There’s No Such Thing as Free Data

A ny day now, the Consumer Financial Protection Bureau (CFPB) is expected to propose new rules governing who pays for access to Americans’ financial data. Before it does, conservatives should get one thing straight: A consumer’s right to his financial information does not entitle a fintech company to unlimited use of somebody else’s infrastructure for free.

My colleague Todd Zywicki argued in these pages that allowing banks to charge for data access would undermine consumer choice and competition. I have cited Mr. Zywicki’s scholarship approvingly before, and he is a formidable defender of both. But on this question, he has the economics backward. Preventing banks from charging fintech companies for commercial access to bank-built systems doesn’t eliminate a price. It sets the price at zero.

That isn’t the free market at work. It’s a coercive price control.

Section 1033 of the Dodd-Frank Act requires that financial institutions make a consumer’s financial information available to the consumer upon request in a usable electronic form. Congress also directed the Consumer Financial Protection Bureau to promote standardized formats for that information. Congress never said the price of commercial Application Programming Interfaces (API) access must be zero. It never directed banks to build free pipelines for Plaid, Yodlee, or any other intermediary. In fact, Congress specifically instructed the CFPB not to require or promote any particular technology for compliance. A consumer’s right to their own financial data and a fintech company’s right to someone else’s infrastructure are not the same thing.

APIs don’t build, maintain, authenticate, or secure themselves. Fraud monitoring, cybersecurity, server capacity, software development, and around-the-clock availability cost money. And those costs aren’t hypothetical. Even with the original rule enjoined, law firm Cozen O’Connor observed that financial institutions have already invested heavily in API and data-sharing infrastructure. “Those systems are not going away.”

Neither is the responsibility that comes with them. Cozen warns that banks cannot simply outsource their exposure: If the replacement rule resembles the current framework, institutions will remain accountable for failures involving access, availability, and data delivery even when vendors build or operate the underlying systems.

So, banks are expected to build, secure, monitor, and answer for the pipes. Mr. Zywicki would have Washington decide that commercial firms get to use them for free. He argues that fees charged to fintechs will eventually be passed on to consumers. Perhaps some will. But that argument runs in both directions. Costs don’t disappear because a regulator commands that the price be zero. They simply move somewhere else.

More important, zero is still a price. Under the Biden-era rule, it was the price chosen by the government. Former CFPB director Rohit Chopra’s rule prohibited financial institutions from charging third parties for access to the interfaces that banks were required to maintain. The theory was straightforward: Fees might discourage data access, so Washington should prohibit them. That argument is the standard rationale for almost every price control ever devised.

The statutory case for free data access is weak, too. In litigation over the rule, the Trump CFPB itself argued that Section 1033 does not authorize the bureau to prohibit banks from charging for access to interfaces. A federal judge subsequently enjoined enforcement of the rule while the bureau reconsiders it, concluding that its challengers are likely to succeed on their claims. There is an even better reason not to regulate the price: We already know negotiation works.

Last year JPMorgan Chase told data aggregators that it intended to charge for access to its systems. The fintech industry erupted. Then something remarkable happened: They negotiated. JPMorgan reduced its proposed pricing. The aggregators won concessions over the handling of data requests. JPMorgan ultimately reached agreements with Plaid, Yodlee, Morningstar, and Akoya — firms responsible for more than 95 percent of third-party data pulls on its systems.

Consumers weren’t disconnected from their financial apps. Open banking didn’t collapse. A bank proposed a price, its counterparties objected, both sides bargained, and they reached an agreement.

Ladies and gentlemen, I present the free market.

Mr. Zywicki’s strongest objection is that banks aren’t ordinary vendors. They hold customer information and increasingly compete with fintech companies that request it. A bank could theoretically use access fees to protect itself from competitors. That concern deserves scrutiny. The possibility of anticompetitive behavior doesn’t justify setting the price of an entire category of commercial transactions at zero. If a bank uses pricing as a pretext to block consumer-authorized access or unlawfully exclude competitors, deal with that conduct. Don’t nationalize the price.

Nor should banks be permitted to trap consumers inside obsolete systems. Consumers should be able to authorize secure access to their financial information. The market should continue moving away from credential-based screen scraping and toward safer APIs. Firms receiving sensitive financial information should bear meaningful security and liability obligations. None of that requires free API access.

Property rights matter on both sides of the transaction. Consumers have rights in their financial information. Financial institutions have invested in the systems used to store, secure, authenticate, and transmit it. Fintech companies are entitled to compete for customers. They are not entitled to have Washington force their competitors to subsidize them.

The CFPB should establish sensible rules for consumer authorization and security and then get out of the way. Let consumers control their information. Let banks and fintechs negotiate over the pipes. There is no reason for Washington to decide that the price of financial data must be zero.