[House Report 113-344] [From the U.S. Government Publishing Office] 113th Congress Report HOUSE OF REPRESENTATIVES 2d Session 113-344 ====================================================================== CONSUMER RIGHT TO FINANCIAL PRIVACY ACT OF 2013 _______ February 6, 2014.--Committed to the Committee of the Whole House on the State of the Union and ordered to be printed _______ Mr. Hensarling, from the Committee on Financial Services, submitted the following R E P O R T together with MINORITY VIEWS [To accompany H.R. 2571] [Including cost estimate of the Congressional Budget Office] The Committee on Financial Services, to whom was referred the bill (H.R. 2571) to amend the Dodd-Frank Wall Street Reform and Consumer Protection Act to require the Bureau of Consumer Financial Protection to notify and obtain permission from consumers before collecting nonpublic personal information about such consumers, and for other purposes, having considered the same, report favorably thereon without amendment and recommend that the bill do pass. Purpose and Summary H.R. 2571, the Consumer Right to Financial Privacy Act, amends the Dodd-Frank Wall Street Reform and Consumer Protection Act (the ``Dodd-Frank Act'') to prohibit the Bureau of Consumer Financial Protection (the ``CFPB'' or the ``Bureau'') from requesting, accessing, collecting, using, retaining, or disclosing nonpublic personal information about a consumer unless (i) the CFPB clearly and conspicuously discloses to the consumer, in writing or in an electronic form, what information will be requested, obtained, accessed, collected, used, retained, or disclosed; and (ii) the consumer informs the CFPB, before such information is requested, obtained, accessed, collected, used, retained, or disclosed, that such information may be requested, obtained, accessed, collected, used, retained, or disclosed. The bill subjects CFPB contractors to the same restrictions and conditions. It also amends the Right to Financial Privacy Act of 1978 to clarify that it applies to the examination by or disclosure to the CFPB of financial records or information in the exercise of its authority with respect to a financial institution. Background and Need for Legislation Consumers of financial products have a legitimate interest in the privacy of their personal financial information. While the Dodd-Frank Act permits the CFPB to collect data as part of its supervisory and examination functions, it expressly prohibits the Bureau from gathering or analyzing personally identifiable financial information on consumers. Section 1022(4)(C) of the Dodd-Frank Act provides that the CFPB ``may not use its authority . . . to obtain records from covered persons and service providers participating in consumer financial services markets for purposes of gathering or analyzing the personally identifiable information of consumers.'' The CFPB has said that it is not collecting personally identifiable information but has provided limited details to the Committee on Financial Services on its data collection efforts. Concerns also have been raised about data security issues at the CFPB. A report by the Federal Reserve's Office of Inspector General, which also has responsibility for overseeing the CFPB, highlighted a series of concerns with the CFPB's information-security controls over their widely used contractor-operated systems. As part of its assessment, the Inspector General examined a contractor-operated system and found several ``management, operational, and technical control weaknesses.'' Furthermore, ``CFPB has not established a comprehensive information security strategy to guide the implementation of an agency-wide information security program.'' The Subcommittee on Financial Institutions and Consumer Credit held a hearing on the CFPB's data collection practices on July 9, 2013, at which CFPB Deputy Director Steve Antonakes was unwilling or unable to answer many basic questions, including how many individual credit card accounts the CFPB is monitoring, or how many data fields it monitors per account, even though the CFPB's strategic plan indicates that the CFPB may be tracking as many as 900 million credit card accounts. Many members of the Committee expressed concern regarding the CFPB's ability to maintain the confidentiality and security of personally identifiable information the Bureau collects about American consumers. In response to the concerns raised at this hearing, Rep. Duffy introduced H.R. 2571 to ensure that the CFPB does not collect or try to collect a consumer's nonpublic personal financial information without such consumer's permission. The bill requires the CFPB and its contractors to request permission from a consumer before seeking his or her nonpublic personal information and requires the consumer to expressly consent to the data collection effort. To this end, the bill promotes financial privacy, permits the consumer to manage access to his or her nonpublic personal information, and improves the transparency of the CFPB's massive data-collection efforts. Hearings The Committee on Financial Services' Subcommittee on Financial Institutions and Consumer Credit held a hearing on H.R. 2571 on October 29, 2013. Committee Consideration The Committee on Financial Services met in open session on November 20, 2013, and ordered H.R. 2571 to be reported favorably to the House without amendment by a recorded vote of 32 yeas to 26 nays (recorded vote no. FC-45), a quorum being present. Committee Votes Clause 3(b) of rule XIII of the Rules of the House of Representatives requires the Committee to list the record votes on the motion to report legislation and amendments thereto. 1. A motion by Chairman Hensarling to report the bill (H.R. 2571) without amendment to the House with a favorable recommendation was agreed to by a record vote of 32 yeas to 26 nays (recorded vote no. FC-45). RECORD VOTE NO. FC-45 ---------------------------------------------------------------------------------------------------------------- Representative Yea Nay Present Representative Yea Nay Present ---------------------------------------------------------------------------------------------------------------- Mr. Hensarling................. X ........ ......... Ms. Waters....... ........ X ......... Mr. Bachus..................... X ........ ......... Mrs. Maloney (NY) ........ X ......... Mr. King (NY).................. X ........ ......... Ms. Velazquez.... ........ X ......... Mr. Royce...................... X ........ ......... Mr. Watt......... ........ X ......... Mr. Lucas...................... X ........ ......... Mr. Sherman...... ........ X ......... Mr. Gary G. Miller (CA)........ X ........ ......... Mr. Meeks........ ........ X ......... Mrs. Capito.................... X ........ ......... Mr. Capuano...... ........ X ......... Mr. Garrett.................... X ........ ......... Mr. Hinojosa..... ........ X ......... Mr. Neugebauer................. X ........ ......... Mr. Clay......... ........ ........ ......... Mr. McHenry.................... X ........ ......... Mrs. McCarthy ........ ........ ......... (NY). Mr. Campbell................... ........ ........ ......... Mr. Lynch........ ........ X ......... Mrs. Bachmann.................. X ........ ......... Mr. David Scott ........ X ......... (GA). Mr. McCarthy (CA).............. X ........ ......... Mr. Al Green (TX) ........ X ......... Mr. Pearce..................... X ........ ......... Mr. Cleaver...... ........ X ......... Mr. Posey...................... X ........ ......... Ms. Moore........ ........ X ......... Mr. Fitzpatrick................ X ........ ......... Mr. Ellison...... ........ X ......... Mr. Westmoreland............... X ........ ......... Mr. Perlmutter... ........ X ......... Mr. Luetkemeyer................ X ........ ......... Mr. Himes........ ........ X ......... Mr. Huizenga (MI).............. X ........ ......... Mr. Peters (MI).. ........ X ......... Mr. Duffy...................... X ........ ......... Mr. Carney....... ........ X ......... Mr. Hurt....................... X ........ ......... Ms. Sewell (AL).. ........ X Mr. Grimm...................... X ........ ......... Mr. Foster....... ........ X ......... Mr. Stivers.................... X ........ ......... Mr. Kildee....... ........ X ......... Mr. Fincher.................... X ........ ......... Mr. Murphy (FL).. ........ X ......... Mr. Stutzman................... X ........ ......... Mr. Delaney...... ........ X ......... Mr. Mulvaney................... X ........ ......... Ms. Sinema....... ........ X ......... Mr. Hultgren................... X ........ ......... Mrs. Beatty...... ........ X ......... Mr. Ross....................... X ........ ......... Mr. Heck (WA).... ........ X ......... Mr. Pittenger.................. X ........ ......... Mrs. Wagner.................... X ........ ......... Mr. Barr....................... X ........ ......... Mr. Cotton..................... X ........ ......... Mr. Rothfus.................... X ........ ......... ---------------------------------------------------------------------------------------------------------------- Committee Oversight Findings Pursuant to clause 3(c)(1) of rule XIII of the Rules of the House of Representatives, the Committee has held hearings and made findings that are reflected in this report. Performance Goals and Objectives Pursuant to clause 3(c)(4) of rule XIII of the Rules of the House of Representatives, the Committee states that H.R. 2571, among other things, prohibits the CFPB from requesting, accessing, collecting, using, retaining, or disclosing nonpublic personal information about a consumer without the consumer's express permission. New Budget Authority, Entitlement Authority, and Tax Expenditures In compliance with clause 3(c)(2) of rule XIII of the Rules of the House of Representatives, the Committee adopts as its own the estimate of new budget authority, entitlement authority, or tax expenditures or revenues contained in the cost estimate prepared by the Director of the Congressional Budget Office pursuant to section 402 of the Congressional Budget Act of 1974. Committee Cost Estimate The Committee adopts as its own the cost estimate prepared by the Director of the Congressional Budget Office pursuant to section 402 of the Congressional Budget Act of 1974. Congressional Budget Office Estimates Pursuant to clause 3(c)(3) of rule XIII of the Rules of the House of Representatives, the following is the cost estimate provided by the Congressional Budget Office pursuant to section 402 of the Congressional Budget Act of 1974: U.S. Congress, Congressional Budget Office, Washington, DC, February 6, 2014. Hon. Jeb Hensarling, Chairman, Committee on Financial Services, House of Representatives, Washington, DC. Dear Mr. Chairman: The Congressional Budget Office has prepared the enclosed cost estimate for H.R. 2571, the Consumer Right to Financial Privacy Act of 2013. If you wish further details on this estimate, we will be pleased to provide them. The CBO staff contact is Susan Willie. Sincerely, Douglas W. Elmendorf. Enclosure. H.R. 2571--Consumer Right to Financial Privacy Act of 2013 Summary: H.R. 2571 would require the Consumer Financial Protection Bureau (CFPB), in its efforts to monitor risks in markets for consumer financial products, to notify and obtain permission from individuals before collecting or using their personal information. The bill also would extend that requirement to businesses hired by the CFPB if the information is being collected on the agency's behalf. CBO estimates that enacting H.R. 2571 would increase direct spending by $8 million over the 2014-2024 period; therefore, pay-as-you go procedures apply. Enacting H.R. 2571 would not affect revenues, and implementing the bill would not affect spending subject to appropriation. H.R. 2571 contains no intergovernmental or private-sector mandates as defined in the Unfunded Mandates Reform Act (UMRA) and would not affect the budgets of state, local, or tribal governments. Estimated cost to the Federal government: The estimated budgetary impact of H.R. 2571 is shown in the following table. The costs of this legislation fall within budget function 370 (commerce and housing credit). -------------------------------------------------------------------------------------------------------------------------------------------------------- By fiscal year, in millions of dollars-- ------------------------------------------------------------------------------------------ 2014- 2014- 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2019 2024 -------------------------------------------------------------------------------------------------------------------------------------------------------- CHANGES IN DIRECT SPENDING Estimated Budget Authority................................... 3 1 1 1 1 1 1 1 1 1 1 6 9 Estimated Outlays............................................ * 3 1 1 1 1 1 1 1 1 1 5 8 -------------------------------------------------------------------------------------------------------------------------------------------------------- Note: Components may not sum to totals because of rounding; * = less than $500,000. Basis of estimate; For this estimate, CBO assumes that the legislation will be enacted near the middle of fiscal year 2014 and that spending will follow historical patterns for the CFPB. The CFPB is permanently authorized to spend amounts transferred from the Federal Reserve; because that activity is not subject to appropriation, CFPB expenditures are recorded in the budget as direct spending. Under current law, the CFPB may obtain certain financial information about an individual from businesses that offer financial products to consumers under certain conditions. H.R. 2571 would require the bureau (and any entities collecting information for the bureau) to inform consumers of the information that is being sought and receive permission from the affected individuals before gathering such information. CBO estimates that it would cost $8 million over the 2014- 2024 period to implement a system to monitor requests made to individuals. Information from the CFPB indicates that the bulk of the data maintained by the bureau to monitor risks to consumers of financial products does not contain information that allows individual consumers to be identified. However, based on information from the CFPB, CBO expects that the bureau would develop a system to monitor requests made to individuals when the agency does use information that is individually identifiable. CBO estimates the CFPB would spend about $3 million soon after enactment for system development costs, and less than $1 million per year thereafter for ongoing use and maintenance costs. Pay-As-You-Go considerations: The Statutory Pay-As-You-Go Act of 2010 establishes budget-reporting and enforcement procedures for legislation affecting direct spending or revenues. The net changes in outlays that are subject to those pay-as-you-go procedures are shown in the following table. CBO ESTIMATE OF PAY-AS-YOU-GO EFFECTS FOR H.R. 2571, AS ORDERED REPORTED BY THE HOUSE COMMITTEE ON FINANCIAL SERVICES ON NOVEMBER 21, 2013 -------------------------------------------------------------------------------------------------------------------------------------------------------- By fiscal year, in millions of dollars ------------------------------------------------------------------------------------------ 2014- 2014- 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2019 2024 -------------------------------------------------------------------------------------------------------------------------------------------------------- NET INCREASE IN THE DEFICIT Statutory Pay-As-You-Go Impact............................... 0 3 1 1 1 1 1 1 1 1 1 5 8 -------------------------------------------------------------------------------------------------------------------------------------------------------- Note: Components may not sum to totals because of rounding. Intergovernmental and private-sector impact: H.R. 2571 contains no intergovernmental or private-sector mandates as defined in UMRA and would not affect the budgets of state, local, or tribal governments. Estimate prepared by: Federal Costs: Susan Willie, Impact on State, Local, and Tribal Governments: Melissa Merrell, Impact on the Private Sector: Paige Piper/Bach. Estimate approved by: Theresa Gullo, Deputy Assistant Director for Budget Analysis. Federal Mandates Statement The Committee adopts as its own the estimate of Federal mandates prepared by the Director of the Congressional Budget Office pursuant to section 423 of the Unfunded Mandates Reform Act. Advisory Committee Statement No advisory committees within the meaning of section 5(b) of the Federal Advisory Committee Act were created by this legislation. Applicability to Legislative Branch The Committee finds that the legislation does not relate to the terms and conditions of employment or access to public services or accommodations within the meaning of the section 102(b)(3) of the Congressional Accountability Act. Earmark Identification H.R. 2571 does not contain any congressional earmarks, limited tax benefits, or limited tariff benefits as defined in clause 9 of rule XXI. Duplication of Federal Programs Pursuant to section 3(j) of H. Res. 5, 113th Cong. (2013), the Committee states that no provision of H.R. 2571 establishes or reauthorizes a program of the Federal Government known to be duplicative of another Federal program, a program that was included in any report from the Government Accountability Office to Congress pursuant to section 21 of Public Law 111- 139, or a program related to a program identified in the most recent Catalog of Federal Domestic Assistance. Disclosure of Directed Rulemaking Pursuant to section 3(k) of H. Res. 5, 113th Cong. (2013), the Committee states that H.R. 2571 contains no directed rulemaking. Section-by-Section Analysis of the Legislation Section 1. Short title This section cites H.R. 2571 as the ``Consumer Right to Financial Privacy Act of 2013.'' Section 2. Requirement of the Bureau of Consumer Financial Protection to obtain permission before collecting nonpublic personal information This section amends the Dodd-Frank Act to require the CFPB to obtain express permission from a consumer before requesting, obtaining, accessing, collecting, using, retaining, or disclosing any ``nonpublic personal information'' about such consumer. The section extends this permission requirement to contractors the CFPB hires to carry out its regulatory functions. Finally, it defines ``nonpublic personal information.'' Section 3. Removal of exemption for the Bureau of Consumer Financial Protection from the Right to Financial Privacy Act Consistent with section 2, this section strikes from the Right to Financial Privacy Act of 1978 (RFPA) an existing exception for CFPB's current data-collection efforts, thus restoring the RFPA's applicability to such efforts. Changes in Existing Law Made by the Bill, as Reported In compliance with clause 3(e) of rule XIII of the Rules of the House of Representatives, changes in existing law made by the bill, as reported, are shown as follows (existing law proposed to be omitted is enclosed in black brackets, new matter is printed in italic, existing law in which no change is proposed is shown in roman): DODD-FRANK WALL STREET REFORM AND CONSUMER PROTECTION ACT * * * * * * * TITLE X--BUREAU OF CONSUMER FINANCIAL PROTECTION * * * * * * * Subtitle B--General Powers of the Bureau * * * * * * * SEC. 1022. RULEMAKING AUTHORITY. (a) * * * * * * * * * * (c) Monitoring.-- (1) * * * * * * * * * * (9) Consumer privacy.-- (A) In general.--The Bureau [may not obtain from a covered person or service provider] may not request, obtain, access, collect, use, retain, or disclose any [personally identifiable financial] nonpublic personal information about a consumer [from the financial records of the covered person or service provider, except--] unless-- [(i) if the financial records are reasonably described in a request by the Bureau and the consumer provides written permission for the disclosure of such information by the covered person or service provider to the Bureau; or [(ii) as may be specifically permitted or required under other applicable provisions of law and in accordance with the Right to Financial Privacy Act of 1978 (12 U.S.C. 3401 et seq.).] (i) the Bureau clearly and conspicuously discloses to the consumer, in writing or in an electronic form, what information will be requested, obtained, accessed, collected, used, retained, or disclosed; and (ii) before such information is requested, obtained, accessed, collected, used, retained, or disclosed, the consumer informs the Bureau that such information may be requested, obtained, accessed, collected, used, retained, or disclosed. * * * * * * * [(B) Treatment of covered person or service provider.--With respect to the application of any provision of the Right to Financial Privacy Act of 1978, to a disclosure by a covered person or service provider subject to this subsection, the covered person or service provider shall be treated as if it were a ``financial institution'', as defined in section 1101 of that Act (12 U.S.C. 3401).] (B) Application of requirement to contractors of the bureau of consumer financial protection.--Subparagraph (A) shall apply to any person directed or engaged by the Bureau to collect information to the extent such information is being collected on behalf of the Bureau. (C) Definition of nonpublic personal information.--In this paragraph, the term ``nonpublic personal information'' has the meaning given the term in section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 6809). * * * * * * * ---------- RIGHT TO FINANCIAL PRIVACY ACT OF 1978 * * * * * * * TITLE XI--RIGHT TO FINANCIAL PRIVACY * * * * * * * exceptions Sec. 1113. (a) * * * * * * * * * * [(r) Disclosure to the Bureau of Consumer Financial Protection.--Nothing in this title shall apply to the examination by or disclosure to the Bureau of Consumer Financial Protection of financial records or information in the exercise of its authority with respect to a financial institution.] * * * * * * * MINORITY VIEWS H.R. 2571, the ``Consumer Right to Financial Privacy Act of 2013'' is a transparent attack on the Consumer Financial Protection Bureau's (CFPB) data driven approach to regulating consumer financial products and services. The bill would prevent the CFPB from accessing, collecting, using, retaining or disclosing non-public information without each individual consumer's written consent. First and foremost, the CFPB is already prohibited from collecting personally identifiable information in the course of its market monitoring responsibilities. Although the Bureau does collect certain information as part of its responsibility to identify and monitor market trends and proactively address emerging consumer credit issues, this information is deliberately depersonalized and aggregated to ensure consumer's sensitive information is protected. Despite existing restrictions on the CFPB's use of sensitive consumer data, the financial institutions that the CFPB is tasked with regulating have ready access to this information through private data vendors, which they use to market products to consumers. Requiring the Bureau to seek consent on an individual level for access to aggregated and anonymous data is not only a hindrance to their core mission to regulating the entities that offer consumer financial products and services, but it is a burdensome requirement well above and beyond what is required of other bank regulators. Rather than constraining the Bureau with onerous and unnecessary requirements that will impede its ability to protect consumers, the Committee should turn its attention to the pressing matter of improving the ways that private companies collect and protect consumer financial data, as evidenced by the recent string of high profile security breaches. Unfortunately, H.R. 2571 does not address any of these serious issues, nor does it increase consumer protection. It is designed simply to curtail the ability of the Consumer Financial Protection Bureau to protect consumers, while ensuring that financial institutions maintain a monopoly on access to consumers' sensitive information. Maxine Waters. Stephen F. Lynch. Ruben Hinojosa. Keith Ellison. David Scott. Michael E. Capuano. Carolyn B. Maloney. Kyrsten Sinema. Joyce Beatty. Bill Foster. Daniel Kildee. Al Green. James A. Himes. Denny Heck. John Carney. Gregory W. Meeks. Terri Sewell. Gwen Moore. Wm. Lacy Clay. Patrick Murphy. Ed Perlmutter. Brad Sherman. Emanuel Cleaver.