[House Report 113-344]
[From the U.S. Government Publishing Office]


113th Congress                                                   Report
                        HOUSE OF REPRESENTATIVES
 2d Session                                                     113-344

======================================================================



 
            CONSUMER RIGHT TO FINANCIAL PRIVACY ACT OF 2013

                                _______
                                

February 6, 2014.--Committed to the Committee of the Whole House on the 
              State of the Union and ordered to be printed

                                _______
                                

Mr. Hensarling, from the Committee on Financial Services, submitted the 
                               following

                              R E P O R T

                             together with

                             MINORITY VIEWS

                        [To accompany H.R. 2571]

      [Including cost estimate of the Congressional Budget Office]

    The Committee on Financial Services, to whom was referred 
the bill (H.R. 2571) to amend the Dodd-Frank Wall Street Reform 
and Consumer Protection Act to require the Bureau of Consumer 
Financial Protection to notify and obtain permission from 
consumers before collecting nonpublic personal information 
about such consumers, and for other purposes, having considered 
the same, report favorably thereon without amendment and 
recommend that the bill do pass.

                          Purpose and Summary

    H.R. 2571, the Consumer Right to Financial Privacy Act, 
amends the Dodd-Frank Wall Street Reform and Consumer 
Protection Act (the ``Dodd-Frank Act'') to prohibit the Bureau 
of Consumer Financial Protection (the ``CFPB'' or the 
``Bureau'') from requesting, accessing, collecting, using, 
retaining, or disclosing nonpublic personal information about a 
consumer unless (i) the CFPB clearly and conspicuously 
discloses to the consumer, in writing or in an electronic form, 
what information will be requested, obtained, accessed, 
collected, used, retained, or disclosed; and (ii) the consumer 
informs the CFPB, before such information is requested, 
obtained, accessed, collected, used, retained, or disclosed, 
that such information may be requested, obtained, accessed, 
collected, used, retained, or disclosed. The bill subjects CFPB 
contractors to the same restrictions and conditions. It also 
amends the Right to Financial Privacy Act of 1978 to clarify 
that it applies to the examination by or disclosure to the CFPB 
of financial records or information in the exercise of its 
authority with respect to a financial institution.

                  Background and Need for Legislation

    Consumers of financial products have a legitimate interest 
in the privacy of their personal financial information. While 
the Dodd-Frank Act permits the CFPB to collect data as part of 
its supervisory and examination functions, it expressly 
prohibits the Bureau from gathering or analyzing personally 
identifiable financial information on consumers. Section 
1022(4)(C) of the Dodd-Frank Act provides that the CFPB ``may 
not use its authority . . . to obtain records from covered 
persons and service providers participating in consumer 
financial services markets for purposes of gathering or 
analyzing the personally identifiable information of 
consumers.''
    The CFPB has said that it is not collecting personally 
identifiable information but has provided limited details to 
the Committee on Financial Services on its data collection 
efforts. Concerns also have been raised about data security 
issues at the CFPB. A report by the Federal Reserve's Office of 
Inspector General, which also has responsibility for overseeing 
the CFPB, highlighted a series of concerns with the CFPB's 
information-security controls over their widely used 
contractor-operated systems. As part of its assessment, the 
Inspector General examined a contractor-operated system and 
found several ``management, operational, and technical control 
weaknesses.'' Furthermore, ``CFPB has not established a 
comprehensive information security strategy to guide the 
implementation of an agency-wide information security 
program.''
    The Subcommittee on Financial Institutions and Consumer 
Credit held a hearing on the CFPB's data collection practices 
on July 9, 2013, at which CFPB Deputy Director Steve Antonakes 
was unwilling or unable to answer many basic questions, 
including how many individual credit card accounts the CFPB is 
monitoring, or how many data fields it monitors per account, 
even though the CFPB's strategic plan indicates that the CFPB 
may be tracking as many as 900 million credit card accounts. 
Many members of the Committee expressed concern regarding the 
CFPB's ability to maintain the confidentiality and security of 
personally identifiable information the Bureau collects about 
American consumers.
    In response to the concerns raised at this hearing, Rep. 
Duffy introduced H.R. 2571 to ensure that the CFPB does not 
collect or try to collect a consumer's nonpublic personal 
financial information without such consumer's permission. The 
bill requires the CFPB and its contractors to request 
permission from a consumer before seeking his or her nonpublic 
personal information and requires the consumer to expressly 
consent to the data collection effort. To this end, the bill 
promotes financial privacy, permits the consumer to manage 
access to his or her nonpublic personal information, and 
improves the transparency of the CFPB's massive data-collection 
efforts.

                                Hearings

    The Committee on Financial Services' Subcommittee on 
Financial Institutions and Consumer Credit held a hearing on 
H.R. 2571 on October 29, 2013.

                        Committee Consideration

    The Committee on Financial Services met in open session on 
November 20, 2013, and ordered H.R. 2571 to be reported 
favorably to the House without amendment by a recorded vote of 
32 yeas to 26 nays (recorded vote no. FC-45), a quorum being 
present.

                            Committee Votes

    Clause 3(b) of rule XIII of the Rules of the House of 
Representatives requires the Committee to list the record votes 
on the motion to report legislation and amendments thereto.
    1. A motion by Chairman Hensarling to report the bill (H.R. 
2571) without amendment to the House with a favorable 
recommendation was agreed to by a record vote of 32 yeas to 26 
nays (recorded vote no. FC-45).

                                              RECORD VOTE NO. FC-45
----------------------------------------------------------------------------------------------------------------
         Representative             Yea       Nay     Present     Representative      Yea       Nay     Present
----------------------------------------------------------------------------------------------------------------
Mr. Hensarling.................        X   ........  .........  Ms. Waters.......  ........        X   .........
Mr. Bachus.....................        X   ........  .........  Mrs. Maloney (NY)  ........        X   .........
Mr. King (NY)..................        X   ........  .........  Ms. Velazquez....  ........        X   .........
Mr. Royce......................        X   ........  .........  Mr. Watt.........  ........        X   .........
Mr. Lucas......................        X   ........  .........  Mr. Sherman......  ........        X   .........
Mr. Gary G. Miller (CA)........        X   ........  .........  Mr. Meeks........  ........        X   .........
Mrs. Capito....................        X   ........  .........  Mr. Capuano......  ........        X   .........
Mr. Garrett....................        X   ........  .........  Mr. Hinojosa.....  ........        X   .........
Mr. Neugebauer.................        X   ........  .........  Mr. Clay.........  ........  ........  .........
Mr. McHenry....................        X   ........  .........  Mrs. McCarthy      ........  ........  .........
                                                                 (NY).
Mr. Campbell...................  ........  ........  .........  Mr. Lynch........  ........        X   .........
Mrs. Bachmann..................        X   ........  .........  Mr. David Scott    ........        X   .........
                                                                 (GA).
Mr. McCarthy (CA)..............        X   ........  .........  Mr. Al Green (TX)  ........        X   .........
Mr. Pearce.....................        X   ........  .........  Mr. Cleaver......  ........        X   .........
Mr. Posey......................        X   ........  .........  Ms. Moore........  ........        X   .........
Mr. Fitzpatrick................        X   ........  .........  Mr. Ellison......  ........        X   .........
Mr. Westmoreland...............        X   ........  .........  Mr. Perlmutter...  ........        X   .........
Mr. Luetkemeyer................        X   ........  .........  Mr. Himes........  ........        X   .........
Mr. Huizenga (MI)..............        X   ........  .........  Mr. Peters (MI)..  ........        X   .........
Mr. Duffy......................        X   ........  .........  Mr. Carney.......  ........        X   .........
Mr. Hurt.......................        X   ........  .........  Ms. Sewell (AL)..  ........        X
Mr. Grimm......................        X   ........  .........  Mr. Foster.......  ........        X   .........
Mr. Stivers....................        X   ........  .........  Mr. Kildee.......  ........        X   .........
Mr. Fincher....................        X   ........  .........  Mr. Murphy (FL)..  ........        X   .........
Mr. Stutzman...................        X   ........  .........  Mr. Delaney......  ........        X   .........
Mr. Mulvaney...................        X   ........  .........  Ms. Sinema.......  ........        X   .........
Mr. Hultgren...................        X   ........  .........  Mrs. Beatty......  ........        X   .........
Mr. Ross.......................        X   ........  .........  Mr. Heck (WA)....  ........        X   .........
Mr. Pittenger..................        X   ........  .........
Mrs. Wagner....................        X   ........  .........
Mr. Barr.......................        X   ........  .........
Mr. Cotton.....................        X   ........  .........
Mr. Rothfus....................        X   ........  .........
----------------------------------------------------------------------------------------------------------------

                      Committee Oversight Findings

    Pursuant to clause 3(c)(1) of rule XIII of the Rules of the 
House of Representatives, the Committee has held hearings and 
made findings that are reflected in this report.

                    Performance Goals and Objectives

    Pursuant to clause 3(c)(4) of rule XIII of the Rules of the 
House of Representatives, the Committee states that H.R. 2571, 
among other things, prohibits the CFPB from requesting, 
accessing, collecting, using, retaining, or disclosing 
nonpublic personal information about a consumer without the 
consumer's express permission.

   New Budget Authority, Entitlement Authority, and Tax Expenditures

    In compliance with clause 3(c)(2) of rule XIII of the Rules 
of the House of Representatives, the Committee adopts as its 
own the estimate of new budget authority, entitlement 
authority, or tax expenditures or revenues contained in the 
cost estimate prepared by the Director of the Congressional 
Budget Office pursuant to section 402 of the Congressional 
Budget Act of 1974.

                        Committee Cost Estimate

    The Committee adopts as its own the cost estimate prepared 
by the Director of the Congressional Budget Office pursuant to 
section 402 of the Congressional Budget Act of 1974.

                 Congressional Budget Office Estimates

    Pursuant to clause 3(c)(3) of rule XIII of the Rules of the 
House of Representatives, the following is the cost estimate 
provided by the Congressional Budget Office pursuant to section 
402 of the Congressional Budget Act of 1974:

                                     U.S. Congress,
                               Congressional Budget Office,
                                  Washington, DC, February 6, 2014.
Hon. Jeb Hensarling,
Chairman, Committee on Financial Services,
House of Representatives, Washington, DC.
    Dear Mr. Chairman: The Congressional Budget Office has 
prepared the enclosed cost estimate for H.R. 2571, the Consumer 
Right to Financial Privacy Act of 2013.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contact is Susan Willie.
            Sincerely,
                                              Douglas W. Elmendorf.
    Enclosure.

H.R. 2571--Consumer Right to Financial Privacy Act of 2013

    Summary: H.R. 2571 would require the Consumer Financial 
Protection Bureau (CFPB), in its efforts to monitor risks in 
markets for consumer financial products, to notify and obtain 
permission from individuals before collecting or using their 
personal information. The bill also would extend that 
requirement to businesses hired by the CFPB if the information 
is being collected on the agency's behalf.
    CBO estimates that enacting H.R. 2571 would increase direct 
spending by $8 million over the 2014-2024 period; therefore, 
pay-as-you go procedures apply. Enacting H.R. 2571 would not 
affect revenues, and implementing the bill would not affect 
spending subject to appropriation.
    H.R. 2571 contains no intergovernmental or private-sector 
mandates as defined in the Unfunded Mandates Reform Act (UMRA) 
and would not affect the budgets of state, local, or tribal 
governments.
    Estimated cost to the Federal government: The estimated 
budgetary impact of H.R. 2571 is shown in the following table. 
The costs of this legislation fall within budget function 370 
(commerce and housing credit).

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                        By fiscal year, in millions of dollars--
                                                              ------------------------------------------------------------------------------------------
                                                                                                                                            2014-  2014-
                                                                2014   2015   2016   2017   2018   2019   2020   2021   2022   2023   2024   2019   2024
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                               CHANGES IN DIRECT SPENDING

Estimated Budget Authority...................................      3      1      1      1      1      1      1      1      1      1      1      6      9
Estimated Outlays............................................      *      3      1      1      1      1      1      1      1      1      1      5     8
--------------------------------------------------------------------------------------------------------------------------------------------------------
Note: Components may not sum to totals because of rounding; * = less than $500,000.

    Basis of estimate; For this estimate, CBO assumes that the 
legislation will be enacted near the middle of fiscal year 2014 
and that spending will follow historical patterns for the CFPB. 
The CFPB is permanently authorized to spend amounts transferred 
from the Federal Reserve; because that activity is not subject 
to appropriation, CFPB expenditures are recorded in the budget 
as direct spending.
    Under current law, the CFPB may obtain certain financial 
information about an individual from businesses that offer 
financial products to consumers under certain conditions. H.R. 
2571 would require the bureau (and any entities collecting 
information for the bureau) to inform consumers of the 
information that is being sought and receive permission from 
the affected individuals before gathering such information.
    CBO estimates that it would cost $8 million over the 2014-
2024 period to implement a system to monitor requests made to 
individuals. Information from the CFPB indicates that the bulk 
of the data maintained by the bureau to monitor risks to 
consumers of financial products does not contain information 
that allows individual consumers to be identified. However, 
based on information from the CFPB, CBO expects that the bureau 
would develop a system to monitor requests made to individuals 
when the agency does use information that is individually 
identifiable. CBO estimates the CFPB would spend about $3 
million soon after enactment for system development costs, and 
less than $1 million per year thereafter for ongoing use and 
maintenance costs.
    Pay-As-You-Go considerations: The Statutory Pay-As-You-Go 
Act of 2010 establishes budget-reporting and enforcement 
procedures for legislation affecting direct spending or 
revenues. The net changes in outlays that are subject to those 
pay-as-you-go procedures are shown in the following table.

       CBO ESTIMATE OF PAY-AS-YOU-GO EFFECTS FOR H.R. 2571, AS ORDERED REPORTED BY THE HOUSE COMMITTEE ON FINANCIAL SERVICES ON NOVEMBER 21, 2013
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                         By fiscal year, in millions of dollars
                                                              ------------------------------------------------------------------------------------------
                                                                                                                                            2014-  2014-
                                                                2014   2015   2016   2017   2018   2019   2020   2021   2022   2023   2024   2019   2024
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                               NET INCREASE IN THE DEFICIT

Statutory Pay-As-You-Go Impact...............................      0      3      1      1      1      1      1      1      1      1      1      5     8
--------------------------------------------------------------------------------------------------------------------------------------------------------
Note: Components may not sum to totals because of rounding.

    Intergovernmental and private-sector impact: H.R. 2571 
contains no intergovernmental or private-sector mandates as 
defined in UMRA and would not affect the budgets of state, 
local, or tribal governments.
    Estimate prepared by: Federal Costs: Susan Willie, Impact 
on State, Local, and Tribal Governments: Melissa Merrell, 
Impact on the Private Sector: Paige Piper/Bach.
    Estimate approved by: Theresa Gullo, Deputy Assistant 
Director for Budget Analysis.

                       Federal Mandates Statement

    The Committee adopts as its own the estimate of Federal 
mandates prepared by the Director of the Congressional Budget 
Office pursuant to section 423 of the Unfunded Mandates Reform 
Act.

                      Advisory Committee Statement

    No advisory committees within the meaning of section 5(b) 
of the Federal Advisory Committee Act were created by this 
legislation.

                  Applicability to Legislative Branch

    The Committee finds that the legislation does not relate to 
the terms and conditions of employment or access to public 
services or accommodations within the meaning of the section 
102(b)(3) of the Congressional Accountability Act.

                         Earmark Identification

    H.R. 2571 does not contain any congressional earmarks, 
limited tax benefits, or limited tariff benefits as defined in 
clause 9 of rule XXI.

                    Duplication of Federal Programs

    Pursuant to section 3(j) of H. Res. 5, 113th Cong. (2013), 
the Committee states that no provision of H.R. 2571 establishes 
or reauthorizes a program of the Federal Government known to be 
duplicative of another Federal program, a program that was 
included in any report from the Government Accountability 
Office to Congress pursuant to section 21 of Public Law 111-
139, or a program related to a program identified in the most 
recent Catalog of Federal Domestic Assistance.

                   Disclosure of Directed Rulemaking

    Pursuant to section 3(k) of H. Res. 5, 113th Cong. (2013), 
the Committee states that H.R. 2571 contains no directed 
rulemaking.

             Section-by-Section Analysis of the Legislation


Section 1. Short title

    This section cites H.R. 2571 as the ``Consumer Right to 
Financial Privacy Act of 2013.''

Section 2. Requirement of the Bureau of Consumer Financial Protection 
        to obtain permission before collecting nonpublic personal 
        information

    This section amends the Dodd-Frank Act to require the CFPB 
to obtain express permission from a consumer before requesting, 
obtaining, accessing, collecting, using, retaining, or 
disclosing any ``nonpublic personal information'' about such 
consumer. The section extends this permission requirement to 
contractors the CFPB hires to carry out its regulatory 
functions. Finally, it defines ``nonpublic personal 
information.''

Section 3. Removal of exemption for the Bureau of Consumer Financial 
        Protection from the Right to Financial Privacy Act

    Consistent with section 2, this section strikes from the 
Right to Financial Privacy Act of 1978 (RFPA) an existing 
exception for CFPB's current data-collection efforts, thus 
restoring the RFPA's applicability to such efforts.

         Changes in Existing Law Made by the Bill, as Reported

  In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italic, existing law in which no change is 
proposed is shown in roman):

DODD-FRANK WALL STREET REFORM AND CONSUMER PROTECTION ACT

           *       *       *       *       *       *       *



TITLE X--BUREAU OF CONSUMER FINANCIAL PROTECTION

           *       *       *       *       *       *       *


Subtitle B--General Powers of the Bureau

           *       *       *       *       *       *       *


SEC. 1022. RULEMAKING AUTHORITY.

  (a) * * *

           *       *       *       *       *       *       *

  (c) Monitoring.--
          (1) * * *

           *       *       *       *       *       *       *

          (9) Consumer privacy.--
                  (A) In general.--The Bureau [may not obtain 
                from a covered person or service provider] may 
                not request, obtain, access, collect, use, 
                retain, or disclose any [personally 
                identifiable financial] nonpublic personal 
                information about a consumer [from the 
                financial records of the covered person or 
                service provider, except--] unless--
                          [(i) if the financial records are 
                        reasonably described in a request by 
                        the Bureau and the consumer provides 
                        written permission for the disclosure 
                        of such information by the covered 
                        person or service provider to the 
                        Bureau; or
                          [(ii) as may be specifically 
                        permitted or required under other 
                        applicable provisions of law and in 
                        accordance with the Right to Financial 
                        Privacy Act of 1978 (12 U.S.C. 3401 et 
                        seq.).]
                          (i) the Bureau clearly and 
                        conspicuously discloses to the 
                        consumer, in writing or in an 
                        electronic form, what information will 
                        be requested, obtained, accessed, 
                        collected, used, retained, or 
                        disclosed; and
                          (ii) before such information is 
                        requested, obtained, accessed, 
                        collected, used, retained, or 
                        disclosed, the consumer informs the 
                        Bureau that such information may be 
                        requested, obtained, accessed, 
                        collected, used, retained, or 
                        disclosed.

           *       *       *       *       *       *       *

                  [(B) Treatment of covered person or service 
                provider.--With respect to the application of 
                any provision of the Right to Financial Privacy 
                Act of 1978, to a disclosure by a covered 
                person or service provider subject to this 
                subsection, the covered person or service 
                provider shall be treated as if it were a 
                ``financial institution'', as defined in 
                section 1101 of that Act (12 U.S.C. 3401).]
                  (B) Application of requirement to contractors 
                of the bureau of consumer financial 
                protection.--Subparagraph (A) shall apply to 
                any person directed or engaged by the Bureau to 
                collect information to the extent such 
                information is being collected on behalf of the 
                Bureau.
                  (C) Definition of nonpublic personal 
                information.--In this paragraph, the term 
                ``nonpublic personal information'' has the 
                meaning given the term in section 509 of the 
                Gramm-Leach-Bliley Act (15 U.S.C. 6809).

           *       *       *       *       *       *       *

                              ----------                              


RIGHT TO FINANCIAL PRIVACY ACT OF 1978

           *       *       *       *       *       *       *


TITLE XI--RIGHT TO FINANCIAL PRIVACY

           *       *       *       *       *       *       *


                               exceptions

  Sec. 1113. (a) * * *

           *       *       *       *       *       *       *

  [(r) Disclosure to the Bureau of Consumer Financial 
Protection.--Nothing in this title shall apply to the 
examination by or disclosure to the Bureau of Consumer 
Financial Protection of financial records or information in the 
exercise of its authority with respect to a financial 
institution.]

           *       *       *       *       *       *       *


                             MINORITY VIEWS

    H.R. 2571, the ``Consumer Right to Financial Privacy Act of 
2013'' is a transparent attack on the Consumer Financial 
Protection Bureau's (CFPB) data driven approach to regulating 
consumer financial products and services. The bill would 
prevent the CFPB from accessing, collecting, using, retaining 
or disclosing non-public information without each individual 
consumer's written consent.
    First and foremost, the CFPB is already prohibited from 
collecting personally identifiable information in the course of 
its market monitoring responsibilities. Although the Bureau 
does collect certain information as part of its responsibility 
to identify and monitor market trends and proactively address 
emerging consumer credit issues, this information is 
deliberately depersonalized and aggregated to ensure consumer's 
sensitive information is protected.
    Despite existing restrictions on the CFPB's use of 
sensitive consumer data, the financial institutions that the 
CFPB is tasked with regulating have ready access to this 
information through private data vendors, which they use to 
market products to consumers. Requiring the Bureau to seek 
consent on an individual level for access to aggregated and 
anonymous data is not only a hindrance to their core mission to 
regulating the entities that offer consumer financial products 
and services, but it is a burdensome requirement well above and 
beyond what is required of other bank regulators.
    Rather than constraining the Bureau with onerous and 
unnecessary requirements that will impede its ability to 
protect consumers, the Committee should turn its attention to 
the pressing matter of improving the ways that private 
companies collect and protect consumer financial data, as 
evidenced by the recent string of high profile security 
breaches. Unfortunately, H.R. 2571 does not address any of 
these serious issues, nor does it increase consumer protection. 
It is designed simply to curtail the ability of the Consumer 
Financial Protection Bureau to protect consumers, while 
ensuring that financial institutions maintain a monopoly on 
access to consumers' sensitive information.

                                   Maxine Waters.
                                   Stephen F. Lynch.
                                   Ruben Hinojosa.
                                   Keith Ellison.
                                   David Scott.
                                   Michael E. Capuano.
                                   Carolyn B. Maloney.
                                   Kyrsten Sinema.
                                   Joyce Beatty.
                                   Bill Foster.
                                   Daniel Kildee.
                                   Al Green.
                                   James A. Himes.
                                   Denny Heck.
                                   John Carney.
                                   Gregory W. Meeks.
                                   Terri Sewell.
                                   Gwen Moore.
                                   Wm. Lacy Clay.
                                   Patrick Murphy.
                                   Ed Perlmutter.
                                   Brad Sherman.
                                   Emanuel Cleaver.

                                  
