The CFPB issued a proposed rule which significantly affects  third-party access to information obtained by the Bureau. In addition to public requests under the Freedom of Information Act, the Privacy Act of 1974 and in legal proceedings, the proposal would also affect the treatment of confidential information obtained by the CFPB under federal consumer finance laws, including “the Bureau’s discretionary disclosure of confidential information to other agencies.”

The proposal would codify the Bureau’s revised interpretation of 12 U.S.C. 5512(c)(6)(B)-(C) regarding the treatment of confidential supervisory information (CSI), as the “Bureau believes that subparagraphs (B) and (C) can reasonably be read to establish an information-sharing regime with a limited set of agencies.” Currently, the Bureau may only share CSI with agencies “having jurisdiction over a supervised financial institution.” The proposed change would remove the requirement for jurisdiction and allow the Bureau to disclose CSI to another agency “to the extent that the disclosure of the information is relevant to the exercise of the [agency’s] statutory or regulatory authority.”

While the CFPB states that the revised interpretation “is intended to facilitate communication and information-sharing among the Bureau and government authorities,” it also states that the proposal will “not alter the Bureau’s policy on disclosing [CSI] to law enforcement agencies.” However, in removing the requirement for jurisdictional authority, the proposal effectively places total discretion with the CFPB regarding the disclosure of CSI gathered through its supervisory or enforcement activities, and it is likely to result in state and other federal agencies acquiring CSI which they previously had no authority to obtain.

Companies in the financial services industry should review the proposed rules with care and consider whether they should submit comments, which must be received by October 24, 2016.