Your Data Is Up for Sale on Cyber Monday

It’s hard to find the most shocking detail about FTX, the cryptocurrency exchange that imploded in such spectacular fashion. From borrowing billions of dollars from customer deposits to meet debt obligations, to using corporate funds to purchase employee homes and “personal items”—the story of FTX’s rapid demise is punctuated by acts of blatant exploitation on behalf of the now-bankrupt exchange.

If these kinds of abusive practices intuitively seem like they should be illegal, that’s because, under current U.S. securities law, they are. But FTX (which was based in the Bahamas, except for its much smaller operation FTX US) and other crypto firms largely don’t fall under securities law. Instead, they dwell in a regulatory gray area. Though FTX is currently being investigated and prosecutors may find ways to hold its decisionmakers accountable under U.S. law, it might be harder than you would expect. The fact is that crypto companies aren’t governed by the existing financial and securities regulations—and crypto is just the tip of the larger financial-technology iceberg.

Under the current U.S. regulatory scheme, fintech companies are viewed more as tech firms than financial firms. The sector has therefore been largely governed by the same “regulation-lite” regime as the tech industry, as opposed to the much more stringent regulation of the financial industry.

This has significant implications for, among other things, users’ sensitive financial data. Laws governing the financial industry afford users’ financial and banking information special protection and privacy rights, recognizing that consumer financial data is deeply personal and sensitive. The U.S. approach to tech regulation, on the other hand, which trends more free market than its EU counterparts, has led to a regulatory scheme that allows for users’ data to be treated as a commodity—one that can be collected, privatized, aggregated, and sold by industry.

The impact of this regulatory approach is far-reaching, given how pervasive fintech companies are becoming. While cryptocurrency remains relatively niche, other fintech services, from Apple Pay to Zelle, are becoming increasingly integrated into our day-to-day lives. Even if the word fintech conjures up something vaguely futuristic and aquatic for you, chances are you have used a fintech service at some point. Fintech refers to a fast-growing sector of companies that use new technologies to compete with traditional financial-services firms, such as Acorns, Affirm, Square, and Robinhood. As financial consumers have increasingly moved their activities from analogue to digital, with a recent survey showing that 78 percent of Americans now prefer to bank digitally, fintech companies have proliferated.

In this online financial frenzy, which is set to hit its apex during the Cyber Monday sales, it is easy to overlook one thing that is being bought and sold: data about consumers.

What many users do not realize when signing up for fintech services is just how much sensitive financial data they are surrendering. Typically, once a customer links their bank account to a fintech app, it can access and collect financial data through provisions in their terms of service. Glancing at the privacy policy of your typical fintech app reveals a laundry-list of data points being collected about you.

READ MORE HERE