In its final rule on Disclosure of Records and Information published last week, the CFPB gave no ground on its position that it has discretionary authority to share confidential information with state attorneys general. This has been a significant concern to industry since the rule was published as an interim final rule in July 2011. 

The final rule, as did the interim rule, allows the CFPB to make discretionary disclosures of confidential information to state AGs “to the extent that the disclosure of the information is relevant to the exercise of the [AG's] statutory…authority” and of supervisory information as long as the AG has “jurisdiction over [the] supervised financial institution.” The CFPB rejected the view of commenters that Dodd-Frank allows the CFPB to share supervisory information such as exam reports only with state regulators having supervisory authority or that confidential information can be shared with state AGs only in circumstances where the AG is exercising its enforcement authority within a judicial process and the disclosure relates to the exercise of such authority. 

The CFPB also refused to modify the rule to notify a financial institution when it receives a request for confidential information from a state regulator or AG or give a financial institution an opportunity to object to a CFPB decision to provide such information. According to the CFPB, it typically engages in such sharing “within the context of joint supervisory examinations and law enforcement investigations” and “within [that] context, notification could reveal prematurely [investigation or examination] plans and might compromise these joint endeavors.” Also, the CFPB is worried that a financial institution “could misuse a right to object …to obstruct or stymie” such plans.

Perhaps most troubling is the ease with which the CFPB dismisses commenters’ concerns about privilege waivers resulting from such sharing. According to the CFPB, while the CFPB believes such concerns are “unwarranted,” financial institutions should take comfort in the fact that the final rule provides that the CFPB’s disclosure of confidential information to another agency does not result in a waiver of any legal privileges. The problem remains that financial institutions have no statutory protection against a waiver when the CFPB provides information to state agencies. While H.R. 4014, which was signed into law near the end of 2012, provides protection for information the CFPB shares with other federal agencies, it provides no anti-waiver protection for privileged information the CFPB shares with state AGs or other state agencies.