# Amendments Relating to Disclosure of Records and Information > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2020-24113 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** November 24, 2020 - **Citation:** 85 FR 75194 ## Text BUREAU OF CONSUMER FINANCIAL PROTECTION 12 CFR Parts 1070 and 1091 [Docket No. CFPB-2016-0039] RIN 3170-AA63 Amendments Relating to Disclosure of Records and Information AGENCY: Bureau of Consumer Financial Protection. ACTION: Final rule. SUMMARY: This final rule amends the Bureau's rule regarding the confidential treatment of information obtained from persons in connection with the exercise of its authorities under Federal consumer financial law. DATES: This final rule is effective December 24, 2020. FOR FURTHER INFORMATION CONTACT: David Snyder, Senior Counsel, Legal Division, 202-435-7758. If you require this document in an alternative electronic format, please contact CFPB_Accessibility@cfpb.gov. SUPPLEMENTARY INFORMATION: I. Background The Bureau of Consumer Financial Protection (Bureau) was established by title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Pub. L. 111-203, codified at 12 U.S.C. 5301 et seq. ) (Dodd-Frank Act). The Dodd-Frank Act, among other things, directed the Bureau to “prescribe rules regarding the confidential treatment of information obtained from persons in connection with the exercise of its authorities under Federal consumer financial law.” 12 U.S.C. 5512(c)(6)(A). In order to establish safeguards for protecting the confidentiality of information, as well as procedures for disclosing information as appropriate, the Bureau published an interim final rule on July 28, 2011, 76 FR 45371 (Jul. 28, 2011), followed by a final rule on February 15, 2013, 78 FR 11483 (Feb. 15, 2013). The Bureau also made limited revisions to the rule during that period, related to the treatment of privileged information. See Notice of Proposed Rulemaking, Confidential Treatment of Privileged Information, 77 FR 15286 (Mar. 15, 2012); Final Rule, Confidential Treatment of Privileged Information, 77 FR 39617 (July 5, 2012). Based on its experience over the previous several years, the Bureau published a notice of proposed rulemaking on August 24, 2016, 81 FR 58310 (Aug. 24, 2016), that proposed to amend the rule to clarify, correct, and amend certain provisions of the rule, and it solicited comments on the proposal. The Bureau issued a final rule on September 12, 2018, 83 FR 46075 (Sept. 12, 2018), that pertained to the portions of the Bureau's proposal related to the Freedom of Information Act, 5 U.S.C. 552, the Privacy Act of 1974, 5 U.S.C. 552a, and requests for Bureau information in legal proceedings. The Bureau now issues this final rule to address the portions of its proposal regarding the confidential treatment of information obtained from persons in connection with the exercise of its authorities under Federal consumer financial law. II. Summary of the Final Rule The final rule revises subparts A and D of section 1070 of title 12 of the Code of Federal Regulations. The revisions to subpart A address definitions of terms that are used throughout the remainder of the part. The Bureau has revised several of these definitions to clarify their intended meanings as well as Bureau practices. The Bureau has also included one new definition and deleted one definition in the final rule. The Bureau declines to finalize one new definition, “agency,” which was proposed in the notice of proposed rulemaking. The revisions to subpart D pertain to the protection and disclosure of confidential information that the Bureau generates and receives during the course of its work. Various provisions of the Dodd-Frank Act require the Bureau to promulgate regulations providing for the confidentiality of certain types of information and protecting such information from public disclosure. The Bureau has sought to provide the maximum protection for confidential information, while ensuring its ability to share or disclose information to the extent necessary to achieve its mission. The Bureau has included detailed procedures in its final rule in order to promote transparency regarding its practices and anticipated uses of confidential information. The Bureau has sought to balance concerns regarding the need to protect confidential information, including sensitive personal information, business information, confidential investigative information (CII) and confidential supervisory information (CSI), against the need to use and disclose certain information in the course of its work or, as appropriate, the work of other agencies with overlapping statutory or regulatory authority. The Bureau has revised subpart D to clarify, correct, and amend certain aspects of the rule based on its experience over the last several years. In response to comments, the Bureau has declined to finalize, or has further revised, several of the revisions initially proposed in its notice of proposed rulemaking. In particular, the Bureau has in part declined to finalize, and in part further revised, its proposal to address disclosure of confidential investigative information in § 1070.42. In addition, the Bureau has declined to finalize its proposal to revise its standard for discretionary disclosure of confidential supervisory information to partner agencies under § 1070.43(b)(1). III. Overview of Comments Received The Bureau received twenty-seven comment letters in response to the notice of proposed rulemaking. Twenty-three of the comments addressed its proposal related to the confidential treatment of Bureau information, including proposed definitions in subpart A and proposed revisions to subpart D. 1 Twelve of these comment letters were submitted on behalf of industry trade associations. Three of these comment letters came from public interest organizations; two comment letters from individual financial institutions; one comment letter from a consumer advocacy organization; one comment letter from a consulting organization; one comment letter from an individual; two comment letters from a member of Congress; and one comment letter from a group of State attorneys general. 1 The Bureau received four comment letters that only addressed its proposal related to the Freedom of Information Act. The Bureau also received one comment letter that was unrelated to the notice of proposed rulemaking. Commenters generally expressed concerns about whether the rule, as proposed, would sufficiently protect sensitive information, including CSI. In particular, numerous commenters took issue with the Bureau's proposal to expand discretion under 12 CFR 1070.43(b) to disclose CSI to agencies that may not have “jurisdiction” over the supervised financial institution. Commenters also expressed concerns with a proposed new definition of “agency” in 12 CFR 1070.2, which they believed to be overly broad. Commenters expressed a variety of policy concerns with these proposals, and a number of commenters argued that the Bureau lacks statutory authority to make these revisions, disagreeing with the Bureau's interpretation of 12 U.S.C. 5512(c)(6), which was articulated in support of the proposal. One commenter expressed support for the Bureau expanding its discretion to disclose CSI. A number of commenters also expressed concerns about a Bureau proposal to expand 12 CFR 1070.42 to address the Bureau's disclosure of CII in the course of its enforcement activities, and limitations on further disclosure of CII. Several of these commenters argued that the proposal's restrictions on further disclosure of CII would constitute a content-based restriction and a prior restraint on speech and would run afoul of the First Amendment's free speech protections. Commenters also articulated various reasons why a recipient of CII may need or want to further disclose CII. Comment letters expressed various other concerns regarding the Bureau's proposal as well. These included concerns with, among other things, a proposal to eliminate a requirement that Bureau contractors and consultants provide written certification that they will comply with legal requirements associated with confidential information; a proposal that would have allowed the Bureau to disclose CSI or CII concerning a person to its service providers; proposed changes to Bureau procedures for processing requests from partner agencies for confidential information; a proposed change to procedures regarding Bureau disclosure of confidential information to Congress; a proposal that would have allowed the Bureau to disclose confidential information “related to” an administrative or court proceeding to which the Bureau is a party; and a proposal to require persons in possession of confidential information to report to the Bureau improper disclosures of confidential information. IV. Legal Authority The Bureau proposed the rule pursuant to its authority under (1) title X of the Dodd-Frank Act, 12 U.S.C. 5481 et seq., including (a) section 1022(b)(1), 12 U.S.C. 5512(b)(1); (b) section 1022(c)(6)(A), 12 U.S.C. 5512(c)(6)(A); and (c) section 1052(d), 12 U.S.C. 5562(d); (2) the Freedom of Information Act, 5 U.S.C. 552; (3) the Privacy Act of 1974, 5 U.S.C. 552a; (4) the Right to Financial Privacy Act, 12 U.S.C. 3401 et seq.; (5) the Trade Secrets Act, 18 U.S.C. 1905; (6) 18 U.S.C. 641; (7) the Paperwork Reduction Act, 44 U.S.C. 3501 et seq., and (8) the Federal Records Act, 44 U.S.C. 3101. The Bureau received no comments on the applicability of these statutes, and it promulgates the final rule pursuant to these authorities. V. Section-by-Section Analysis Part 1070—Disclosure of Records and Information Subpart A—General Provisions and Definitions Section 1070.2—General Definitions Proposed Section 1070.2(a) Agency In the notice of proposed rulemaking, the Bureau proposed adding a new definition, “agency,” which it proposed to include “a Federal, State, or foreign governmental authority or an entity exercising governmental authority.” The Bureau declines to finalize this proposal. As previously drafted, § 1070.43 provided the Bureau with discretion to share confidential information with Federal or State agencies in certain circumstances. The proposed definition, combined with proposed revisions to §§ 1070.43 and 1070.45, was intended to clarify the Bureau's ability to share confidential information with a broader category of entities with whom the Bureau may at times collaborate in the course of carrying out its authorities under Federal consumer financial laws. The Bureau stated in its proposal that this could include registration and disciplinary organizations like State bar associations. Proposed revisions to § 1070.47 also expanded protections for confidential information disclosed under subpart D to include information shared with these additional entities. Finally, the Bureau proposed additional technical corrections throughout the rule to account for use of the new term. 2 2 The Bureau also proposed renumbering the definitions in § 1070.2 to account for the addition and subtraction of various definitions. The Bureau received a number of comment letters regarding this proposed definition, with particular emphasis on its interaction with proposed revisions to § 1070.43 regarding the Bureau's discretionary disclosure of confidential information (including confidential supervisory information) to other agencies. 3 Commenters largely took issue with the proposed definition's inclusion of “entit[ies] exercising governmental authority,” though several expressed concerns regarding its inclusion of “foreign governmental authorit[ies]” as well. 3 See below for discussion of comments regarding proposed § 1070.43(b)(1). Several commenters stated that the proposed definition was overly broad. Commenters expressed concerns that non-governmental entities may lack jurisdiction over the persons that initially provided information to the Bureau, and that foreign agencies may not be subject to United States law. For example, one comment letter, from a group of industry trade associations, criticized the proposal's inclusion of “entit[ies] exercising governmental authority” as “limitless;” it stated that the Bureau provided no limitation on its interpretation of the term, and suggested that, in addition to State bar associations, it could include medical societies, national associations of State regulatory bodies (such as insurance or utility commissioners), or municipal entities (such as housing or transportation authorities). Another commenter suggested that the term could include quasi-governmental organizations such as State or local task forces, boards, commissions, licensing bodies, ombudsmen, self-regulatory organizations, or courts. Two industry trade association commenters questioned how confidential information from financial institutions could be relevant to entities like State bar associations—such as where the institution does not engage in the practice of law, or where the entity would not generally have authority over financial institutions. One comment letter, from an industry trade association, criticized the proposed definition as outside the intended and normal usage of the term “agency.” It argued that the term unambiguously means a governmental entity with legal authority to supervise and regulate the individual or company to whom confidential supervisory information relates, and the Bureau lacks authority to expand the definition to include entities that, in the commenter's view, are clearly not agencies. It stated that while a State bar association may exercise governmental authority, it is a non-governmental, voluntary professional membership organization, and is not an agency. The commenter also analogized that the term “agency,” when used in the regulatory context (such as in the Administrative Procedure Act, 5 U.S.C. 551) refers to entities with administrative legal authority, and that section 342(g) of the Dodd-Frank Act defines “agency” to refer to specific financial regulatory bodies. 4 4 Section 342 of the Dodd-Frank Act establishes Offices of Minority and Women Inclusion in enumerated Federal financial regulators. Several commenters expressed concerns about the Bureau's authority to promulgate the proposed definition. One comment letter, from an industry trade association, stated that there is no legislative history to support a conclusion that the Bureau has discretion to share confidential information with “entities exercising governmental authority.” Two comment letters, from an industry trade association and a group of industry trade associations, argued that 12 U.S.C. 5512(c)(6), which discusses Bureau disclosure of CSI to certain agencies, does not mention non-U.S. agencies or quasi-governmental authorities. One comment letter, from a member of Congress, suggested that the Bureau's proposed definition was meant to unlawfully expand its authority to share confidential supervisory information with entities that lack jurisdiction over the companies, including foreign regulators and entities that exercise governmental authority. Several comment letters from industry trade associations argued that the Bureau's proposal provides insufficient rationale for, or clarity regarding, its proposed definition. One of these commenters suggested that sharing confidential supervisory information with non-regulatory or non-governmental entities is unnecessary for enforcement or supervisory purposes. Another commenter suggested that the Bureau publish a list of entities “exercising governmental authority,” and concrete examples about how the Bureau intends to share confidential information with them and how such sharing would advance the Bureau's purposes. This commenter also suggested that the Bureau provide more information regarding its procedures for sharing information with foreign agencies and create a procedure for institutions to challenge a proposed disclosure with a presumption in favor of nondisclosure. The Bureau also received two comment letters, from a group of industry trade associations and an industry trade association, raising concerns that non-regulatory or non-governmental entities may have insufficient information security, protections, controls, or expertise to protect the Bureau's confidential information. A third comment letter, from a financial institution, expressed similar concerns that the disclosure of confidential information to such entities could unintentionally result in exposing the information to the public. One comment letter, from an industry trade association, suggested that the disclosure of confidential information to bar associations would lead to further disclosure to the plaintiffs' bar and use in litigation against the financial institution at issue. One comment letter, from a group of industry trade associations, suggested that the proposed definition could raise tensions with other laws. It stated that the proposal would lead to financial institutions “effectively sharing information in a manner that is inconsistent” with Regulation P, 12 CFR part 1016, and the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., because it would enable certain entities to obtain data that they could not otherwise obtain from the financial institution itself. The commenter also suggested that the proposal would allow sharing of confidential information, including personally identifiable information about non-U.S. individuals, in a manner that could be inconsistent with non-U.S. privacy rules and other non-U.S. laws, though it did not identify specific laws or explain how the proposal would conflict. Finally, one commenter expressed concern regarding the Bureau's inclusion of foreign regulators in its proposal, noting that the proposal differed from the Federal Trade Commission's (FTC's) practices, which include certain restrictions on disclosures to foreign governments. In response to the comments received, the Bureau declines to include the proposed definition, “agency,” in the final rule. The Bureau likewise declines to finalize the technical corrections and renumbering proposed to account for the new definition. Any use of the word “agency(ies)” in subpart D will not be capitalized because the final rule does not define the term. The proposal's inclusion of “entit[ies] exercising governmental authority” had been intended primarily to facilitate limited and occasional collaboration in the course of carrying out the Bureau's enforcement activities. However, the Bureau recognizes that the defined term's use in provisions that address its disclosure of confidential supervisory information could give the impression that the Bureau intends to disclose confidential supervisory information to these entities as well. The Bureau also recognizes that the potential breadth of the proposal could create uncertainty and undermine confidence that information provided to the Bureau will be used and protected appropriately. In light of the minimal benefit of finalizing the proposal, relative to these concerns and others expressed in the comments received, the Bureau declines to include this proposed text in the final rule. The Bureau included “foreign governmental authorit[ies]” in the proposed definition because Bureau enforcement and supervisory activities occasionally require it to coordinate with foreign government regulators, such as where a transnational entity engages in related activities in multiple jurisdictions, or where an entity abroad interacts with U.S. consumers from a foreign location. The Bureau disagrees with commenters' contention that it lacks statutory authority to promulgate a regulation that authorizes disclosure of confidential information to foreign regulators. The Bureau has broad authority under 12 U.S.C. 5512(c)(6)(A) to draft regulations regarding the confidential treatment of information that it obtains from persons in connection with the exercise of its authorities under Federal consumer financial laws. Even assuming that this rulemaking authority is restricted by section 5512(c)(6)(C)(ii)—which says the Bureau “may, in its discretion, furnish to a prudential regulator or other agency having jurisdiction over a covered person or service provider any other report or confidential supervisory information concerning such person examined by the Bureau under the authority of any other provision of Federal law”—disclosure to foreign regulators is consistent with this provision. First, section 5512(c)(6)(C)(ii) does not address, and thus does not limit disclosure of, confidential investigative information or other confidential information that is not CSI. Second, the provision's reference to “other agency having jurisdiction” is not expressly restricted to domestic agencies and can reasonably be read to include foreign agencies with jurisdiction over the supervised financial institution. Nevertheless, while the Bureau believes that it has authority to disclose confidential information to foreign regulators, it declines to expressly address such disclosures in the rule because, historically, its need to make these disclosures has been extremely rare. Revising the regulation to allow disclosure of confidential information to foreign regulators under the Bureau's standard information-sharing processes addressed in § 1070.43 risks leaving a mistaken impression that such disclosures will take place with regularity. Instead, in the event that the Bureau identifies a future need to share confidential information with a foreign regulator, and it cannot otherwise make the disclosure pursuant to subpart D, it will do so pursuant to § 1070.46, which permits the Bureau's director to authorize disclosure of confidential information other than as set forth in subpart D. The authorization must be in writing, must otherwise be permitted by law, and may not be delegated. See 12 CFR 1070.46(a), (c). The Bureau recognizes that disclosure of confidential information to a foreign regulator warrants special considerations, such as the regulator's ability to protect the information under its country's laws. And to the extent that the confidential information includes sensitive information, such as privileged information, proprietary information, or consumers' personal information, the Bureau will take that into consideration as well and will appropriately limit the scope of its disclosure. The Bureau intends to exercise its discretion to disclose confidential information to foreign regulators with caution, subject to appropriate confidentiality assurances and only when needed to support Bureau mission needs such as enhancing consumer protection. Limiting such disclosures to the Director's authority under § 1070.46 reflects this commitment by requiring decision-making to take place at the Bureau's highest level. For the aforementioned reasons, the Bureau declines to finalize the proposed definition of “agency.” Section 1070.2(a) Associate Director for Supervision, Enforcement and Fair Lending The Bureau proposed adding a new definition for “Associate Director for Supervision, Enforcement and Fair Lending” in order to clarify the meaning of a term already used in the rule, as well as several times in the proposed revisions to the rule. The Bureau received no comments regarding this proposal, and it finalizes the proposal without modification. Former Section 1070.2(e) Civil Investigative Demand Material Former § 1070.2(e) defined the term “civil investigative demand material.” The Bureau proposed eliminating this definition and instead incorporating it into the definition of “confidential investigative information” in § 1070.2(h). The Bureau explained that, because the term “civil investigative demand material” only arose in the rule in § 1070.2(h), the separate definition was unnecessary. The Bureau received no comments regarding the elimination of this definition, and it finalizes the proposal without modification. 5 5 See below for discussion of comments regarding the definition of “confidential investigative information” in § 1070.2(h). Section 1070.2(f) Confidential Information Section 1070.2(f) defines the term “confidential information.” Confidential information refers to three defined categories of non-public information—confidential consumer complaint information, confidential investigative information, and confidential supervisory information—as well as other Bureau information that may be exempt from disclosure pursuant to one or more of the statutory exemptions to the FOIA. Confidential information does not include information contained in records that have been made publicly available or otherwise publicly disclosed by the Bureau. The Bureau proposed revising the definition to clarify that such appropriate disclosures may be made by either Bureau employees or other authorized agents of the Bureau. An unauthorized disclosure of information would not affect the information's confidentiality. In addition, the Bureau proposed revising the definition to clarify that confidential information disclosed to a third party in accordance with subpart D shall remain the Bureau's confidential information. The Bureau received no comments regarding this proposal, and it finalizes the proposal without modification. Section 1070.2(g) Confidential Consumer Complaint Information Section 1070.2(g) defines the term “confidential consumer complaint information.” The Bureau proposed expanding the definition to include any information received or generated by the Bureau through processes or procedures established under 12 U.S.C. 5493(b)(3). The Bureau has found that its Consumer Response system at times receives misdirected complaints for which it lacks authority to act, or complaints submitted by companies rather than consumers. The proposed revision was intended to clarify that any complaints submitted to the Bureau through its Consumer Response system, and any information generated therein, are similarly classified under its confidentiality rules and subject to the same confidentiality protections. The proposal did not alter the prior text which limits confidential consumer complaint information to only include information that is exempt from disclosure pursuant to 5 U.S.C. 552(b). One comment letter, from an industry trade association, expressed support for this proposal, which it described as an important safeguard for companies that may be named erroneously in consumer complaints submitted to the Bureau. The Bureau finalizes the proposal without modification. Section 1070.2(h) Confidential Investigative Information Section 1070.2(h) defines the term “confidential investigative information.” As discussed above with respect to former § 1070.2(e), the Bureau proposed incorporating the definition of “civil investigative demand material” into § 1070.2(h). In addition, we proposed revising the term to clarify that confidential investigative information includes any information obtained or generated in the course of Bureau enforcement activities, including general investigative activities that may not pertain to a specific institution. The Bureau also proposed replacing § 1070.2(h)(2)'s reference to “materials” with “documents, materials, or records” in order to parallel similar language in the definition of “confidential supervisory information” at § 1070.2(i)(2). An industry trade association criticized this proposal, alleging that it would “greatly expand” the definition of CII. The trade association argued that the revision would now include any information that may reveal the existence of communication between the Bureau and a company in the enforcement context, including the existence of a civil investigative demand (CID). The commenter expressed concerns that any such information would be subject to the Bureau's discretionary authority to share confidential information. The Bureau does not agree that its proposed revisions to the definition of CII would significantly expand it. The Bureau merely proposed to incorporate the text of the definition of “civil investigative demand materials” into the definition of “confidential investigative information” to eliminate the need for a separate defined term. It further proposed minor revisions to refine and clarify the definition's text, such as making clear that CII can be obtained or generated in the course of general investigative activities that may not pertain to a specific institution. The Bureau did not propose substantive changes along the lines described by the commenter. The commenter appears to take issue with the definition's inclusion of information “derived from” materials otherwise considered CII. However, this text predated the notice of proposed rulemaking and it is not new. Other than the non-substantive replacement of the word “documents” with “materials,” the Bureau's proposed revisions did not impact this text or its meaning. The Bureau also disagrees with the commenter's implication that classifying information as “confidential investigative information” reduces its protections because the Bureau has procedures for sharing confidential information with partner agencies. On the contrary, classification of information as “confidential” restricts the Bureau's disclosure (rather than expanding it) because it renders the information subject to subpart D's protections. Where information is not considered “confidential,” the rule's protections do not attach to it, and the Bureau may share it with agency partners without taking into account the limitations and protections of the rule. For the aforementioned reasons, the Bureau finalizes the proposal without modification. Section 1070.2(i) Confidential Supervisory Information Section 1070.2(i) defines the term “confidential supervisory information.” The Bureau proposed revising § 1070.2(i)(1)(i) to clarify that the term includes supervisory letters and similar documents. Since adopting the current definition of “confidential supervisory information,” the Bureau has refined the formats it uses for summarizing and memorializing the results of an examination or other supervisory review of a supervised financial institution. The Bureau currently issues different types of documents, including examination reports and supervisory letters, to convey the results of its examinations and other supervisory reviews. These documents are the property of the Bureau and are provided to the supervised financial institution for its confidential use only. In addition, the Bureau proposed revising § 1070.2(i)(1)(ii) to state that, in addition to “documents” prepared by, or on behalf of, or for the use of the Bureau or any other Federal, State, or foreign government agency in the exercise of its supervisory authority over a financial institution, confidential supervisory information also includes “materials[ ] or records” prepared by, or on behalf of, or for the use of the Bureau or any other Federal, State, or foreign government agency in the exercise of its supervisory authority over a financial institution. This revision was intended to clarify that any such physical materials can include confidential supervisory information, regardless of the format. Likewise, the Bureau proposed revising the definition to include information derived from such “materials[ ] or records.” We noted in the notice of proposed rulemaking that information “derived” from such documents, materials, or records could include either physical materials (such as other documents, materials, or records) or information known to individuals (such as oral testimony or interviews based on knowledge gleaned from the documents, materials, or records). In addition, the Bureau proposed revising § 1070.2(i)(1)(iv) to delete the reference to information collected using the Bureau's authority to monitor for risks to consumers in the offering or provision of consumer financial products or services under 12 U.S.C. 5512(c)(4) (sometimes referred to as the Bureau's “market monitoring” authority). The Bureau explained that, in accordance with the definition of “confidential information” in § 1070.2(f), market monitoring information would continue to be classified and protected as “confidential information” to the extent that it is exempt from disclosure pursuant to one or more of the statutory exemptions to the FOIA. The Bureau proposed replacing the “market monitoring” reference in § 1070.2(i)(1)(iv) with new language stating that confidential supervisory information includes information obtained by the Bureau “for purposes of detecting and assessing risks to consumers and to markets for consumer financial products or services pursuant to 12 U.S.C. 5514(b)(1)(C), 5515(b)(1)(C), and 5516(b).” The purpose of this revision was to clarify that confidential supervisory information continues to include information obtained by the Bureau under its supervisory authorities at 12 U.S.C. 5514(b)(1)(C), 5515(b)(1)(C), and 5516(b). The Bureau had previously interpreted § 1070.2(i)(1)(iv) to address information obtained using these authorities as well as information obtained using its market monitoring authority, and the proposal was intended to retain the former, but exclude the latter. Finally, the Bureau proposed deleting § 1070.2(i)(2), which previously stated that confidential supervisory information does not include documents prepared by a supervised financial institution for its own business purposes and that the Bureau does not possess. This provision was intended to prevent any implication that a supervised financial institution's copies of internal documents would be deemed to be confidential supervisory information on the grounds that those documents had been submitted to the Bureau in the course of a Bureau supervisory process. The Bureau explained that because this interpretation already follows from the other provisions of the rule, including the definition of “confidential supervisory information,” the explicit inclusion of this exception is unnecessary. The Bureau proposed renumbering § 1070.2(i) in light of this revision. In response to the Bureau's proposal, one comment letter, from a group of industry trade associations, requested further guidance regarding the type of information that the Bureau considers to be “derived from” confidential supervisory information and therefore subject to the term's definition. For example, in a scenario where a supervised financial institution undertakes a project in response to Bureau concerns expressed in the course of supervision, the commenter asked whether the institution's work plan would be considered CSI. The commenter stated that such guidance is particularly important in light of the Bureau's proposal to delete § 1070.2(i)(2), which previously stated that confidential supervisory information does not include documents prepared by a supervised financial institution for its own business purposes and that the Bureau does not possess. Where a supervised financial institution generates an internal work plan as part of its efforts to address Bureau supervisory concerns, information in the work plan that is “derived from” the types of documents, materials, or records described in § 1070.2(i)(1) and (2) is CSI. For example, an internal document may reveal a Bureau compliance rating, a Bureau supervisory finding, a supervisory “Matter Requiring Attention,” or other confidential information that is contained in documents, materials, or records prepared by, or on behalf of, or for the use of the Bureau. This information is CSI even where it is contained in an internal document that is not shared with the Bureau (for example, minutes of an internal discussion). Certain work plans or other documents generated by a supervised financial institution in the course of a project undertaken in response to Bureau supervision may constitute CSI because they are “prepared . . . for the use of the [Bureau]” as described in § 1070.2(i)(2). For example, updates or progress reports generated at the request of the Bureau and submitted to the Bureau by an institution as part of the Bureau supervisory process are generally CSI. On the other hand, work plans or other internal documents such as official business policies are not “derived from” the types of documents, materials, or records described in § 1070.2(i)(1) and (2) simply because they are created, adopted, or modified in response to Bureau supervision. A work plan that does not reveal the content or existence of confidential supervisory communications need not be treated as containing CSI. In addition, as explained above, the Bureau does not intend the deletion of § 1070.2(i)(2) to substantively alter the meaning of “confidential supervisory information.” Rather, we consider the paragraph to be superfluous because its substance is implied by the remainder of the rule. The Bureau does not consider “confidential supervisory information” to include documents prepared by a supervised financial institution for its own business purposes, which do not include communications or information about the Bureau's supervisory process, and that the Bureau does not possess. As the Bureau explained in its notice of proposed rulemaking, should a supervised financial institution submit copies of such documents to the Bureau in the course of a Bureau supervisory process, the copies of the documents in the Bureau's possession would be Bureau confidential supervisory information. However, submission of those documents to the Bureau does not convert the copies of those documents that are in the possession of the financial institution into Bureau confidential information. To the extent that institutions have additional questions along these lines, the Bureau encourages them to contact appropriate Bureau regional staff for further guidance. In addition to the request for guidance, the Bureau received two comment letters from industry trade associations that expressed concerns with the proposal's removal of information collected using the Bureau's market monitoring authority at 12 U.S.C. 5512(c)(4) from the definition of “confidential supervisory information.” One commenter expressed concerns that removing market monitoring information from the definition of CSI could result in disclosure of market monitoring information under the Freedom of Information Act. It argued that FOIA exemptions that do not pertain to confidential supervisory information provide less protection because they are subject to more agency discretion. The second commenter disagreed with the Bureau's reasoning, expressed in the notice of proposed rulemaking, that it is unnecessary to classify market monitoring information as CSI where the information is not used for supervisory purposes. The commenter argued that, with respect to supervised financial institutions, the Bureau has authority to collect the same information either through its market monitoring authority at 12 U.S.C. 5512(c)(4) or through its various supervisory authorities, and it expressed concerns that these different methods would provide different protections. With respect to the first comment, the Bureau does not agree that re-classifying categories of confidential information in the rule would alter the applicability of exemptions under the FOIA. The FOIA establishes a judicially enforced statutory regime that is distinct from the Bureau's treatment of confidential information. The FOIA exemption that pertains to the supervision of financial institutions, 5 U.S.C. 552(b)(8) (Exemption (b)(8)), exempts from disclosure records “contained in, or related to, examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions.” Market monitoring information, which may be unrelated to the Bureau's supervision of financial institutions, is not necessarily subject to this exemption, regardless of whether the Bureau has a regulation that labels it “confidential supervisory information.” If Exemption (b)(8), or any other FOIA exemption, applies to market monitoring information, then under the Bureau's proposal it will be protected both from disclosure under the FOIA and pursuant to the Bureau's confidentiality rules. However, categorically classifying market monitoring information as CSI would not prevent the information's disclosure pursuant to a FOIA request in the event that no FOIA exemption can apply to it—for example, information collected for a study that is publicly available on the internet. The comment's conflation of the FOIA and the Bureau's independent confidentiality protections highlights the need for the proposed revision, in order to improve transparency and manage expectations related to the protections that attach to information collected by the Bureau. The Bureau disagrees with the second commenter's argument as well. The comment letter correctly states that the Bureau could, conceivably, collect certain information under its 12 U.S.C. 5512(c)(4) market monitoring authority, or its 12 U.S.C. 5514(b), 5515(b), or 5516(b) supervisory authorities. While the commenter suggests that this counsels treating the information the same in all events, the Bureau thinks otherwise. Congress intentionally drafted the Dodd-Frank Act to provide the Bureau with distinct authorities to collect information for distinct purposes. The Bureau's proposal would categorize information in accordance with the authority used to collect the information and the information's intended use. Rather than conflating its authorities and uses, the proposal would improve transparency about the Bureau's classification and treatment of information. Furthermore, even if the Bureau does not label it “confidential supervisory information,” market monitoring information will continue to be protected as confidential information to the extent that it is exempt from disclosure under the FOIA—in particular, information that contains confidential business information or personal information. See 5 U.S.C. 552(b)(4) & (6). Such information would largely be subject to the same protections accorded to CSI by the Bureau's confidentiality rules. And for the reasons already discussed, classifying this information as Bureau CSI would not protect it from disclosure under the FOIA to the extent that it is not actually subject to any exemption to the FOIA. For the aforementioned reasons, the Bureau finalizes the proposal without modification. Section 1070.2(k) Employee Section 1070.2(k) defines the term “employee.” The Bureau proposed revising the definition to clarify that, for purposes of this rule, Bureau “employees” include certain contract personnel and employees of the Bureau's Inspector General. The Bureau received one comment letter, from an industry trade association, expressing concern that classifying employees of the Bureau's Inspector General as “employees” could restrict the employees' ability to disclose confidential information and impair their ability to perform their jobs. For example, the commenter argued that § 1070.41 could prevent the Bureau's Inspector General from publishing reports regarding the Bureau's examination or supervision process, or other internal workings of the Bureau. The Bureau disagrees with this commenter's concerns. Classifying employees of the Bureau's Inspector General as “employees” under the rule clarifies that Inspector General employees may access confidential information consistent with the rule. Furthermore, the Bureau does not agree with the commenter's concerns regarding § 1070.41's restrictions, as § 1070.41(c) allows for the publication of reports derived from confidential information to the extent that they do not identify, either directly or indirectly, any particular person to whom the information pertains. This concern is also addressed by proposed § 1070.48, which states that subpart D does not prohibit the Inspector General's office from disclosing confidential information “as needed in accordance with the Inspector General Act of 1978, 5 U.S.C. App. 3.” 6 6 See below for additional discussion of comments regarding disclosures of confidential information by the Inspector General's office under § 1070.48. For the aforementioned reasons, the Bureau finalizes this proposal without modification. Subpart D—Confidential Information Section 1070.41 Non-Disclosure of Confidential Information Section 1070.41(b) Disclosures to Contractors and Consultants Section 1070.41(b) provides that contractors and consultants may only receive confidential information if they certify in writing to treat the confidential information in accordance with these rules, Federal laws and regulations that apply to Federal agencies for the protection of the confidentiality of personally identifiable information and for data security and integrity, as well as any additional conditions or limitations that the Bureau may impose. The Bureau proposed removing the certification requirement and replacing it with an affirmative statement that contractors and consultants are required to follow the obligations previously identified in the certification. The Bureau explained in its proposal that this revision was intended to clarify that contractors and consultants are subject to § 1070.41(b)'s requirements irrespective of any affirmative certification. The Bureau will further revise its proposal in the final rule. In response to this proposal, the Bureau received one comment letter, from an industry trade association, stating that contractors and consultants should continue to be required to provide the written certification, to help them understand the gravity of their access to confidential information, and so their nondisclosure obligations can be more easily enforced. The commenter suggested that the Bureau can provide the clarity articulated in its notice of proposed rulemaking while continuing to require such certifications. The Bureau agrees with the commenter that it is a best practice for contractors and consultants to provide a written certification that they will follow the Bureau's confidentiality rules. The Bureau also agrees that this provision can be revised further to both clarify contractors' and consultants' obligations and retain the current certification requirement. The Bureau thus revises the proposed language by adding an additional sentence after the proposed text: “CFPB contractors or consultants may receive confidential information only if such contractors or consultants certify in writing to treat such confidential information in accordance with these requirements.” This will retain the current certification requirement while addressing the need for clarity identified in the notice of proposed rulemaking. Section 1070.41(c) Disclosures of Materials Derived From Confidential Information Section 1070.41(c) addresses the disclosure of materials derived from confidential information. It requires that, when the Bureau discloses such materials, they may not directly or indirectly identify any particular person to whom the confidential information pertains. The Bureau proposed replacing the phrase “[n]othing in this subpart shall limit the discretion of the CFPB” with “[t]he CFPB may . . .” in order to clarify that § 1070.41(c) authorizes such disclosure by the Bureau. The Bureau received no comments regarding this proposal, and it finalizes the proposal without modification. Section 1070.41(d) Disclosures of Confidential Information With Consent The Bureau proposed a new paragraph that, where practicable, authorizes the Bureau to, upon receipt of prior consent, disclose confidential information that directly or indirectly identifies particular persons. The proposed provision would require consent from all such persons to the extent that the identification constitutes confidential information, and any such disclosure would have to comply with applicable law. In the event that the person is a minor child or otherwise lacks capacity to give consent, consent can be provided on that person's behalf by someone with legal authority to give it, such as a parent or guardian, where applicable. The Bureau explained in its notice of proposed rulemaking that it may at times be useful to disclose such information in order to achieve the Bureau's mission objectives, and that by conditioning disclosure on consent, affected persons' interests would be appropriately protected. The Bureau also clarified that this new provision is intended to serve as a distinct authority for disclosure, and that it would in no way impact other methods of disclosure currently addressed in the rule, such as in § 1070.43. The Bureau proposed renumbering the section to account for the new paragraph. The Bureau received no comments regarding this proposal, and it finalizes the proposal without modification. Section 1070.41(e) Nondisclosure of Confidential Information Belonging to Other Agencies Section 1070.41(e) previously provided that nothing in subpart D requires or authorizes the Bureau to disclose confidential information that it has received from other agencies where such disclosure would contravene applicable law or conflict with any agreement between the CFPB and the provider agency. The Bureau further revises this provision in the final rule to address concerns about this provision raised in a comment letter. The Bureau proposed replacing the word “disclosability” in the paragraph's title with “nondisclosure” in order to clarify that this provision protects the confidentiality of other agencies' confidential information; the Bureau explained in its proposal that it did not intend the revision to substantively change the provision. The Bureau received no comments regarding its proposed revision to the paragraph's title. However, the Bureau did receive one comment letter, from a consulting organization, which noted that the Bureau can at times obtain prudential regulators' CSI from financial institutions. The commenter expressed concern that the Bureau could potentially disclose that CSI via other provisions of the rule in ways in which the originating prudential regulator might disagree. The commenter correctly pointed out that, whereas § 1070.41(e), as proposed, addressed information provided directly to the Bureau by another agency, it was silent regarding other agencies' information that the Bureau might obtain indirectly from a third party. The Bureau sees value in providing assurances, to other regulators and to regulated entities, that § 1070.41(e) applies regardless of whether the Bureau received the information from the agency itself or from a third party. To that end, the Bureau is revising the paragraph's text in the final rule. Rather than referencing “confidential information that another agency has provided to the CFPB,” the paragraph will instead pertain to “confidential information belonging to another agency that has been provided to the CFPB (either directly or through a holder of the information such as a financial institution).” The Bureau likewise revises the paragraph's title to reflect this revision. The paragraph further states that the CFPB will not disclose confidential information belonging to another agency “to the extent such disclosure contravenes applicable law or the terms of any agreement that exists between the CFPB and the agency to govern the CFPB's treatment of information that the agency provides to the CFPB.” The Bureau understands the “applicable law” reference to include limits on its further disclosure of information in accordance with other agencies' regulations related to confidential treatment of information. See, e.g., 12 CFR 261.20(a); 12 CFR 4.37(b); 12 CFR 309.6(a); 12 CFR 792.31. We note, though, that § 1070.41(e) does not limit the Bureau's use and disclosure of business records or other company materials simply because that information has also been provided to another agency. Section 1070.42 Disclosure of Confidential Supervisory Information and Confidential Investigative Information Section 1070.42 previously provided that the Bureau may, in its discretion, disclose confidential supervisory information concerning a supervised financial institution or its service providers to that supervised financial institution or its affiliates. In addition, § 1070.42 provided that, unless directed otherwise by the Bureau's Associate Director for Supervision, Enforcement and Fair Lending or by his or her delegee, any supervised financial institution in possession of confidential supervisory information pursuant to this section may further disclose the information to certain recipients, subject to certain conditions. In its notice of proposed rulemaking, the Bureau proposed several discrete changes to this section. First, it proposed expanding the scope of § 1070.42 to also address the Bureau's disclosure of CII in the course of its enforcement activities, as well as the further disclosure of CII by recipients of the information. Second, the Bureau proposed revising § 1070.42(a) to provide that, in addition to disclosing information concerning a person, its affiliates, or its service providers to that person or its affiliates, the Bureau may also disclose such information to that person's service providers. Third, the Bureau proposed revising § 1070.42(b)(2) to allow disclosure of information to insurance providers in certain circumstances without first seeking permission from the CFPB. Finally, the Bureau proposed removing references to the Associate Director for Supervision, Enforcement and Fair Lending's delegee, which was rendered unnecessary due to the new definition of the term “Associate Director for Supervision, Enforcement and Fair Lending” in § 1070.2. Each of these discrete proposals, and the comments responding to them, will be addressed in turn. The majority of the comments submitted to the Bureau regarding § 1070.42 pertained to its proposal to expand the section's scope to address enforcement activities. In response to comments received, the Bureau in part declines to finalize, and in part further revises, this proposal. As the Bureau explained in its notice of proposed rulemaking, it proposed this revision to lend clarity (1) to how the Bureau discloses CII in the course of its enforcement activities, and (2) regarding financial institutions' discretion to further disclose CII. This was intended to reduce confusion caused by the dynamic in the previously promulgated rule, which provided explicit and detailed instructions in the supervisory context, but lacked such specificity in the enforcement context. The Bureau's proposed solution was to mirror the CSI instructions with respect to CII. The Bureau received a number of comment letters expressing concerns about the proposal's limitations on further disclosure of CII. In particular, the Bureau received seven comment letters—four from industry trade associations, two from public interest organizations, and one from a member of Congress—arguing that the proposal would infringe on free speech rights protected by the First Amendment. They stated that the proposal's requirement to obtain permission from the Bureau prior to further disclosing CII (other than as permitted in the section) would constitute a content-based restriction and a prior restraint on speech. For such restrictions to be constitutionally valid, they must be narrowly tailored to meet a compelling government interest, and commenters argued that the Bureau's proposal does not meet this test. Commenters also stated that courts and Congress have required procedural safeguards where agencies have imposed limitations on further disclosure of information regarding their investigative activities, and that the Bureau's proposal did not include such procedures. These comment letters also described free speech benefits that commenters believed the proposal would harm. For example, commenters noted that entities may need to further disclose CII to meet contractual obligations and for other business dealings; to consult with others who may have information relevant to the investigation (such as former employees of the institution); to seek guidance or assistance from a trade association; and to complain to the press, the public and elected officials about perceived government misconduct. Commenters noted that free speech in this context promotes the public interest by enabling accountability and oversight of government, and in turn discouraging government overreach. In addition, two industry trade association commenters and one financial institution commenter argued that the Bureau provided insufficient rationale for its proposal, such as that the Bureau did not detail the confusion that its proposal was intended to resolve. Finally, two commenters—an industry trade association and a member of Congress—argued that the Bureau lacks authority to promulgate its proposal because, in their view, the Bureau's statutory authority for its rule only limits the Bureau's own disclosures of information. One comment letter, from a public interest organization, encouraged the Bureau to state in its final rule that a recipient of CII in the course of an enforcement investigation is not prohibited from further disclosing the CII. The Bureau received one comment letter from a financial institution that was supportive of this proposal because it would lend clarity regarding treatment of CII. The Bureau has evaluated the comments that it received regarding this proposal, and it declines to finalize § 1070.42 as proposed. As explained above, the two purposes of this proposal were to clarify (1) how the Bureau discloses CII in the course of its enforcement activities, and (2) financial institutions' discretion to further disclose CII. Rather than finalize its proposal in full, the Bureau will finalize it in part, and will further revise the section's text in part, in order to achieve these purposes while taking into account the comments that it received. First, in order to clarify how the Bureau discloses CII in the course of its enforcement activities, the Bureau will finalize its proposed revisions to paragraph (a), which addresses the Bureau's own disclosure of confidential supervisory information and confidential investigative information (subject to additional revisions related to disclosures to service providers, discussed below). Although commenters were largely critical of proposed limits on further disclosure of CII, comment letters did not express concerns about the Bureau clarifying its own discretion to disclose CII in the course of its enforcement activities. Second, the Bureau declines to expand paragraph (b)—which addresses further disclosure of CSI—to include CII. Instead, paragraph (b) will retain its previous scope and only address further disclosure of CSI. To effectuate this, the Bureau will revise the paragraph's title to read “Further disclosure of confidential supervisory information.” In addition, the Bureau declines to finalize its proposal to have all references in paragraph (b) to “confidential supervisory information” be accompanied by the phrase “confidential investigative information.” Furthermore, although the Bureau had proposed replacing references to “supervised financial institution” in paragraph (b) with a broader reference to “person” in order to account for recipients of CII, the Bureau declines to make this change because it is unnecessary if paragraph (b) only pertains to further disclosure of CSI. The Bureau finalizes several non-substantive technical revisions that it included in its proposal for clarity, and on which it received no comments. In addition, to clarify that paragraph (b) only authorizes the further disclosure of the Bureau's—and not other agencies'—information, the Bureau revises paragraph (b)(3) to, like (b)(1) and (2), refer to confidential supervisory information “of the CFPB;” and it adds a new paragraph (b)(4), stating that nothing in paragraph (b) authorizes the disclosure of confidential information belonging to another agency. Third, in order to lend greater clarity to financial institutions' discretion to further disclose CII, the Bureau will include a new paragraph (c) in its final rule. This paragraph, titled “Further disclosure of confidential investigative information,” states that “[n]othing in this subpart shall prohibit any person lawfully in possession of confidential investigative information of the CFPB pursuant to paragraph (a) of this section from further disclosing that confidential investigative information.” This paragraph will thus make clear that the Bureau's rule does not prohibit the recipients of the Bureau's CII under paragraph (a) from further disclosing it. 7 The Bureau also inserts “paragraph (a) of” before two references to “this section” in paragraphs (b)(1) and (2), respectively, for clarity and to mirror the specificity in new paragraph (c). 7 The Bureau notes that while it disagrees with two commenters' arguments that its authority under the Dodd-Frank Act to promulgate its confidentiality rules is limited to the Bureau's own disclosure of information, these commenters' arguments are rendered moot by the Bureau's revision in the final rule. The Bureau proposed several other revisions to § 1070.42 in its notice of proposed rulemaking that garnered fewer comments. For instance, the Bureau proposed revising § 1070.42(a) to provide that, in addition to disclosing information concerning a person, its affiliates, or its service providers to that person or its affiliates, the Bureau may also disclose such information to that person's service providers. In proposing this change, the Bureau reasoned that such information may at times be relevant to supervision or enforcement activities related to service providers. The Bureau declines to finalize this proposal in the final rule. The Bureau received several comment letters expressing concerns about this proposal. Two comment letters, from an industry trade association and from a financial institution, expressed concern that disclosure of CSI or CII by the Bureau to an institution's service providers could lead to unintended consequences, particularly if the disclosure includes attorney-client privileged materials or proprietary information obtained from the financial institution. Another comment letter, from an industry trade association, argued that such disclosures could interfere with contractual relations between the financial institution and its vendors, and expressed concern that disclosures of preliminary allegations of wrongdoing could “poison the well” with the vendor. This commenter suggested that the financial institution, and not the Bureau, should determine when service providers should have access to confidential information. In response to these comments, the Bureau declines to finalize this proposal, and the final rule will instead contain the status quo text, unmodified (subject to revisions to § 1070.42(a) related to the Bureau's disclosure of CII, discussed above), which only authorizes disclosure to a person or its affiliates. The Bureau declines to address disclosure of CSI or CII to a person's service provider in the rule because, historically, its need to make such disclosures has been extremely rare. Revising the regulation to allow Bureau staff to disclose such CSI or CII to service providers pursuant to § 1070.42(a) risks leaving a mistaken impression that these disclosures will take place with regularity. Instead, in the event that the Bureau identifies a future need to share CSI or CII pertaining to a person with its service provider, and it cannot otherwise make the disclosure pursuant to subpart D, it will do so pursuant to § 1070.46, which permits the Bureau's Director to authorize disclosure of confidential information other than as set forth in subpart D. The authorization must be in writing, must otherwise be permitted by law, and may not be delegated. See 12 CFR 1070.46(a), (c). The Bureau anticipates that, for example, we may need to disclose CSI obtained from a financial institution to that institution's service provider in limited circumstances where we identify problems at a supervised service provider through the supervision of its client. We anticipate such disclosures to be rare, such as where CSI pertains to the service provider and the service provider is subject to the Bureau's supervisory authority. In instances such as these, where disclosure pertains to the Bureau's authority over the service provider, it should be in the Bureau's purview to make the disclosure. However, the Bureau appreciates commenters' concerns, such as that the Bureau could “poison the well” or otherwise make these disclosures in inappropriate ways or for inappropriate purposes. In deciding whether to use its discretion to disclose information to service providers, we would consider in part whether the information contains otherwise sensitive information, such as attorney-client privileged information or proprietary information, and we will limit the scope of disclosure as appropriate. Vesting the Director alone with authority to approve these disclosures under § 1070.46 reflects this commitment by requiring decision-making to take place at the Bureau's highest level. In addition, the Bureau also proposed revising § 1070.42(b)(2) to clarify that a person in possession of confidential information pursuant to this section may disclose such information to an insurance provider pursuant to a claim for coverage made by that person under an existing policy. The Bureau explained in its proposal that such disclosures could only be made if the Bureau had not precluded indemnification or reimbursement for the claim. The Bureau further explained that this revised language would only authorize disclosure to the extent necessary for the insurance provider to process and administer the claim for coverage. Further distribution or use of the information would be prohibited. We noted that these limitations do not foreclose an insurance provider from using information that has been publicly disclosed by the Bureau in making future underwriting determinations regarding the person or for other purposes—even if that information was originally submitted to the insurance provider as confidential information under this provision. The Bureau received two comment letters regarding this proposal. One comment letter, from an industry trade association, expressed concerns about the proposal's limitation. It noted that insurance contracts may require timely notice of claims (including receipt of a CID or initiation of a regulatory proceeding) and argued that waiting to learn whether the CFPB has precluded indemnification or reimbursement may preclude recovery. The commenter also argued that, following an enforcement action, an entity may be subject to a private class action suit, and therefore should be permitted to disclose information to its insurers to obtain reimbursement for legal and other expenses associated with the follow-on lawsuit. A second comment letter, from a financial institution, suggested that the Bureau allow the disclosure of confidential information to insurance providers for the purpose of underwriting insurance coverage, such as directors and officers liability coverage. The commenter reasoned that, although an institution can seek approval from the Associate Director for Supervision, Enforcement and Fair Lending, this process would add time and uncertainty, which could impact institutions' ability to timely obtain insurance coverage. The Bureau notes that facets of these comments—that relate to the disclosure of CII to insurance companies—are rendered moot by revisions to the proposal described above. Under the final rule, § 1070.42 contains no limitations on institutions' disclosure of CII to an insurance company, and this appears to resolve much of the commenters' concerns. In addition, it is unclear from the industry trade group's comment whether the group interprets proposed § 1070.42(b)(2) to require financial institutions, prior to disclosing information to an insurance provider, to first inquire as to whether the Bureau precludes indemnification or reimbursement for a claim. It does not. The provision would permit such disclosures without first seeking permission from the Bureau; if the Bureau has not already notified the financial institution that it precludes indemnification or reimbursement, the financial institution may make the disclosure. The Bureau disagrees with the second commenter's suggestion that it allow disclosures to insurance providers for underwriting purposes. Again, the provision is now limited to further disclosure of CSI, and the Bureau does not believe that underwriting would be an appropriate use of its supervisory communications and ratings. We note that the prudential regulators similarly concluded in 2005 that their nonpublic information should not be disclosed to insurance companies for underwriting purposes. See FDIC, Financial Institution Letter, FIL-13-2005, “Interagency Advisory on the Confidentiality of CAMELS Ratings and Other Nonpublic Supervisory Information (Feb. 28, 2005), available at https://www.fdic.gov/news/news/financial/2005/fil1305.html (last visited Oct. 8, 2020). For the aforementioned reasons, the Bureau finalizes this proposal without modification. Finally, the Bureau proposed to remove references to the Associate Director for Supervision, Enforcement and Fair Lending's delegee. The Bureau reasoned that such reference is no longer necessary because the new definition of Associate Director for Supervision, Enforcement and Fair Lending, located at § 1070.2, includes delegees. The Bureau received no comments regarding this proposal, and it finalizes the proposal without modification. In addition to the comments regarding its proposed revisions to § 1070.42, the Bureau also received a comment letter, from a group of industry trade associations, asking the Bureau to revise the rule to allow service providers to disclose CSI to the financial institutions to which they provide service. The current rule allows financial institutions to disclose CSI to their service providers, and the commenter suggested making this allowance reciprocal. The commenter reasoned that financial institutions' responsibility to monitor third-party relationships is made more difficult if the service provider can withhold negative supervisory evaluations from the financial institution. The Bureau declines to make this suggested revision. The Bureau believes that supervisory communications with service providers could be undermined if the service providers knew that their clients could request the information. This concern is heightened with supervised nonbank institutions that are subject to the Bureau's supervision and happen to act as service providers. Lastly, the Bureau received one comment letter, from a group of industry trade associations, seeking guidance on whether the Bureau's rule prohibits entities from making certain disclosures pursuant to securities law. This issue was similarly raised in comment letters that argued against the proposal's limitation on further disclosure of CII (discussed above) due to securities law obligations. The Bureau agrees that further clarity on this issue would be helpful, as the comment letter makes clear that it is a source of confusion. As a preliminary matter, under § 1070.42(c) of the final rule, there are no restrictions on institutions' further disclosure of CII obtained pursuant to § 1070.42(a). In addition, the rule does not prohibit an institution from further disclosing confidential information, including confidential supervisory information, where such disclosure is otherwise required by law. See 12 CFR 1070.41(a). This includes where an institution determines that it is required to make a disclosure in order to comply with securities law. Such disclosure should be limited to that which is necessary to comply with securities law. The Bureau encourages financial institutions to reach out to appropriate regional staff with further questions regarding this issue. The Bureau notes that its discussion of the authorization to make disclosures under the securities laws is limited to disclosure of the Bureau's confidential information; with respect to confidential information that belongs to other regulators, financial institutions should consult with the regulator(s) to which the confidential information belongs. Section 1070.43 Disclosure of Confidential Information to Agencies Section 1070.43 sets forth the circumstances in which the Bureau may disclose confidential information to other government agencies. The Bureau proposed several revisions to this section. First, as a general matter, the Bureau proposed to revise the section's title and subtitles to delete the references to “law enforcement agencies” and “other government agencies;” to revise the text throughout the section to account for the new defined term “agency;” and to make various other non-substantive technical corrections. Second, the Bureau proposed revising the standard, in § 1070.43(b)(1), regarding the Bureau's discretion to disclose CSI to other agencies. Third, the Bureau proposed revising § 1070.43(b)(2) to, among other things, move responsibility for acting on agency requests for confidential information from the Bureau's General Counsel to the Bureau's Associate Director for Supervision, Enforcement and Fair Lending. Fourth, the Bureau proposed deleting § 1070.43(c), which pertains to requests for information that is not confidential information. The Bureau also received a comment on proposed § 1070.43(c) (formerly § 1070.43(d)) which addresses the negotiation of standing requests for confidential information between the Bureau and other agencies. The Bureau proposed revising the section's title and subtitles to delete the references to “law enforcement agencies” and “government” agencies because it believed the references to be superfluous. Instead, the title and subtitles would reference “agencies.” This was not intended to be a substantive change. The Bureau proposed various other non-substantive technical corrections in the section as well. The Bureau received no comments that directly address these proposed revisions, and it finalizes them without modification. The Bureau also proposed revisions throughout the section to account for the proposed defined term “agency.” 8 For the reasons discussed above with respect to proposed § 1070.2(a), and because the Bureau has declined to include the new definition in the final rule, the Bureau declines to finalize these proposed revisions in § 1070.43. Previous references to “Federal or State agency” will remain references to “Federal or State agency” without modification. 8 See above for discussion of comments regarding the proposed definition of “Agency” in proposed § 1070.2(a). Section 1070.43(a)(1) Section 1070.43(a)(1) requires, among other things, that the Bureau disclose a final report of examination, including any and all revisions to that report, to a Federal or State agency with jurisdiction over a supervised financial institution, provided that the Bureau receives from the agency reasonable assurances as to the confidentiality of the information disclosed. The Bureau revises this provision in the final rule. The Bureau has previously explained that this provision implements 12 U.S.C. 5512(c)(6)(C)(i). See 78 FR 11484, 11494, 11496 (Feb. 13, 2013). In particular, in the preamble to its 2013 final rule, the Bureau concluded that section 5512(c)(6)(C)(ii)'s mandate that the Bureau disclose examination reports to “State regulator[s]” does not require the disclosure of CSI to a State attorney general unless that State attorney general regulates the covered person or service provider. See 78 FR 11484, 11496. The Bureau concedes that although it articulated this interpretation in the 2013 final rule's preamble, § 1070.43(a)'s inclusion of the more general term “Federal or State agency” could be cause for confusion. Although the Bureau proposed no revisions to § 1070.43(a), it revises this provision in the final rule to clarify that it will disclose a final report or examination, including any and all revisions to such a report, “as provided in 12 U.S.C. 5512(c)(6)(C)(i),” to a Federal or State agency with jurisdiction over that financial institution, provided that the Bureau receives from the agency reasonable assurances as to the confidentiality of the information disclosed. Several comments, while addressing the Bureau's proposed revisions to other provisions, touched on issues raised by § 1070.43(a). For example, one comment letter, from an industry trade association, expressed concern that, between the Bureau's proposed definition of “agency” and the Bureau's proposed interpretation of 12 U.S.C. 5512(c)(6), the Bureau could draft a rule that enables a State bar association to require the Bureau to disclose reports to it—a dynamic that the commenter described as absurd. Another comment letter, from a group of State attorneys general, expressed support for the Bureau's proposal to remove the jurisdictional requirement for sharing CSI with a partner agency under § 1070.43(b), suggesting that this revision would permit the Bureau to share CSI with State enforcement agencies more freely. The Bureau notes, in response to the first comment, that concerns regarding the disclosure of CSI to State bar associations are fully addressed by the Bureau's decision to not finalize the proposed definition of “agency” in the final rule; and regarding the commenter's broader point, that the Bureau could conceivably draft § 1070.43(a) more broadly, the Bureau has not proposed such a rule. In response to the second comment, the Bureau notes that its policy regarding sharing CSI with State attorneys general is set forth in Bulletin 12-01. It did not intend its proposal to alter this policy, and Bulletin 12-01 will remain in place after the final rule becomes effective. Nevertheless, these comments do highlight concerns and confusion related to disclosure of reports of examination to State agencies, including under § 1070.43(a). The Bureau thus revises the provision to clarify in its text that its scope parallels the scope of 12 U.S.C. 5512(c)(6)(C)(i). This revision does not change the interpretation articulated in the preamble to the 2013 final rule; it merely codifies that interpretation in the regulation's text. In addition, for consistency with this new text, the Bureau revises § 1070.43(a)'s separate reference to disclosures of draft reports of examination “in accordance with 12 U.S.C. 5515(e)(1)(C)” to say that the draft reports of examination will be disclosed “as provided in 12 U.S.C. 5515(e)(1)(C).” Replacing the phrase “in accordance with” with the phrase “as provided in” is a technical revision that is not intended to change the meaning of that text. Section 1070.43(b) Discretionary Disclosure of Confidential Information to Agencies Section 1070.43(b)(1) Section 1070.43(b)(1) sets forth the standard under which the Bureau may disclose confidential information to other agencies in its discretion. The Bureau's prior rule established two distinct standards for disclosing confidential supervisory information and other confidential information. It stated that the Bureau may disclose confidential information to an agency “to the extent that the disclosure of the information is relevant to the exercise of the [Agency's] statutory or regulatory authority,” but that it may only share confidential supervisory information with agencies “having jurisdiction over a supervised financial institution.” The Bureau proposed removing the separate standard for confidential supervisory information, which would have aligned the two standards and provided the Bureau with discretion to disclose either confidential supervisory information or other confidential information to another agency “to the extent that the disclosure of the information is relevant to the exercise of the [agency's] statutory or regulatory authority.” The Bureau declines to finalize this proposed revision. The Bureau explained in its notice of proposed rulemaking that this proposed change was intended to facilitate communication and information-sharing among the Bureau and other governmental authorities. The Bureau stated that it had determined that sharing confidential supervisory information in situations where the disclosure of the information is relevant to the exercise of the receiving agency's statutory or regulatory authority would facilitate the Bureau's purposes and objectives. It noted that multiple agencies engage in operations that potentially affect the offering and provision of consumer financial products and services, as well as the markets, industries, companies, and other persons relevant to the Bureau's work, and that multiple agencies have interests and obligations relating to implementation, interpretation, and enforcement of the Dodd-Frank Act and the other Federal consumer financial laws administered by the Bureau. The Bureau also explained that the proposed change would have assisted it in implementing and administering Federal consumer financial law in a more consistent and effective fashion, and would have enabled the Bureau to work together with other agencies having responsibilities related to consumer financial matters. The Bureau said that it believed that the proposed change would comport with the intent of the Dodd-Frank Act, since effective coordination and communication among agencies is essential in order for the regulatory framework established by that Act to work as Congress intended. The Bureau stated in its proposal that, in its judgment, the prior rule's restrictions had proven overly cumbersome in application, posed unnecessary impediments to cooperating with other agencies, and otherwise risked impairing the Bureau's ability to fulfill its statutory duties. Unnecessary impediments to information-sharing in such circumstances impede supervisory and enforcement coordination and create opportunities for potential conflict, inefficiency, and duplication of efforts across agencies. The Bureau reasoned that retaining discretion to share confidential supervisory information in such situations would better promote the Bureau's mission and overall effectiveness. The Bureau also stated in its proposal that the proposed change would codify a revised interpretation of 12 U.S.C. 5512(c)(6). See generally 81 FR 58310, 58317-18 (Aug. 24, 2016). The Bureau received a number of comments regarding its proposed revision to § 1070.43(b)(1), and they were largely critical of the proposal. Commenters expressed general concerns regarding the potential breadth of proposed § 1070.43(b)(1), and the proposal's potential impact on the supervisory process. Commenters also raised concerns regarding the proposal's interaction with definition of “agency” in proposed § 1070.2(a). 9 In addition, a number of comment letters took issue with the Bureau's revised interpretation of 12 U.S.C. 5512(c)(6). 9 The Bureau's final rule does not include the proposed definition of “agency” in response to these and related concerns. See above for discussion of comments regarding proposed § 1070.2(a). Several commenters criticized the Bureau's proposed revision to § 1070.43(b)(1) for being overly broad. For example, several industry trade associations stated that the proposed “relevance” standard would allow the Bureau to disclose CSI to any interested domestic or foreign agency, even if it has no role in the regulation of financial institutions. One comment letter, from a group of industry trade associations, suggested that if an institution operated in only one State and only sold a product in that State, any domestic or foreign regulator might find CSI regarding the institution “relevant” to their statutory or regulatory authority to the extent that consumers within their jurisdiction could purchase the same product. Another commenter argued that there is no logical stopping point to “relevance,” and that the proposal would enable disclosure of CSI by the Bureau even if information were only tangentially related to an agency's authority. The Bureau received several comment letters that stated that broader disclosure of confidential supervisory information raises concerns regarding the protection of privileged material. Although not all Bureau CSI consists of material subject to a financial institution's privilege, financial institutions do at times submit materials subject to the attorney-client privilege and/or attorney work-product privilege in the course of the Bureau's supervisory activities. See generally 12 U.S.C. 1828(x). Commenters expressed concern that the transfer of privileged information to agencies or entities that are not covered by 12 U.S.C. 1828(x) or 12 U.S.C. 1821(t) could result in a breach or waiver of the privilege. Commenters also stated that the Bureau's proposal was likely to make entities less willing to voluntarily produce privileged materials to the Bureau due to such risks. One commenter suggested that uncertainty regarding the Bureau's protection of privilege could make institutions less likely to engage counsel or obtain written advice, which could negatively impact compliance. This commenter also stated that the U.S. Department of Justice and Securities and Exchange Commission do not condition cooperation credit on the waiver of privilege. Another comment letter stated that there is no indication in 12 U.S.C. 1828(x) that Congress intended the provision to enable a banking agency to circumvent the inability of other agencies to obtain privileged materials. In light of these concerns, one commenter suggested that the Bureau modify its proposal to limit disclosure of privileged information to Federal agencies that are referenced in 12 U.S.C. 1821(t). Another commenter went further, suggesting that the Bureau state that it would not transfer privileged materials subject to 12 U.S.C. 1828(x) to other agencies or parties at all. The Bureau also received several comment letters that expressed concern that broader dissemination of CSI increases risk that the CSI may not be protected sufficiently, including from data breach, hacking, and other unauthorized disclosures. One comment letter, from an industry trade association, stated that such disclosures could lead to the information being taken out of context, or could raise safety and soundness issues. A comment letter, from a group of industry trade associations, stated that, once the Bureau discloses CSI to an agency or entity, there is no mechanism to ensure that the recipient has taken appropriate steps to prevent data breaches or to resolve data breaches when they occur; and there is no meaningful way for the Bureau to prevent the further transmission of CSI by a recipient. This commenter also argued that the recipient's certification, required by § 1070.43(b)(2)(v), is inadequate. One comment letter, from an industry trade association, expressed concern that recipients of CSI may be unable to protect it from disclosure due to State and foreign disclosure or privacy laws (which may require greater disclosure than that mandated by the Freedom of Information Act, 5 U.S.C. 552) or discovery requests in civil litigation. Commenters also stated that broad disclosure of CSI would undermine the Bureau's supervisory process. One commenter explained that it is logical to share CSI subject to heightened disclosure restrictions, compared to other confidential information like CII, because CSI plays a critical role in effective supervision. Several industry trade association commenters stated that the proposal would make institutions less likely to cooperate with the Bureau and produce information to the Bureau in the course of its supervisory activities. One comment letter, from a group of industry trade associations, articulated that the proposal would undermine the relationship of trust between banks and the Bureau, and it suggested that this could be detrimental to banks' safety and soundness. This commenter argued that the proposal would undermine the bank examination privilege because more routine disclosure of CSI would increase the risk that courts will no longer protect confidential supervisory information from disclosure in private litigation. This commenter suggested that the Bureau only disclose CSI in rare cases when the disclosure serves a strong governmental interest, and not merely advancement of the Bureau's mission. The Bureau also received a number of comment letters that criticized its proposal for providing insufficient rationale or clarity. Several commenters stated that the Bureau's proposal did not establish a record for how the status quo rules impede its activities, and how the proposal would resolve those issues. One comment letter, from a group of industry trade associations, stated that the Bureau had not conducted a thorough analysis of the risks associated with expanded disclosure of CSI, including supervisory, litigation, and reputational risks, which it suggested surpassed the potential benefits of the proposal. Another comment letter, from an industry trade association, disagreed with the Bureau's justification for its proposal—that it would enable cooperation with other agencies having responsibilities related to consumer financial matters—because the proposal's definition of “agency” included non-financial regulators and other entities without responsibilities related to the enforcement of consumer financial laws or prudential regulation. A second industry trade association commenter argued that the proposal to disclose CSI to agencies that lack jurisdiction over supervised financial institutions would not help the Bureau administer consumer financial laws, reasoning that the status quo rule did not restrain the Bureau's supervisory or enforcement authorities. This same commenter rejected the Bureau's coordination rationale, reasoning that any agency that has supervisory or enforcement authority over a covered financial institution could already receive CSI under the previous rule. In addition, the Bureau received several comment letters that argued that the Bureau's proposal was inconsistent with other regulators' practices, stating that other regulators do not disclose CSI to agencies that lack jurisdiction. For example, one comment letter, from a group of industry trade associations, stated that the proposal was inconsistent with the policies of Federal prudential regulators, which it said have broader statutory authority than the Bureau to share CSI. See 12 U.S.C. 1817(a)(2)(C)(iii) (Federal banking agencies may “furnish any report of examination or other [CSI] concerning any . . . entity examined by such agency . . . to . . . any . . . person that the Federal Banking agency determines to be appropriate.”). The commenter contrasted this language with 12 U.S.C. 5512(c)(6)(C)(ii), arguing that by not extending section 1817's discretionary authority to the Bureau, Congress indicated an intent to limit the Bureau's discretion to disclose CSI. The commenter stated that, in practice, regulators have adopted regulations that strictly limit such disclosure, which provides comfort to supervised entities. The commenter noted, for example, that the Office of the Comptroller of the Currency (OCC) has promulgated regulations that limit disclosure of non-public OCC information to State agencies where those agencies have “authority to investigate violations of criminal law” or are “state bank and state savings association regulatory agencies,” and when disclosure is “necessary, in the performance of their official duties.” 12 CFR 4.37(c). Another comment letter, from a consulting organization, argued that the Bureau's proposal was inconsistent with other agencies' practices, and that it would compromise the reliability of the bank examination privilege and would violate the Bureau's obligations to the FFIEC to maintain supervisory consistency. This same commenter stated that Congress had intended 12 U.S.C. 5512(c)(6)(C) to mirror regulations by the Board of Governors of the Federal Reserve System (“FRB”), at 12 CFR 261.20, which it described as limiting the Board's sharing of CSI to agencies with supervisory jurisdiction. Another comment letter, from an industry trade association, similarly stated that FRB regulations, at § 261.20, permit disclosure to Federal prudential regulators and State supervisory agencies. This commenter also stated that the Bureau failed to explain why it needed greater flexibility in light of other agencies' practices. The Bureau received other critical comments as well. For example, one comment letter, from a group of industry trade associations, suggested that the Bureau's proposal would result in an increase in requests for the Bureau's information, which would burden Bureau staff. Two commenters, a consulting organization and an industry trade association, expressed concern that sharing CSI with non-supervisory agencies would expand the Bureau's supervisory power in contravention of Cuomo v. Clearing House Ass'n, 557 U.S. 519 (2009), and related authorities. Several commenters suggested that, in the event that the Bureau adopted its proposal, it should provide formal guidance or make additional changes to the rule. For example, one commenter proposed that the Bureau codify in the rule a formal policy and practice of sharing CSI only in limited circumstances, such as where the requestor demonstrates a substantial need for the requested information that outweighs the Bureau's need to maintain its confidentiality. This commenter also suggested that, absent circumstances that compel otherwise, the Bureau should notify the impacted supervised financial institution prior to disclosing CSI related to the institution to any entity other than Federal or State financial supervisory agencies with jurisdiction, or in certain cases U.S. Department of Justice, and give the supervised financial institution a reasonable opportunity to object and redact the information. Another commenter suggested that, in the event that the Bureau receives misdirected complaint data from credit unions over which it lacks jurisdiction, it should not share the data with any agency other than the National Credit Union Administration (NCUA) and that it should defer to the NCUA on whether the information is “relevant” to other agencies' statutory or regulatory authority. In addition to these issues, a number of the comment letters received by the Bureau disagreed with the revised interpretation of 12 U.S.C. 5512(c)(6) that the Bureau articulated in its proposal. Commenters described the Bureau's interpretation as “tortured,” “unreasonable,” and contrary to statutory language and to the statute's clear intent. In particular, several of the comment letters, received from industry trade associations and a member of Congress, disagreed with the Bureau's conclusion that 12 U.S.C. 5512(c)(6)(C)(ii) is ambiguous, instead concluding that the provision is unambiguous and restrictive. The Bureau also received several comment letters, from industry trade associations, that stated that the Bureau's interpretation of 12 U.S.C. 5512(c)(6) renders subparagraph (C)(ii) superfluous. And several comment letters, also from industry trade associations, argued that its proposed interpretation conflicted with legislative history and congressional intent. Finally, one comment letter, from a consulting organization, suggested that the Bureau did not sufficiently substantiate the change in policy articulated in its proposal. See Encino Motorcars v. Navarro, 136 S. Ct. 2117, 2125-26 (2016). 10 10 One commenter interpreted 12 U.S.C. 5512(c)(6)(C) to apply to confidential investigative information (in addition to confidential supervisory information), and to require the Bureau to provide confidentiality assurances to the impacted financial institution prior to disclosing the confidential information to another agency under subparagraph (C)(i). The Bureau disagrees with these interpretations. First, subparagraph (C) explicitly references “confidential supervisory information,” which is a narrower term than subparagraph (A)'s more general reference to “information obtained from persons in connection with the exercise of its authorities under Federal consumer financial law.” CII is thus outside the scope of subparagraph (C), and the Bureau's rule makes clear in § 1070.2(h) and (i) that the Bureau considers “confidential investigative information” to be different from “confidential supervisory information.” Second, the Bureau disagrees that subparagraph (C)(i) requires the Bureau to provide confidentiality assurances to the supervised financial institution about whom a report of examination pertains; because the provision addresses the exchange of information between the Bureau and another agency, the Bureau understands it to require the agency obtaining the report of examination to provide such assurances of confidentiality to the Bureau. The Bureau received one comment that was supportive of its proposal, from a group of State attorneys general. The comment letter suggested that the proposal would permit the Bureau to share CSI with State enforcement agencies. It argued that sharing CSI would properly increase resources available to address consumer abuses by supervised institutions, and that it would support coordination and collaboration between State attorneys general and the Bureau in their enforcement efforts. 11 11 The Bureau notes that its policy regarding sharing CSI with State attorneys general is set forth in Bulletin 12-01. It did not intend its proposal to alter this policy, and Bulletin 12-01 remains in place subsequent to the final rule becoming effective. The Bureau disagrees with commenters' claims that it did not sufficiently substantiate the change in policy articulated in its proposal. The Bureau stated in its proposal that it had determined that broader discretion to disclose CSI would facilitate the Bureau's purposes and objectives, and it explained how such discretion would assist its work. See 81 FR 58310, 58317 (Aug. 24, 2016). However, the Bureau declines to finalize its proposal. Instead, the final rule will retain § 1070.43(b)(1)'s status quo dual standards, unmodified: The Bureau may disclose confidential information to an agency “to the extent that the disclosure of the information is relevant to the exercise of the [Agency's] statutory or regulatory authority,” and confidential supervisory information to an agency “having jurisdiction over a supervised financial institution.” The Bureau had proposed changing the standard for disclosure of CSI to provide flexibility to address rare situations where it may have a need to disclose information identified as confidential supervisory information to an agency that does not necessarily have jurisdiction over a given financial institution. However, the Bureau acknowledges that commenters have raised the general concern that, as proposed, § 1070.43(b)(1)'s potential breadth could create uncertainty and decrease confidence that information provided to the Bureau in the course of its supervisory activities will be used and protected appropriately. In light of these concerns, the Bureau declines to revise the regulation as proposed. Section 1070.43(b)(2) Section 1070.43(b)(2) sets forth a process for agencies to submit written requests (sometimes referred to as “access requests”) to the Bureau in order to obtain access to its confidential information pursuant to § 1070.43(b). Whereas the section previously required submission of access requests to the General Counsel, the Bureau proposed to instead require submission to the Associate Director for Supervision, Enforcement and Fair Lending. 12 The Bureau further revises § 1070.43(b)(2) in the final rule in several ways. In particular, rather than vesting authority to act upon access requests with either the General Counsel or the Associate Director for Supervision, Enforcement and Fair Lending, the final rule will vest the authority with the Director or her designee. Thus, instead of codifying a delegation via regulation, the final rule will provide the Director with the flexibility to change the delegation if warranted, without the need for further rulemaking. 12 The Bureau likewise proposed moving the General Counsel's related “access request” authorities in 12 CFR 1070.47(a)(1)-(2) to the Associate Director for Supervision, Enforcement and Fair Lending. The comment letters received by the Bureau generally addressed both revisions together. The Bureau explained in its notice of proposed rulemaking that it believed the proposed change would lead to increased efficiency because the vast majority of access requests submitted to the Bureau pertain to work conducted by its Division of Supervision, Enforcement and Fair Lending. The Bureau stated that the Associate Director for Supervision, Enforcement and Fair Lending would continue to consult with other Bureau stakeholders, including the Legal Division, as necessary. The Bureau reasoned that, in making these changes, the authority to act upon access requests would shift from the Legal Division to other Bureau staff with expertise more directly related to processing these requests. The Bureau also proposed that access requests be emailed to a single email address, accessrequests@cfpb.gov, or to the Bureau's mailing address at 1700 G Street NW, Washington, DC 20552, in order to facilitate processing. The Bureau received five comment letters, all from industry trade associations, that were critical of the proposal to shift the authority to act upon access requests from the General Counsel to the Associate Director for Supervision, Enforcement and Fair Lending. Three comment letters expressed concern that the proposal could create a conflict of interest. For example, one commenter argued that the Associate Director could use access requests as a “negotiating tool” in situations where an agency may ask the Associate Director for CSI regarding an entity while the Division is simultaneously engaged in an enforcement action against the same entity. A second commenter expressed concerns that the Associate Director might lack impartiality, given that he or she also oversees requests for information from institutions during the course of an investigation, as well as requests from institutions to further disclose information under § 1070.42(b). Another comment letter, from a group of industry trade associations, stated that the Associate Director would have a potential conflict of interest because he or she may have reasons to grant access requests related to the work conducted by his or her Division. Four comment letters argued that the Bureau's General Counsel is better suited to the role of approving access requests. The group of trade associations stated that the General Counsel is in a better position to weigh the impact of disclosure on the bank examination privilege and other legal obligations. The commenter also argued that agencies' assertions in access requests regarding their legal authority are more appropriately addressed by the General Counsel. Similarly, two commenters asserted that the General Counsel is better suited than the Associate Director for making determinations that impact personal and commercial privacy interests of entities. One commenter argued that shifting the authority for access requests could lose a check on ensuring that disclosure of CSI is rooted in the Bureau's statutory and regulatory authority, rather than political or ideological motivations. Two commenters recommended that the General Counsel maintain a role in deciding whether to approve access requests, with one suggesting more specifically that General Counsel approval be required, in addition to the Associate Director's approval. Two commenters also criticized the proposal for departing from other agencies' practices. The group of industry trade associations noted that the FRB vests authority to decide access requests with its Legal Division. Another commenter argued that other agencies vest their General Counsel with responsibility to “oversee FOIA requests and production of information.” This same commenter expressed concern that moving access-request authority could result in inconsistent decisions regarding the release of information in response to access requests, FOIA requests, or requests under the Bureau's Touhy regulations at 12 CFR 1070.30 through 1070.37. 13 13 This commenter also claimed that the Bureau's proposal would shift responsibility for determining FOIA requests to the Associate Director for Supervision, Enforcement, and Fair Lending. The Bureau made no such proposal. Authorities to decide FOIA requests remained unchanged in the Bureau's proposal, and are unchanged in this final rule and in 83 FR 46075 (Sept. 12, 2018). As the Bureau explained in the notice of proposed rulemaking, we proposed moving access-request authority from the General Counsel to the Associate Director for Supervision, Enforcement and Fair Lending in order to increase efficiency because most access requests submitted to the Bureau pertain to work conducted by that Division. The Bureau believes that the Associate Director may be in a better position than the General Counsel to make a policy determination whether to authorize an access request, since the Division of Supervision, Enforcement and Fair Lending is more familiar with the information at issue and the context of the access request. The Bureau does not agree with the contention that this change creates a conflict of interest, as the Bureau would consider the same policy grounds for granting an access request regardless of where the authority is located. In addition, while some agencies, such as the FRB, may vest access-request authority with their General Counsel, others do not. For example, the FDIC vests access-request authority in the director of the division having primary authority over the records. See 12 CFR 309.6. Likewise, the Securities and Exchange Commission vests access-request authority in senior officers at or above the level of Associate Director or Associate Regional Director. See Securities and Exchange Commission, Division of Enforcement, Enforcement Manual section 5.1 (Nov. 28, 2017), available at https://www.sec.gov/divisions/enforce/enforcementmanual.pdf (last visited Oct. 8, 2020); 17 CFR 240.24c-1. Given the size and organization of the Bureau, and for the reasons described above, we think it reasonable to vest access-request authority in an official other than the General Counsel. Nevertheless, in light of the concerns expressed, the Bureau declines to codify in the rule that authority to act upon access requests is vested in the Associate Director for Supervision, Enforcement and Fair Lending. Instead, the final rule will vest the authority in the “Director,” which is defined in 12 CFR 1070.2(j) to include a designee of the Director. Thus, while the Director may delegate the authority to the Associate Director for Supervision, Enforcement and Fair Lending, this shift can be reversed or otherwise changed without requiring a rulemaking—such as if experience shows that the Bureau's Legal Division was in a better position to address access requests. The Bureau notes that if responsible for acting upon access requests, the Division of Supervision, Enforcement and Fair Lending would continue to consult with the Legal Division as needed, such as when an access request raises legal questions regarding authority, privilege, privacy, trade secrets, or other legal obligations. 14 14 The Bureau occasionally receives access requests for confidential information that is neither CII nor CSI, such as information originating from another Bureau Division that is exempt from disclosure under the FOIA. In those instances, the Division of Supervision, Enforcement and Fair Lending would consult with impacted Divisions as warranted. Furthermore, the Bureau does not share one commenter's concern that its proposal could lead to different results where determinations are made in response to an access request, a FOIA request, or a request under the Bureau's Touhy regulations. These disclosures occur in different contexts, subject to different protections, and should not necessarily result in identical determinations. In addition, as stated above, the Bureau's Legal Division would continue to be consulted as needed in access-request determinations. Finally, although the Bureau received no comments on the email address or mailing address that it proposed for access request submissions, it declines to include this contact information in the final rule because it has concluded that codification of such information is unnecessary. In addition to changing the authority to act on access requests, the Bureau proposed revising § 1070.43(b)(2)(iii), for purposes of clarity, to state that, among other things, access requests must include a statement certifying and identifying the agency's “statutory or regulatory authority that is relevant to the requested information, as required by paragraph (b)(1).” We explained in the proposal that, in our experience, the previous formulation (the agency must certify or identify its “authority for requesting the documents”) can lead to confusion. The Bureau received no comments on this proposal. However, because the Bureau has declined to finalize its proposed revision to § 1070.43(b)(1) regarding discretionary disclosure of CSI, it needs to further revise paragraph (b)(2)(iii) to track the dual standards in paragraph (b)(1) and achieve the same clarity sought in the proposal. Thus, the Bureau further revises the text in the final rule to read, “A statement certifying and identifying, as required by paragraph (b)(1) of this section, the agency's statutory or regulatory authority that is relevant to the requested information or, with respect to a request for confidential supervisory information, the agency's jurisdiction over a supervised financial institution.” Finally, although the Bureau proposed no revisions to § 1070.43(b)(2)(v), it received two comment letters from industry trade associations regarding the paragraph, which requires agencies to include in an access letter “[a] certification that the agency will maintain the requested confidential information in confidence, including in a manner that conforms to the standards that apply to Federal agencies for the protection of the confidentiality of personally identifiable information and for data security and integrity, as well as any additional conditions or limitations that the CFPB may impose.” One commenter described the requirement as inadequate, and the other argued that the certification does not substitute for evaluation of the agencies' data security policies. These comments are similar to a comment that the Bureau received when it initially promulgated the rule, where a commenter suggested that the Bureau audit agencies' data security practices prior to sharing confidential information with them. See 78 FR 11484, 11495 (Feb. 15, 2013). We considered and rejected the suggestion at the time, explaining in the previous final rule that, prior to disclosure, the Bureau takes reasonable steps to ensure that a requesting agency is legally authorized to protect the information, and that it has systems in place to safeguard the information from theft, loss, or unauthorized access or disclosure. See id. at 11497. The Bureau's view remains unchanged, and it finalizes § 1070.43(b)(2)(v) without modification. Former Section 1070.43(c) State Requests for Information Other Than Confidential Information Former § 1070.43(c) stated that State agency requests for information other than confidential information were not to be made and considered under § 1070.43. The Bureau proposed deleting this paragraph because it believed the paragraph to be unnecessary and confusing. Because, by its own terms, § 1070.43 only applies to confidential information, there is no need to state that it does not apply to information that is not confidential. The Bureau received no comments on this proposal, and it finalizes the proposal without modification. Proposed Section 1070.43(c) Negotiation of Standing Requests Proposed § 1070.43(c) (formerly § 1070.43(d)) states that the Bureau may negotiate terms governing the exchange of confidential information with agencies on a standing basis. The Bureau proposed no substantive revisions to this paragraph (other than replacing a reference to “Federal or State agencies” with “Agencies,” which is discussed above). The Bureau received one comment letter, from an industry trade association, which stated that the Bureau could use this authority to negotiate data security standards, and it requested clarification from the Bureau that such standards are non-negotiable. The Bureau disagrees with the commenter's implication that the Bureau can use proposed § 1070.43(c) to negotiate data security standards lower than the standards required by § 1070.43(b)(2). Paragraph (b)(2) requires agencies to make certain confidentiality assurances in order for the Bureau to approve an access request. Proposed paragraph (c), meanwhile, merely states that the Bureau can agree to the exchange of information on a standing, rather than a case-by-case, basis. In this context, the Bureau interprets proposed paragraph (c) to require that such standing agreements be consistent with the requirements of paragraph (b)(2). In addition, we note that the Bureau's obligations under the Dodd-Frank Act, such as the confidentiality requirements of 12 U.S.C. 5512(c)(8), apply equally to disclosures under paragraphs (b) and (c). For the aforementioned reasons, the Bureau finalizes the proposal without modification. Section 1070.44 Disclosure of Confidential Consumer Complaint Information Section 1070.44 addresses the Bureau's disclosure of confidential consumer complaint information in the course of investigating, resolving, or otherwise responding to consumer complaints. The Bureau proposed replacing the phrase “[n]othing in this subpart shall limit the discretion of the CFPB” with “[t]he CFPB may . . .” in order to clarify that § 1070.44 authorizes such disclosure by the Bureau. The Bureau also proposed replacing the phrase “concerning financial institutions or consumer financial products and services” with “concerning consumer financial products and services or a violation of Federal consumer financial law” in order to clarify that the section broadly addresses any information received or generated by the Bureau through processes or procedures established under 12 U.S.C. 5493(b)(3), including where complaints do not concern financial institutions, or where the Bureau lacks authority to act on them. The Bureau received no comments on this proposal, and it finalizes the proposal without modification. Section 1070.45 Affirmative Disclosure of Confidential Information Section 1070.45 addresses various instances where the Bureau may make disclosures of confidential information on its own initiative. The Bureau proposed several revisions to clarify, supplement, or amend the disclosures previously addressed in the section. Any disclosures made pursuant to this section must be made in accordance with applicable law. The Bureau proposed deleting the reference in § 1070.45(a) to “confidential investigative information” in the phrase “confidential investigative information or other confidential information.” The Bureau explained in its proposal that this reference is unnecessary because confidential investigative information is a sub-category of confidential information. The Bureau also noted that, while it may disclose any category of confidential information under § 1070.45(a), disclosures made under this section—particularly paragraphs (a)(3) and (4) and proposed (a)(6)—are more likely to involve confidential investigative information, rather than other categories of confidential information, such as confidential supervisory information. The Bureau received no comments regarding this proposal, and it finalizes the proposal without modification. Paragraph (a)(2) addresses disclosure of confidential information to either House of the Congress, or to an appropriate committee or subcommittee of the Congress, as set forth in 12 U.S.C. 5562(d)(2). The text states that, upon receipt of a request from the Congress for confidential information that a financial institution submitted to the Bureau along with a claim that such information consists of trade secret or privileged or confidential commercial or financial information, or confidential supervisory information, the Bureau “shall notify” the financial institution in writing of its receipt of the request and provide the institution with a copy of the request. The Bureau proposed revising the text to state that it “may notify” the financial institution in such circumstances. The Bureau declines to finalize this proposal. The Bureau reasoned in its proposal that this revision would provide greater flexibility and more closely align with 12 U.S.C. 5562(d)(2), which states that the Bureau “is permitted to adopt rules allowing prior notice to any party that owns or otherwise provided the material to the Bureau and had designated such material as confidential.” The Bureau received four comment letters that addressed this proposal. Three commenters—an industry trade association, a group of industry trade associations, and a financial institution—stated that notification should be mandatory so that financial institutions have an opportunity to object to the disclosure to Congress, or at least to prepare to be able to assist Congress or to respond to potential publicity. One comment letter, from a group of industry trade associations, argued that notice is critical to ensuring that information is not misused, misunderstood, inaccurately reported, or inadvertently disclosed. The commenter reasoned that notice allows institutions to be prepared to respond to questions and potentially avoid panic or inappropriate or harmful reactions. The two industry trade association commenters also stated that they did not believe the Bureau sufficiently explained its need for “flexibility” in its proposal, and that any such need is outweighed by the importance of preserving the confidentiality of CSI. One of the commenters also noted that the Bureau's proposal differs from a similar rule promulgated by the FTC that requires agency notice in similar situations. See 16 CFR 4.11(b). Finally, the Bureau received a comment letter, from a public interest organization, expressing concern that the Bureau's proposal could reduce institutions' ability to prevent, or at least object to, the disclosure of information to Congress, which could threaten the privileged status of any such information. In light of these comments, the Bureau declines to finalize this proposal, and the final rule instead will contain the status quo text, unmodified, which requires notification by the Bureau prior to disclosures to either House of the Congress or to an appropriate committee of subcommittee of the Congress. The Bureau appreciates commenters' concerns about a financial institution's need to know when its sensitive information is being produced to Congress. The Bureau also recognizes that a mandatory, rather than discretionary, notification process establishes predictability and increases confidence regarding the Bureau's protection and appropriate [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2020-24113. Public record. Not legal advice.