Data Points: Privacy & Data Security Blog

On October 29th, the Eastern District of Kentucky (the “Court”) enjoined the CFPB from enforcing the Personal Financial Data Rights Rule (the “Rule”) until it has completed its reconsideration of the Rule.[1] The Rule had been released by the Consumer Protection Financial Bureau (“CFPB”) in October of 2024 pursuant to the CFPB’s authority under Section 1033 of the Dodd-Frank Act.[2] The Rule requires financial institutions to share consumers’ personal financial data with other providers at no cost upon the consumer’s request. The Court, having determined that challenges to the Rule were likely to succeed on the merits, has now enjoined the CFPB from enforcing the Rule, finding that requiring financial institutions to comply with the Rule while it is under reconsideration by the CFPB would cause irreparable harm.

In February 2025, the Virginia legislature passed a bill governing high risk artificial intelligence. On March 24, 2025, Governor Youngkin vetoed it.

On October 22, 2024, the Consumer Financial Protection Bureau (the “CFPB”) finalized its personal financial data rights rule (“The Final 1033 Rule” or the “Final Rule”) that would require data providers to make available to consumers and their authorized third parties certain covered data in the data provider’s control or possession concerning a covered consumer financial product or service. This Final Rule comes a year after the CFPB initially proposed the rule (the “Proposed Rule”) in October of 2023.