Exam CIPP-US topic 1 question 38 discussion

The correct answer is D. The Consumer Financial Protection Bureau. This answer is supported in several sections of the IAPP textbook, U.S. Private-Sector Privacy, 4th Edition, 2024, such as: 5.4.3, "Until the creation of the CFPB, the FTC issued rules and guidance for the FCRA, as amended by the Fair and Accurate Credit Transactions Act (FACTA) of 2003. The CFPB now has authority to issue rules for those areas." 9, "The CFPB now has rulemaking authority for the FCRA, as updated by FACTA, as well as for most financial institutions under GLBA..." 9.4, "The CFPB has assumed rulemaking authority for specific existing laws related to financial privacy and other consumer issues, such as the FCRA, GLBA, and Fair Debt Collection Practices Act." Initially, I selected B, because the FTC previously had rulemaking and enforcement authority for these laws before the CFPB was created. While the FTC still has some enforcement responsibilities, the CFPB now holds primary rulemaking authority.

In 2010, Congress passed the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), which granted "rule-making authority" under FCRA (except for Section 615(e) (red flag guidelines and regulation) and Section 628 (disposal of records) to the Consumer Financial Protection Bureau (CFPB). Congress substantively amended the FCRA upon the passage of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act). The FACT Act created many new responsibilities for consumer reporting agencies and users of consumer reports. It contained many new consumer disclosure requirements as well as provisions to address identity theft. In addition, it provided free annual consumer report rights for consumers and improved access to consumer report information to help increase the accuracy of data in the consumer reporting system.

Answer is D

https://www.consumerfinance.gov/compliance/supervision-examinations/fair-credit-reporting-act-fcra-examination-procedures/ In 2010, Congress passed the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), which granted rule-making authority under FCRA (except for Section 615(e) (red flag guidelines and regulation) and Section 628 (disposal of records) to the Consumer Financial Protection Bureau (CFPB). The Dodd-Frank Act also amended two provisions of the FCRA to require the disclosure of a credit score and related information when a credit score is used in taking an adverse action or in risk-based pricing.

FTC also has significant rule making authority over FCRA and FACTA. Could B also be the right choice here?