The Consumer Financial Protection Bureau (CFPB) announced its intention to act as a data security regulator by releasing its first unfair, deceptive or abusive acts or practices (UDAAP) enforcement action for allegedly deceptive statements about data security practices after remaining largely silent on the topic for more than four years. The CFPB’s March enforcement action, against a small payments company, contains only a modest civil money penalty and does not require payments to customers. The language in the bureau’s action suggests that it expects regulated companies to implement certain data security processes and that it may take further enforcement action in the area of data security.

Originally published in Bloomberg BNA's Banking Report™ - June 6, 2016.