The CFPB’s proposed rules governing the handling of data would allow the agency to disclose to non-credit union regulators information that should remain confidential, credit union trade groups said in comments filed last week.
The bureau should be prohibited from collecting information from credit unions and sharing it with any agency besides the NCUA, NAFCU Regulatory Affairs Counsel Andrew Morris wrote in reacting to the proposed rules.
For instance, NAFCU officials question whether the CFPB should be permitted to disclose confidential information to organizations such as state bar associations. CUNA officials agreed.
“The vast expansion of information sharing contemplated by the proposal could increase the risk of unintended disclosures and a loss of confidentiality, which could ultimately harm consumers,” Luke Martone, CUNA’s senior director of advocacy and counsel, told CFPB officials.
Nothing in Dodd-Frank allows the bureau to have total discretion to define how it provides confidential information to non-financial regulators, Morris wrote.
In addition, Martone said, the proposed rules would permit the CFPB to share information about a credit union with a service provider working for the institution. That disclosure is not necessary for supervision or enforcement purposes and it could expose the institution to potential data breaches and unauthorized release to the public, he said.
The CFPB also broadly interprets when it may release information to another agency, the trade groups said, adding that the rule would allow disclosure of information to agencies that do not have supervisory powers over credit unions.
“Such a strained interpretation is clearly outside the language of the statute,” Martone said.
In issuing the proposed rules, the CFPB said that it sought to provide the maximum amount of protection for confidential information, while ensuring its ability to disclose information in order to achieve its mission and fulfill its duties.
