:57:12.840 a very pro consumer, pro fintech rule and the banks 985 00:57:12.840 --> 00:57:15.960 are going to lose on most of these most of 986 00:57:16.000 --> 00:57:19.880 these issues. Now, one medic question that is in my 987 00:57:20.079 --> 00:57:24.880 mind is how much influence do banks have within the 988 00:57:24.920 --> 00:57:27.440 Republican Party at this point. If you go back to

989 00:57:27.519 --> 00:57:30.599 Trump one in twenty nineteen and you pull the Republicans, 990 00:57:30.719 --> 00:57:34.519 sixty three percent had a high opinion of large banks. 991 00:57:35.039 --> 00:57:39.400 And at that point the Business Roundtable shaired by Jamie 992 00:57:39.400 --> 00:57:43.440 Diamond started redefining the purpose of the corporation. Banks started 993 00:57:43.480 --> 00:57:49.119 debanking prominent conservatives, shutting off services to Alaska, to coal, 994 00:57:50.239 --> 00:57:53.079 to a lot of oil and gas companies. Essentially, if 995 00:57:53.079 --> 00:57:56.679 you go through the Republican coalition attacking every element of 996 00:57:56.719 --> 00:58:00.480 that and with the result of the approval now is 997 00:58:00.480 --> 00:58:04.599 somewhere in thirty percent, it's the same as Democrats has 998 00:58:04.639 --> 00:58:09.039 fallen as well. So you're looking at an industry as 999 00:58:09.079 --> 00:58:12.159 a whole that has far less influence than they would 1000 00:58:12.159 --> 00:58:16.159 have had in Trump won, and maybe less impact on 1001 00:58:16.679 --> 00:58:19.760 the rule making. And we saw that in the initial 1002 00:58:19.880 --> 00:58:22.920 the Genius Act in the Stable Point Bill, where on 1003 00:58:23.000 --> 00:58:25.119 the hill the banks really got to hand it to 1004 00:58:25.199 --> 00:58:27.719 them for probably the first time that I can remember, 1005 00:58:29.280 --> 00:58:33.239 and I think that may be repeating itself throughout these 1006 00:58:33.320 --> 00:58:36.840 rule makings and throughout these legislative fights. So again, the 1007 00:58:36.880 --> 00:58:40.119 big meta question to me is how much influences do 1008 00:58:40.199 --> 00:58:43.000 the banks have left. Have they thrown it all away 1009 00:58:43.519 --> 00:58:46.320 or are they starting to clost some of it back 1010 00:58:46.440 --> 00:58:48.679 by trying to move back in the center and not 1011 00:58:48.960 --> 00:58:53.559 just be on the side of the left in advancing 1012 00:58:54.000 --> 00:58:56.840 sort of left wing policy goals with their market share. 1013 00:58:57.559 --> 00:59:00.679 And I'll just add one footnote to to buy something 1014 00:59:00.719 --> 00:59:05.000 Paul said about the statutory interpretation question or representative. I mean, 1015 00:59:05.039 --> 00:59:10.079 obviously we're in the post Looper Bright world, so whatever 1016 00:59:10.119 --> 00:59:15.639 the CFPV determines representatives should mean will require well get 1017 00:59:15.719 --> 00:59:20.039 little deference from from a court. And I don't you know, 1018 00:59:20.079 --> 00:59:23.119 I haven't delved into the sort of legislative history or 1019 00:59:23.159 --> 00:59:25.679 whatever sources they might look at to try to figure 1020 00:59:25.679 --> 00:59:30.159 out what that term is. Uh to see whether you know, 1021 00:59:30.519 --> 00:59:32.920 whether they're how determined it is to figure out what 1022 00:59:32.960 --> 00:59:35.519 exactly that means and what the full context would look like. 1023 00:59:35.559 --> 00:59:40.360 But that'll be an interesting post Loper Bright question interpret 1024 00:59:40.400 --> 00:59:43.719 one word essentially in the statute. 1025 00:59:43.800 --> 00:59:49.000 So well, thank you both Paul and Professor's Wiki for 1026 00:59:49.719 --> 00:59:51.519 joining us today, and of course thank of all of 1027 00:59:51.559 --> 00:59:54.480 our audience for coming in and looking at this important question. 1028 00:59:54.519 --> 00:59:56.920 I'm sure there will be more developments, and thank you 1029 00:59:57.000 --> 00:59:58.400 for Federal Society. 1030 00:59:58.079 --> 01:00:01.159 For hosting this well well, thank you again to all 1031 01:00:01.199 --> 01:00:04.239 our speakers and for sharing your expertise as noted. You 1032 01:00:04.280 --> 01:00:07.679 can find our participants expanded by us at fedsoc dot org. 1033 01:00:08.000 --> 01:00:10.119 Please feel free to reach out to me directly or 1034 01:00:10.119 --> 01:00:12.400 through our website if you're interested in any follow up 1035 01:00:12.400 --> 01:00:14.920 with our experts. And thank you all again, and we 1036 01:00:14.960 --> 01:00:15.480 are adjourned. 1037 01:00:15.840 --> 01:00:18.480 Thank you for listening to this episode of fedsoc forms, 1038 01:00:18.559 --> 01:00:19.840 a podcast of the Federal. 1039 01:00:19.679 --> 01:00:20.920 Societies Practice Groups. 1040 01:00:21.440 --> 01:00:24.519 For more information about the Federal Society, the practice groups, 1041 01:00:24.760 --> 01:00:27.199 and to become a Federal Society member, please visit our 1042 01:00:27.199 --> 01:00:29.280 website at fedsoc dot nem org