PROTECTED Act

This bill changes how lenders collect and report small business loan data. It says lenders can ask owners for certain personal details the consumer bureau requires, but the owner does not have to answer, and saying yes or no will not affect the loan decision . It pushes the consumer bureau to set clear rules before deleting or changing any published data, and to explain how those changes protect privacy . Lenders are not allowed to guess an owner’s personal traits by sight or other means if the owner didn’t provide them, and regulators can’t judge a lender based on how many applicants chose to answer these questions .

The bill sets who counts as a “financial institution” for these rules, mainly larger lenders that made at least 2,500 small business credit deals in each of the past two years, and it leaves out smaller banks under $10 billion in assets, Farm Credit System institutions, community development financial institutions, and many equipment or vehicle lenders. It also defines a “small business” as one with $1,000,000 or less in revenue last year . There is a delayed start: the rules begin three years after the consumer bureau finishes certain cost and paperwork reviews, and there’s a two-year period after that when the bureau won’t enforce these parts yet .

Key points

• Who is affected: Larger lenders making many small-business loans; small businesses with $1,000,000 or less in annual revenue .
• What changes: Owners can choose not to share personal details; lenders can’t guess those details; compliance can’t be judged by response rates; privacy steps must be explained before data is changed or deleted .
• When: Starts three years after required reviews are completed, with an additional two-year non-enforcement period .