CFPB officials said the proposal would expand the number of companies currently subject to the Fair Credit Reporting Act -- a 1970 law governing the privacy of consumer data provided to lenders -- to cover the use of data derived from payment histories, personal income and criminal records.