House Report 113-344 - CONSUMER RIGHT TO FINANCIAL PRIVACY ACT OF 2013

[House Report 113-344]
[From the U.S. Government Publishing Office]

113th Congress Report
HOUSE OF REPRESENTATIVES
2d Session 113-344

======================================================================

CONSUMER RIGHT TO FINANCIAL PRIVACY ACT OF 2013

_______

February 6, 2014.--Committed to the Committee of the Whole House on the
State of the Union and ordered to be printed

_______

Mr. Hensarling, from the Committee on Financial Services, submitted the
following

R E P O R T

together with

MINORITY VIEWS

[To accompany H.R. 2571]

[Including cost estimate of the Congressional Budget Office]

The Committee on Financial Services, to whom was referred
the bill (H.R. 2571) to amend the Dodd-Frank Wall Street Reform
and Consumer Protection Act to require the Bureau of Consumer
Financial Protection to notify and obtain permission from
consumers before collecting nonpublic personal information
about such consumers, and for other purposes, having considered
the same, report favorably thereon without amendment and
recommend that the bill do pass.

Purpose and Summary

H.R. 2571, the Consumer Right to Financial Privacy Act,
amends the Dodd-Frank Wall Street Reform and Consumer
Protection Act (the ``Dodd-Frank Act'') to prohibit the Bureau
of Consumer Financial Protection (the ``CFPB'' or the
``Bureau'') from requesting, accessing, collecting, using,
retaining, or disclosing nonpublic personal information about a
consumer unless (i) the CFPB clearly and conspicuously
discloses to the consumer, in writing or in an electronic form,
what information will be requested, obtained, accessed,
collected, used, retained, or disclosed; and (ii) the consumer
informs the CFPB, before such information is requested,
obtained, accessed, collected, used, retained, or disclosed,
that such information may be requested, obtained, accessed,
collected, used, retained, or disclosed. The bill subjects CFPB
contractors to the same restrictions and conditions. It also
amends the Right to Financial Privacy Act of 1978 to clarify
that it applies to the examination by or disclosure to the CFPB
of financial records or information in the exercise of its
authority with respect to a financial institution.

Background and Need for Legislation

Consumers of financial products have a legitimate interest
in the privacy of their personal financial information. While
the Dodd-Frank Act permits the CFPB to collect data as part of
its supervisory and examination functions, it expressly
prohibits the Bureau from gathering or analyzing personally
identifiable financial information on consumers. Section
1022(4)(C) of the Dodd-Frank Act provides that the CFPB ``may
not use its authority . . . to obtain records from covered
persons and service providers participating in consumer
financial services markets for purposes of gathering or
analyzing the personally identifiable information of
consumers.''
The CFPB has said that it is not collecting personally
identifiable information but has provided limited details to
the Committee on Financial Services on its data collection
efforts. Concerns also have been raised about data security
issues at the CFPB. A report by the Federal Reserve's Office of
Inspector General, which also has responsibility for overseeing
the CFPB, highlighted a series of concerns with the CFPB's
information-security controls over their widely used
contractor-operated systems. As part of its assessment, the
Inspector General examined a contractor-operated system and
found several ``management, operational, and technical control
weaknesses.'' Furthermore, ``CFPB has not established a
comprehensive information security strategy to guide the
implementation of an agency-wide information security
program.''
The Subcommittee on Financial Institutions and Consumer
Credit held a hearing on the CFPB's data collection practices
on July 9, 2013, at which CFPB Deputy Director Steve Antonakes
was unwilling or unable to answer many basic questions,
including how many individual credit card accounts the CFPB is
monitoring, or how many data fields it monitors per account,
even though the CFPB's strategic plan indicates that the CFPB
may be tracking as many as 900 million credit card accounts.
Many members of the Committee expressed concern regarding the
CFPB's ability to maintain the confidentiality and security of
personally identifiable information the Bureau collects about
American consumers.
In response to the concerns raised at this hearing, Rep.
Duffy introduced H.R. 2571 to ensure that the CFPB does not
collect or try to collect a consumer's nonpublic personal
financial information without such consumer's permission. The
bill requires the CFPB and its contractors to request
permission from a consumer before seeking his or her nonpublic
personal information and requires the consumer to expressly
consent to the data collection effort. To this end, the bill
promotes financial privacy, permits the consumer to manage
access to his or her nonpublic personal information, and
improves the transparency of the CFPB's massive data-collection
efforts.

Hearings

The Committee on Financial Services' Subcommittee on
Financial Institutions and Consumer Credit held a hearing on
H.R. 2571 on October 29, 2013.

Committee Consideration

The Committee on Financial Services met in open session on
November 20, 2013, and ordered H.R. 2571 to be reported
favorably to the House without amendment by a recorded vote of
32 yeas to 26 nays (recorded vote no. FC-45), a quorum being
present.

Committee Votes

Clause 3(b) of rule XIII of the Rules of the House of
Representatives requires the Committee to list the record votes
on the motion to report legislation and amendments thereto.
1. A motion by Chairman Hensarling to report the bill (H.R.
2571) without amendment to the House with a favorable
recommendation was agreed to by a record vote of 32 yeas to 26
nays (recorded vote no. FC-45).

RECORD VOTE NO. FC-45
----------------------------------------------------------------------------------------------------------------
Representative Yea Nay Present Representative Yea Nay Present
----------------------------------------------------------------------------------------------------------------
Mr. Hensarling................. X ........ ......... Ms. Waters....... ........ X .........
Mr. Bachus..................... X ........ ......... Mrs. Maloney (NY) ........ X .........
Mr. King (NY).................. X ........ ......... Ms. Velazquez.... ........ X .........
Mr. Royce...................... X ........ ......... Mr. Watt......... ........ X .........
Mr. Lucas...................... X ........ ......... Mr. Sherman...... ........ X .........
Mr. Gary G. Miller (CA)........ X ........ ......... Mr. Meeks........ ........ X .........
Mrs. Capito.................... X ........ ......... Mr. Capuano...... ........ X .........
Mr. Garrett.................... X ........ ......... Mr. Hinojosa..... ........ X .........
Mr. Neugebauer................. X ........ ......... Mr. Clay......... ........ ........ .........
Mr. McHenry.................... X ........ ......... Mrs. McCarthy ........ ........ .........
(NY).
Mr. Campbell................... ........ ........ ......... Mr. Lynch........ ........ X .........
Mrs. Bachmann.................. X ........ ......... Mr. David Scott ........ X .........
(GA).
Mr. McCarthy (CA).............. X ........ ......... Mr. Al Green (TX) ........ X .........
Mr. Pearce..................... X ........ ......... Mr. Cleaver...... ........ X .........
Mr. Posey...................... X ........ ......... Ms. Moore........ ........ X .........
Mr. Fitzpatrick................ X ........ ......... Mr. Ellison...... ........ X .........
Mr. Westmoreland............... X ........ ......... Mr. Perlmutter... ........ X .........
Mr. Luetkemeyer................ X ........ ......... Mr. Himes........ ........ X .........
Mr. Huizenga (MI).............. X ........ ......... Mr. Peters (MI).. ........ X .........
Mr. Duffy...................... X ........ ......... Mr. Carney....... ........ X .........
Mr. Hurt....................... X ........ ......... Ms. Sewell (AL).. ........ X
Mr. Grimm...................... X ........ ......... Mr. Foster....... ........ X .........
Mr. Stivers.................... X ........ ......... Mr. Kildee....... ........ X .........
Mr. Fincher.................... X ........ ......... Mr. Murphy (FL).. ........ X .........
Mr. Stutzman................... X ........ ......... Mr. Delaney...... ........ X .........
Mr. Mulvaney................... X ........ ......... Ms. Sinema....... ........ X .........
Mr. Hultgren................... X ........ ......... Mrs. Beatty...... ........ X .........
Mr. Ross....................... X ........ ......... Mr. Heck (WA).... ........ X .........
Mr. Pittenger.................. X ........ .........
Mrs. Wagner.................... X ........ .........
Mr. Barr....................... X ........ .........
Mr. Cotton..................... X ........ .........
Mr. Rothfus.................... X ........ .........
----------------------------------------------------------------------------------------------------------------

Committee Oversight Findings

Pursuant to clause 3(c)(1) of rule XIII of the Rules of the
House of Representatives, the Committee has held hearings and
made findings that are reflected in this report.

Performance Goals and Objectives

Pursuant to clause 3(c)(4) of rule XIII of the Rules of the
House of Representatives, the Committee states that H.R. 2571,
among other things, prohibits the CFPB from requesting,
accessing, collecting, using, retaining, or disclosing
nonpublic personal information about a consumer without the
consumer's express permission.

New Budget Authority, Entitlement Authority, and Tax Expenditures

In compliance with clause 3(c)(2) of rule XIII of the Rules
of the House of Representatives, the Committee adopts as its
own the estimate of new budget authority, entitlement
authority, or tax expenditures or revenues contained in the
cost estimate prepared by the Director of the Congressional
Budget Office pursuant to section 402 of the Congressional
Budget Act of 1974.

Committee Cost Estimate

The Committee adopts as its own the cost estimate prepared
by the Director of the Congressional Budget Office pursuant to
section 402 of the Congressional Budget Act of 1974.

Congressional Budget Office Estimates

Pursuant to clause 3(c)(3) of rule XIII of the Rules of the
House of Representatives, the following is the cost estimate
provided by the Congressional Budget Office pursuant to section
402 of the Congressional Budget Act of 1974:

U.S. Congress,
Congressional Budget Office,
Washington, DC, February 6, 2014.
Hon. Jeb Hensarling,
Chairman, Committee on Financial Services,
House of Representatives, Washington, DC.
Dear Mr. Chairman: The Congressional Budget Office has
prepared the enclosed cost estimate for H.R. 2571, the Consumer
Right to Financial Privacy Act of 2013.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contact is Susan Willie.
Sincerely,
Douglas W. Elmendorf.
Enclosure.

H.R. 2571--Consumer Right to Financial Privacy Act of 2013

Summary: H.R. 2571 would require the Consumer Financial
Protection Bureau (CFPB), in its efforts to monitor risks in
markets for consumer financial products, to notify and obtain
permission from individuals before collecting or using their
personal information. The bill also would extend that
requirement to businesses hired by the CFPB if the information
is being collected on the agency's behalf.
CBO estimates that enacting H.R. 2571 would increase direct
spending by $8 million over the 2014-2024 period; therefore,
pay-as-you go procedures apply. Enacting H.R. 2571 would not
affect revenues, and implementing the bill would not affect
spending subject to appropriation.
H.R. 2571 contains no intergovernmental or private-sector
mandates as defined in the Unfunded Mandates Reform Act (UMRA)
and would not affect the budgets of state, local, or tribal
governments.
Estimated cost to the Federal government: The estimated
budgetary impact of H.R. 2571 is shown in the following table.
The costs of this legislation fall within budget function 370
(commerce and housing credit).

--------------------------------------------------------------------------------------------------------------------------------------------------------
By fiscal year, in millions of dollars--
------------------------------------------------------------------------------------------
2014- 2014-
2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2019 2024
--------------------------------------------------------------------------------------------------------------------------------------------------------
CHANGES IN DIRECT SPENDING

Estimated Budget Authority................................... 3 1 1 1 1 1 1 1 1 1 1 6 9
Estimated Outlays............................................ * 3 1 1 1 1 1 1 1 1 1 5 8
--------------------------------------------------------------------------------------------------------------------------------------------------------
Note: Components may not sum to totals because of rounding; * = less than $500,000.

Basis of estimate; For this estimate, CBO assumes that the
legislation will be enacted near the middle of fiscal year 2014
and that spending will follow historical patterns for the CFPB.
The CFPB is permanently authorized to spend amounts transferred
from the Federal Reserve; because that activity is not subject
to appropriation, CFPB expenditures are recorded in the budget
as direct spending.
Under current law, the CFPB may obtain certain financial
information about an individual from businesses that offer
financial products to consumers under certain conditions. H.R.
2571 would require the bureau (and any entities collecting
information for the bureau) to inform consumers of the
information that is being sought and receive permission from
the affected individuals before gathering such information.
CBO estimates that it would cost $8 million over the 2014-
2024 period to implement a system to monitor requests made to
individuals. Information from the CFPB indicates that the bulk
of the data maintained by the bureau to monitor risks to
consumers of financial products does not contain information
that allows individual consumers to be identified. However,
based on information from the CFPB, CBO expects that the bureau
would develop a system to monitor requests made to individuals
when the agency does use information that is individually
identifiable. CBO estimates the CFPB would spend about $3
million soon after enactment for system development costs, and
less than $1 million per year thereafter for ongoing use and
maintenance costs.
Pay-As-You-Go considerations: The Statutory Pay-As-You-Go
Act of 2010 establishes budget-reporting and enforcement
procedures for legislation affecting direct spending or
revenues. The net changes in outlays that are subject to those
pay-as-you-go procedures are shown in the following table.

CBO ESTIMATE OF PAY-AS-YOU-GO EFFECTS FOR H.R. 2571, AS ORDERED REPORTED BY THE HOUSE COMMITTEE ON FINANCIAL SERVICES ON NOVEMBER 21, 2013
--------------------------------------------------------------------------------------------------------------------------------------------------------
By fiscal year, in millions of dollars
------------------------------------------------------------------------------------------
2014- 2014-
2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2019 2024
--------------------------------------------------------------------------------------------------------------------------------------------------------
NET INCREASE IN THE DEFICIT

Statutory Pay-As-You-Go Impact............................... 0 3 1 1 1 1 1 1 1 1 1 5 8
--------------------------------------------------------------------------------------------------------------------------------------------------------
Note: Components may not sum to totals because of rounding.

Intergovernmental and private-sector impact: H.R. 2571
contains no intergovernmental or private-sector mandates as
defined in UMRA and would not affect the budgets of state,
local, or tribal governments.
Estimate prepared by: Federal Costs: Susan Willie, Impact
on State, Local, and Tribal Governments: Melissa Merrell,
Impact on the Private Sector: Paige Piper/Bach.
Estimate approved by: Theresa Gullo, Deputy Assistant
Director for Budget Analysis.

Federal Mandates Statement

The Committee adopts as its own the estimate of Federal
mandates prepared by the Director of the Congressional Budget
Office pursuant to section 423 of the Unfunded Mandates Reform
Act.

Advisory Committee Statement

No advisory committees within the meaning of section 5(b)
of the Federal Advisory Committee Act were created by this
legislation.

Applicability to Legislative Branch

The Committee finds that the legislation does not relate to
the terms and conditions of employment or access to public
services or accommodations within the meaning of the section
102(b)(3) of the Congressional Accountability Act.

Earmark Identification

H.R. 2571 does not contain any congressional earmarks,
limited tax benefits, or limited tariff benefits as defined in
clause 9 of rule XXI.

Duplication of Federal Programs

Pursuant to section 3(j) of H. Res. 5, 113th Cong. (2013),
the Committee states that no provision of H.R. 2571 establishes
or reauthorizes a program of the Federal Government known to be
duplicative of another Federal program, a program that was
included in any report from the Government Accountability
Office to Congress pursuant to section 21 of Public Law 111-
139, or a program related to a program identified in the most
recent Catalog of Federal Domestic Assistance.

Disclosure of Directed Rulemaking

Pursuant to section 3(k) of H. Res. 5, 113th Cong. (2013),
the Committee states that H.R. 2571 contains no directed
rulemaking.

Section-by-Section Analysis of the Legislation

Section 1. Short title

This section cites H.R. 2571 as the ``Consumer Right to
Financial Privacy Act of 2013.''

Section 2. Requirement of the Bureau of Consumer Financial Protection
to obtain permission before collecting nonpublic personal
information

This section amends the Dodd-Frank Act to require the CFPB
to obtain express permission from a consumer before requesting,
obtaining, accessing, collecting, using, retaining, or
disclosing any ``nonpublic personal information'' about such
consumer. The section extends this permission requirement to
contractors the CFPB hires to carry out its regulatory
functions. Finally, it defines ``nonpublic personal
information.''

Section 3. Removal of exemption for the Bureau of Consumer Financial
Protection from the Right to Financial Privacy Act

Consistent with section 2, this section strikes from the
Right to Financial Privacy Act of 1978 (RFPA) an existing
exception for CFPB's current data-collection efforts, thus
restoring the RFPA's applicability to such efforts.

Changes in Existing Law Made by the Bill, as Reported

In compliance with clause 3(e) of rule XIII of the Rules of
the House of Representatives, changes in existing law made by
the bill, as reported, are shown as follows (existing law
proposed to be omitted is enclosed in black brackets, new
matter is printed in italic, existing law in which no change is
proposed is shown in roman):

DODD-FRANK WALL STREET REFORM AND CONSUMER PROTECTION ACT

* * * * * * *

TITLE X--BUREAU OF CONSUMER FINANCIAL PROTECTION

* * * * * * *

Subtitle B--General Powers of the Bureau

* * * * * * *

SEC. 1022. RULEMAKING AUTHORITY.

(a) * * *

* * * * * * *

(9) Consumer privacy.--
(A) In general.--The Bureau [may not obtain
from a covered person or service provider] may
not request, obtain, access, collect, use,
retain, or disclose any [personally
identifiable financial] nonpublic personal
information about a consumer [from the
financial records of the covered person or
service provider, except--] unless--
[(i) if the financial records are
reasonably described in a request by
the Bureau and the consumer provides
written permission for the disclosure
of such information by the covered
person or service provider to the
Bureau; or
[(ii) as may be specifically
permitted or required under other
applicable provisions of law and in
accordance with the Right to Financial
Privacy Act of 1978 (12 U.S.C. 3401 et
seq.).]
(i) the Bureau clearly and
conspicuously discloses to the
consumer, in writing or in an
electronic form, what information will
be requested, obtained, accessed,
collected, used, retained, or
disclosed; and
(ii) before such information is
requested, obtained, accessed,
collected, used, retained, or
disclosed, the consumer informs the
Bureau that such information may be
requested, obtained, accessed,
collected, used, retained, or
disclosed.

* * * * * * *

[(B) Treatment of covered person or service
provider.--With respect to the application of
any provision of the Right to Financial Privacy
Act of 1978, to a disclosure by a covered
person or service provider subject to this
subsection, the covered person or service
provider shall be treated as if it were a
``financial institution'', as defined in
section 1101 of that Act (12 U.S.C. 3401).]
(B) Application of requirement to contractors
of the bureau of consumer financial
protection.--Subparagraph (A) shall apply to
any person directed or engaged by the Bureau to
collect information to the extent such
information is being collected on behalf of the
Bureau.
(C) Definition of nonpublic personal
information.--In this paragraph, the term
``nonpublic personal information'' has the
meaning given the term in section 509 of the
Gramm-Leach-Bliley Act (15 U.S.C. 6809).

* * * * * * *

----------

RIGHT TO FINANCIAL PRIVACY ACT OF 1978

* * * * * * *

TITLE XI--RIGHT TO FINANCIAL PRIVACY

* * * * * * *

exceptions

Sec. 1113. (a) * * *

* * * * * * *

[(r) Disclosure to the Bureau of Consumer Financial
Protection.--Nothing in this title shall apply to the
examination by or disclosure to the Bureau of Consumer
Financial Protection of financial records or information in the
exercise of its authority with respect to a financial
institution.]

* * * * * * *

MINORITY VIEWS

H.R. 2571, the ``Consumer Right to Financial Privacy Act of
2013'' is a transparent attack on the Consumer Financial
Protection Bureau's (CFPB) data driven approach to regulating
consumer financial products and services. The bill would
prevent the CFPB from accessing, collecting, using, retaining
or disclosing non-public information without each individual
consumer's written consent.
First and foremost, the CFPB is already prohibited from
collecting personally identifiable information in the course of
its market monitoring responsibilities. Although the Bureau
does collect certain information as part of its responsibility
to identify and monitor market trends and proactively address
emerging consumer credit issues, this information is
deliberately depersonalized and aggregated to ensure consumer's
sensitive information is protected.
Despite existing restrictions on the CFPB's use of
sensitive consumer data, the financial institutions that the
CFPB is tasked with regulating have ready access to this
information through private data vendors, which they use to
market products to consumers. Requiring the Bureau to seek
consent on an individual level for access to aggregated and
anonymous data is not only a hindrance to their core mission to
regulating the entities that offer consumer financial products
and services, but it is a burdensome requirement well above and
beyond what is required of other bank regulators.
Rather than constraining the Bureau with onerous and
unnecessary requirements that will impede its ability to
protect consumers, the Committee should turn its attention to
the pressing matter of improving the ways that private
companies collect and protect consumer financial data, as
evidenced by the recent string of high profile security
breaches. Unfortunately, H.R. 2571 does not address any of
these serious issues, nor does it increase consumer protection.
It is designed simply to curtail the ability of the Consumer
Financial Protection Bureau to protect consumers, while
ensuring that financial institutions maintain a monopoly on
access to consumers' sensitive information.

Maxine Waters.
Stephen F. Lynch.
Ruben Hinojosa.
Keith Ellison.
David Scott.
Michael E. Capuano.
Carolyn B. Maloney.
Kyrsten Sinema.
Joyce Beatty.
Bill Foster.
Daniel Kildee.
Al Green.
James A. Himes.
Denny Heck.
John Carney.
Gregory W. Meeks.
Terri Sewell.
Gwen Moore.
Wm. Lacy Clay.
Patrick Murphy.
Ed Perlmutter.
Brad Sherman.
Emanuel Cleaver.