President-elect Biden has signaled that robust consumer protections will be a major focus of his policy agenda in what is anticipated to be a dramatic shift from the deregulatory policies of the Trump administration.  In this article, we preview the incoming administration’s anticipated consumer protection agenda in two areas: data privacy and consumer financial protection.  We also consider what, if any, impact this policy shift is likely to have on state-level enforcement.

Assuming that Republicans retain control of the Senate, and with a divided Congress consumed at least in the short term with negotiations over COVID-19 relief, we expect to see an initial focus of the Biden administration on pursuing its policy agenda through increased enforcement and regulatory activity.  That said, both the Biden administration and key members of Congress are focused on identifying common ground for potential bipartisan legislation.[1]

Data privacy is one area that is likely to see bipartisan legislative efforts.  Policymakers on both sides of the aisle have recognized the need for federal privacy legislation, and though the parties continue to disagree over key details, they may face heightened pressure to act in light of California’s recent passage of the California Privacy Rights Act, which imposes additional privacy obligations on businesses scrambling to comply with the California Consumer Privacy Act that went into effect earlier this year.  We also expect to see increased privacy enforcement and regulatory activity during the Biden administration—at both the federal and state levels.

Indeed, state attorneys general, who stepped in to fill a gap in consumer protection enforcement more generally under the Trump administration, are expected to continue their active enforcement role over the next four years.  With President-elect Biden’s late son, Beau Biden, having served as state attorney general of Delaware and Vice President-elect Kamala Harris having previously served as attorney general of California, the incoming administration has close ties to state attorneys general and is likely to view them as key partners in executing the incoming administration’s consumer protection agenda.

Another area where we expect to see early action under the new administration is consumer financial protection, in particular through a revitalized Consumer Financial Protection Bureau (CFPB).  President-elect Biden is expected to move quickly to install a new director to head the agency, marking a swift shift toward a more aggressive role by the agency in policing Wall Street, fintech companies, and other financial industry participants.

Below we take a closer look at anticipated near-term policy and enforcement shifts in the areas of data privacy and consumer financial protection.

Data Privacy

Data privacy is likely to be a key area of legislative and enforcement focus under the Biden administration.  President-elect Biden, who campaigned on his ability to work across the aisle, may find opportunities to facilitate bipartisan privacy legislation.  Republicans and Democrats alike have recognized the need for passing comprehensive federal privacy legislation, but have differed over whether, and to what extent, such legislation should preempt more stringent state laws and provide for enforcement through a private right of action.  But the recent passage of Proposition 24 in California, which amends the presently-effective California Consumer Privacy Act and imposes additional requirements under the California Privacy Rights Act, as well as the anticipation of follow-on legislation in other states, may increase pressure on federal lawmakers to act.

Reforming Section 230 of the Communications Decency Act is another area that is expected to receive bipartisan attention, with policymakers on both sides of the aisle expressing concern about the scope of immunity that courts have afforded to social media companies under the statute.  Here too, however, the parties differ over the focus of their concerns, with Republicans voicing concern about perceived anti-conservative bias and Democrats focused on the spread of misinformation and hate speech.  Thus, whether such reform proceeds and what it would entail will likely depend on which party gains control of the Senate.

While these and other efforts to facilitate federal legislation may have a longer-term time horizon, the Biden administration’s immediate focus will likely be on administrative action: increased investigations and enforcement, revising informal guidance, and initiating formal rulemaking.

Foremost among the enforcement tools available to the new administration will be the Federal Trade Commission (“FTC”).  Even under the Trump administration, the FTC attained significant settlements related to data security issues.  The FTC was also active in the rulemaking space; for example, beginning in July 2019 the FTC initiated rulemaking to update the Children’s Online Privacy Protection Act (“COPPA”) Rule to better address interactive media and other recent technological developments.   The Biden administration will likely continue these efforts to enforce and modernize data privacy regulations.  The focus, however, may shift, including in light of the potential for new leadership at the FTC.  The two Democratic FTC Commissioners have expressed an interest in vigorously pursuing data privacy enforcement actions, and including individual liability for company leadership as an available remedy. With the current Republican Chairman Joe Simons rumored to be stepping down in the next few months, President-elect Biden may be able to appoint a new Commissioner, creating a 3-2 Democratic majority, in addition to designating a new Chairman.  This is not a sure thing, however; FTC Commissioners have seven-year terms and Chairman Simons may opt to remain in office through the end of his term in 2023.  Under those circumstances, the new administration’s efforts to refocus or invigorate enforcement may be somewhat impeded.

In the healthcare space, the new administration is expected to increase regulatory oversight of sharing of personal health information in response to COVID-19.  More generally, the Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) recently has shifted its HIPAA enforcement focus away from large, headline-grabbing penalties for the most significant data breaches toward emphasizing a larger number of smaller-dollar settlements.  This shift followed OCR’s April 2019 announcement that it would sharply reduce the maximum annual penalties that health care entities can face for lower-level privacy violations.  It remains to be seen whether OCR retains this high-volume, low-penalty focus or changes course following an anticipated change in leadership at the top levels under the new administration.  One priority that is not expected to change is OCR’s aggressive enforcement of “right of access” provisions under HIPAA.  In the past year, OCR has announced 10 settlements related to these provisions.  Vigorous enforcement of these provisions will likely continue under the Biden administration.  Indeed, the Biden administration already has indicated a desire to continue certain related initiatives, including promoting patient control and use of data.

Finally, outside of the federal government, state attorneys general have taken an increasingly active role in enforcement of consumer privacy laws, and we expect this nationwide trend to continue, particularly with the recent passage of new state-level privacy and cybersecurity laws.  State-level enforcement has been particularly active in the areas of data security and data breach response, and will likely continue to be so, particularly given the increase in security threats and incidents that have accompanied remote work during the pandemic. As noted above, the new administration has deep ties to state attorneys general, which are likely to herald deeper partnerships and more joint privacy-related enforcement actions between state and federal authorities.

Consumer Financial Protection

With the economic impact of the COVID-19 pandemic looming large, consumer financial protection is expected to be an immediate priority for the incoming administration.  The most drastic shift is likely to occur at the CFPB, an agency formed in the wake of the financial crisis during the Obama administration, but which saw a significant decline in enforcement activity and a rollback of Obama-era rules under the Trump administration.

The President-elect has tapped Leandra English, former CFPB deputy director, to lead the transition team’s review of the CFPB.  English helped to establish the agency under President Obama, and her removal by President Trump and replacement with Mick Mulvaney gave rise to a Supreme Court decision this year holding that the President can replace the CFPB director at will.[2]  That decision paves the way for President-elect Biden to promptly replace the current head of CFPB, Kathleen Kraninger, with a new acting CFPB director pending Senate confirmation of a permanent appointment.  Given English’s deep knowledge of, and history with, the CFPB, her appointment to lead the incoming administration’s overhaul of the agency signals that the President-elect takes the CFPB and its role as consumer watchdog seriously.

A ramp up in the frequency and scale of enforcement actions is expected to be the most significant and immediate shift in the CFPB under the Biden administration, with more investigations and actions, as well as heftier fines against a broader range of financial firms.[3]  Enforcement of the CARES Act is expected to be a top priority, which means more aggressive monitoring of banks and financial institutions for compliance with payment forbearance to mortgage and student loan borrowers and prohibitions on negative credit reporting due to the COVID-19 pandemic.  Any subsequently enacted provisions in connection with COVID-19 relief are also likely to be top enforcement priorities for the CFPB.

A revitalized CFPB also is expected to renew its Obama-era focus on reining in payday lenders, monitoring student loan servicers, prioritizing equal access to affordable credit, and aggressively enforcing against discriminatory lending practices against minority borrowers.  It is also likely that the CFPB will initiate rulemaking and/or offer guidance on issues of fair-lending compliance, including new reporting requirements.

Under its first director, Richard Cordray, the CFPB also partnered closely with state attorneys general, and increased federal-state cooperation in enforcement activity could return to the CFPB under the Biden administration.  Indeed, federal-state collaboration in this space is already underway.  On September 29, 2020, the CFPB announced a nationwide enforcement initiative in collaboration with the FTC and more than 50 state and federal law enforcement partners against debt collectors engaged in allegedly abusive debt collection practices called “Operation Corrupt Collector.”[4]  These kinds of federal-state enforcement actions are likely to increase under a more active CFPB.

ENDNOTES

[1]     Of course, if the Georgia Senate runoffs flip control of the Senate to the Democrats, this would alter the calculus both in terms of the type of legislation the Biden administration is able to pursue and the individuals the President-elect is likely to appoint to his cabinet and key administrative agencies.

[2]     Seila Law v. CFPB, 140 S. Ct. 2183, 2197 (2020).

[3]     The CFPB also underwent a reorganization under President Trump that removed the fair lending office from the Bureau’s Supervision, Enforcement and Fair Lending Unit, affecting its enforcement powers.  This is likely to be reversed by CFPB leadership appointed by President-elect Biden.

[4]     CFPB, Newsroom, CFPB, FTC, State, and Federal Law Enforcement Partners Announce Nationwide Crackdown on Phantom and Abusive Debt Collection (Sept. 29, 2020), https://www.consumerfinance.gov/about-us/newsroom/cfpb-ftc-state-and-federal-law-enforcement-partners-announce-nationwide-crackdown-phantom-and-abusive-debt-collection/.

This post comes to us from Gibson, Dunn & Crutcher LLP. It is based on the firm’s piece, “Where Data Privacy And CFPB Are Headed Under Biden,” which first appeared on November 24, 2020, in Law360.