### 15572 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

1 http://www.nist.gov/pml/div684/upload/ FederalVisionQIS.pdf. 1 Disclosure of Certain Credit Card Complaint Data, 77 FR 37558 (June 22, 2012) (‘‘2012 Notice of Final Policy Statement’’); Disclosure of Consumer Complaint Data, 78 FR 21218 (Apr. 10, 2013) (‘‘2013 Notice of Final Policy Statement’’). Science and the Needs of U.S. Industry is to solicit input from stakeholders

about the broader needs of the industrial community in the area of quantum information science (QIS). Topics to be discussed include opportunities for research and development, emerging
market areas, barriers to near-term and future applications, and workforce needs. Information gathered at this workshop will be used in the development and coordination of U. S. Government policies, programs, and budgets to advance U.S. competitiveness in QIS.

This workshop will focus on the needs of industry in the following areas:

(1) Opportunities

Quantum information science includes, for example, quantum computing and processing, quantum algorithms and programming languages, quantum communications, quantum sensors, quantum devices, single photon
sources, and detectors. What areas of pre-competitive QIS research and development appear most promising? What areas should be the highest priorities for Federal investment? What are the emerging frontiers? What methods of monitoring new developments are most effective?

(2) Market Areas and Applications

The 2008 ‘‘A Federal Vision for Quantum Information Science’’ 1 identified exciting new possibilities for QIS impact, including mineral exploration, medical imaging, and quantum computing. Now, six yearslater, what market areas are wellpositioned to benefit from new developments in QIS?

(3) Barriers

Funding levels and mechanisms, technology, dissemination of information, and technology transfer are some of the potential barriers to adoption of QIS technology. What are the greatest barriers to advancing important near-term and future applications of QIS and what should be

done to address these barriers?

(4) Workforce Needs

Addressing opportunities in QIS and barriers to applications requires a workforce spanning many disciplines, ranging from computer science and information theory to atomic scale manipulation of materials, and possessing a range of knowledge and skills. What knowledge and skills are most important for a workforce capable of addressing the opportunities and

barriers? In what areas is the current workforce strong, and in what areas is

it weak? What are the best mechanisms for equipping workers with the needed knowledge and skills?

The workshop will include invited presentations by leading experts from academia, industry, and government and time for group discussion.

There is no cost for participating in the workshop. No proprietary information will be accepted, presented or discussed as part of the workshop, and all information accepted, presented or discussed at the workshop will be in the public domain.

Workshop Registration: All workshop participants must pre-register at the following web address to be admitted: http://www.nist.gov/pml/div684/quantum-information-scienceinnovation-and-the-path-forward.cfm. Anyone wishing to attend this meeting must register by 5 p.m. Eastern Time on April 3, 2015, in order to attend. Also, please note that under the REAL ID Act
of 2005 (Pub. L. 109–13), federal agencies, including NIST, can only accept a state-issued driver’s license or

identification card for access to federal facilities if issued by states that are REAL ID compliant or have an extension. NIST also currently accepts

other forms of federal-issued

identification in lieu of a state-issued

driver’s license. For detailed information please contact Gail
Newrock at (301) 975–3200 or visit: http://www.nist.gov/public

_ affairs/

visitor/.

Richard R. Cavanagh,

Acting Associate Director for Laboratory
Programs.

[FR Doc. 2015–06848 Filed 3–20–15; 4:15 pm]

**BILLING CODE 3510–13–P**

**BUREAU OF CONSUMER FINANCIAL**

**PROTECTION**

**[Docket No. CFPB–2014–0016]**

**Disclosure of Consumer Complaint**

**Narrative Data**

**AGENCY :**  Bureau of Consumer Financial

Protection.

**ACTION :**  Final Policy Statement.

**SUMMARY :**  The Bureau of Consumer
Financial Protection (the ‘‘Bureau’’) is issuing a final policy statement (‘‘Final Policy Statement’’) to provide guidance on how the Bureau plans to exercise its discretion to disclose publicly unstructured consumer complaint
narrative data (‘‘narratives’’ or
‘‘consumer narratives’’) via its webbased, public facing database (the ‘‘Consumer Complaint Database’’ or ‘‘Database’’). Only those narratives for which opt-in consumer consent is obtained and a robust personal information scrubbing standard and methodology applied will be eligible for disclosure. The Final Policy Statement supplements and amends the Bureau’s existing policy statements establishing and expanding the Consumer Complaint

Database. 1

**DATES :**  Applicability date: The Bureau will not publish any consented-to narrative for at least 90 days after publication in the Federal Register

.

**FOR FURTHER INFORMATION CONTACT :**  Scott Pluta, Assistant Director, Office of Consumer Response, Bureau of
Consumer Financial Protection, at (202)

435–7306.

**SUPPLEMENTARY INFORMATION :** 

Authority: 12 U.S.C. 5492(a), 5493(b)(3),
(d), 5496(c)(4), 5511(b), (c), 5512, 5534(a), (b).

I. Overview

A. Final Policy Statement

Under the Final Policy Statement, the Bureau extends its existing practice of disclosing data associated with consumer complaints via the Consumer Complaint Database to include narratives for which opt-in consumer

consent is obtained and a robust personal information scrubbing standard and methodology has been applied. The purposes of the Consumer Complaint Database include providing consumers with timely and

understandable information about consumer financial products and services, and improving the functioning, transparency, and efficiency of markets for such products and services. The Bureau believes that adding additional information to the Consumer Complaint
Database, here narratives and structured company responses, is consistent with and promotes these purposes.

II. Background

A. Complaint System

In the Bureau’s previous notices of its policy statements, establishing and expanding the Consumer Complaint Database, the Bureau generally

described how the Office of Consumer Response (‘‘Consumer Response’’) handles consumer complaints (collectively the ‘‘Complaint


### 15573 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

2 2012 Notice of Final Policy Statement, 77 FR at 37559 (June 22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21219 (April 10, 2013).

3 The Complaint System is described in more detail in the 2013 Consumer Response Annual Report (March 31, 2014) at: http://www.consumerfinance.gov/reports/2013-consumerresponse-annual-report./ 4 Disclosure of Consumer Complaint Narrative Data, 79 FR 42765, 42767 (July 23, 2014).

5 This group included: Americans for Financial Reform; Alliance for a Just Society; Arkansas Community Organization; California Reinvestment Coalition; Connecticut Citizen Action Group; Center for Digital Democracy; Center for Responsible Lending; Community Legal Services, Philadelphia;
Connecticut Fair Housing Center; Consumer Action;
Consumer Federation of America; Consumers for Auto Reliability and Safety; Consumer Watchdog; Demos; Electronic Privacy Information Center; Empire Justice Center; Florida Alliance for Consumer Protection; Home Defenders League; International Union, United Automobile, Aerospace & Agricultural Implement Workers of America (UAW); Keystone Progress; Leadership Conference on Civil and Human Rights; Massachusetts Consumers’ Coalition; MASSPIRG; Miami Valley Fair Housing Center, Dayton, Ohio; Missourians Organizing for Reform and Empowerment; NAACP;

National Association of Consumer Advocates;
National Consumer Law Center (on behalf of its low
income clients); National Council of La Raza; National Fair Housing Alliance; National People’s
Action; New Economy Project; New Jersey Citizen Action; New Jersey Communities; United Oregon Consumer League; Privacy Rights Clearinghouse; Privacy Times; Project on Government Oversight; Public Citizen; Public Justice Center; South Carolina Appleseed Legal Justice Center; Southwest Center for Economic Integrity; Texas Legal Services Center; The Institute for College Access and
Success; U.S.PIRG; Virginia Citizens Consumer
Council; Woodstock Institute; and the World
Privacy Forum. System’’). 2 This Final Policy Statement

does not affect how a consumer’s complaint is substantively handled by the Bureau. Consumer Response screens all complaints submitted by consumers based on several criteria, including whether the complaint should be routed to another regulator and whether the complaint is complete. Screened complaints are forwarded via a secure web portal to the appropriate company. The company then has 15 calendar days to provide an initial response and up to 60 calendar days to provide a final response. Companies have the ability within these timeframes to respond administratively to the Bureau, e.g., responding that no commercial relationship exists between the complaining consumer and the company in question. Typically, the company reviews the complaint,

communicates with the consumer as
needed, and determines what action to take in response. After the company responds to the consumer and the Bureau via the secure company portal,

the Bureau invites the consumer to review the response and provide feedback. Some complaints are individually reviewed by Consumer Response investigations staff. All complaints are subject to follow-up and further investigation by Consumer Response and other parts of the

Bureau. 3

The Bureau makes publicly available some data it collects as part of its complaint handling function, while continually striving to protect the

sensitive information contained within that data. One way the Bureau currently accomplishes this is by sharing some

fields from de-identified individuallevel complaint data with the public through the Consumer Complaint

Database. The Database was launched on June 19, 2012. It was initially populated with credit card complaint data but has since been expanded to include complaint data about other products, e.g., mortgages, bank accounts
and services, student loans, vehicle and other consumer loans, credit reporting, money transfers, debt collection, payday loans, and prepaid cards. Data from complaints are disclosed in the Database the earlier of: (1) An initial response to

the consumer and the Bureau (confirming a commercial relationship
with the consumer) or (2) 15 calendar days after the complaint was sent to the company. Data from a complaint is not published in the Database if, among other reasons, the company suspects the complaint was submitted in furtherance

of a fraud or it indicates to the Bureau

that it does not have a commercial relationship with the consumer.

B. Overview of Public Comments

In its Proposed Policy Statement Regarding Disclosure of Unstructured

Narrative Data From Consumer Complaints and Company Responses (‘‘Proposed Policy Statement’’), the Bureau proposed expanding its Consumer Complaint Database to include narratives submitted by consumers as well as public-facing narrative responses from companies. 4 The Bureau received 137 unique comments from, among others, consumer groups, trade associations, companies, and individuals. In some cases, several organizations jointly submitted a single comment letter. One financial reform organization,

Americans for Financial Reform (‘‘AFR’’), submitted a single set of
comments on behalf of 49 consumer, civil rights, privacy, and open

government groups. 5 The Bureau reviewed unique comments from 39 individuals, as well as substantially

identical comment letters from approximately 30,000 individuals expressing support for the Proposed Policy Statement. Commenters provided feedback on numerous aspects of the Proposed Policy Statement. Almost all comments concerned the expansion of the

Database to include narratives. Companies and their trade associations generally opposed the inclusion of narratives in the Database. Many industry commenters asserted that the publication of ‘‘unverified’’ consumer narratives would unfairly damage the reputations of companies. Several trade

associations also commented that

inclusion of unstructured narratives is contrary to the Bureau’s stated mission of being data-driven.

Per the AFR’s comment letter, consumer, civil rights, privacy, and open government groups supported the inclusion of narratives, asserting that among other things narratives would: ‘‘(1) Empower consumers with timely, valuable information pre-purchase, in order to prevent problems and reward companies that respect their customers, and post-purchase, in order to report unreasonable, unfair or deceptive practices and alert others in advance of problems; (2) allow others to assist the Bureau in detecting destructive patterns before they do extensive damage; and (3) encourage more people to use the
Database, as it becomes a more useful tool, creating a cycle of increased

information about consumer experiences in the financial services marketplace.’’ These groups and

individual commenters endorsed the goals underlying the publication of

consumer narratives.

Several commenters focused on
normalization, or the use of some metric to provide context for data, for example, by including information on the number of accounts a company has for each particular product or service. Some industry commenters noted the risk of potential consumer re-identification and the impact certain laws may have on a company’s ability to respond publicly to a consumer’s complaint. Both trade associations and consumer groups submitted written comments advising the Bureau to be mindful of the privacy

risks associated with narrative publication. Nonetheless, four nationally recognized privacy groups— Electronic Privacy Information Center, Privacy Rights Clearinghouse, Privacy Times, and World Privacy Forum— signed AFR’s comment letter in support of the Proposed Policy Statement. Additionally, Privacy Rights Clearinghouse submitted an individual comment generally supportive of disclosing narratives.

Many submissions included

comments directed to the Bureau’s method of processing consumer


### 15574 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

6 Consumer Response maintains several feedback mechanisms for participants in the Complaint System and has plans to expand this capability over

time.

7 Disclosure of Consumer Complaint Narrative Data, 79 FR 45183 (Aug. 4, 2014). 8 The Administrative Procedure Act exempts general statements of policy from notice and
comment. 5 U.S.C. 553(b)(A).

9 12 U.S.C. 5512(c)(6)(A).

10 To the extent any features of this policy were considered binding on any party, the Bureau believes they would constitute procedural rules, which are likewise exempt from the requirements
of notice and comment. 5 U.S.C. 553(b)(A). 11 See Ctr. for Auto Safety v. Nat’l Highway Traffic Safety Admin., 452 F.3d 798 (D.C. Cir. 2006) (agency’s general statement of policy was not a binding legislative rule simply because it had practical effects, rather than legal consequences, for private parties). Several commenters rely on Electronic Privacy Information Center v. Department of Homeland Security, 653 F.3d 1 (D.C.
Cir. 2011), but the Bureau does not believe that case supports their argument. The agency action in that case, in the court’s view, imposed legally binding requirements on airline passengers to go through heightened security procedures or be barred from entering airport boarding areas. The opportunity to provide a public response narrative does not impose any similar binding requirement.

12 See 2013 Notice of Final Policy Statement, 78 FR at 21226 (announcing planned changes to Public Complaint Database and stating Bureau’s intention to study and solicit further public feedback on the efficacy of its complaint policies)(April 10, 2013); 2012 Notice of Final Policy Statement, 77 FR at 37568 (same)(June 22, 2012). complaints, i.e., the Complaint System.

To the extent that these comments also related to the scope of the Proposed Policy Statement, the Bureau addresses

them below. Whether addressed below or not, the Bureau welcomes operational

feedback and intends to continue to refine its Complaint System over time. 6

III. Summary of Comments Received, Bureau Responses, and Resulting Policy Statement Changes

This section provides a summary of the comments received by subject matter to the Proposed Policy

Statement. It also summarizes the Bureau’s assessment of the comments by subject matter and, where applicable, describes the resulting changes that the Bureau is making in the Final Policy Statement including a change to how companies may respond publicly to individual complaints. All such changes concern the Consumer Complaint Database. There are no policy changes regarding the Bureau’s issuance of its own complaint data reports, e.g., the Consumer Response Annual Report.

A. The Policy Statement Process

The Bureau is committed to transparency and robust engagement with the public regarding its actions. Although not required by law to do so, the Bureau voluntarily solicited and received public comments on the Proposed Policy Statement. A few commenters requested a 60-day response period as opposed to the 30 days originally provided, a request the Bureau granted. 7 The Bureau received substantial public feedback expressing a range of viewpoints, and it has carefully
considered the comments received, as

described in detail below. As stated in the Final Policy Statement, the Bureau plans to monitor the effectiveness of its policy on an ongoing basis and to continue to engage with the public, including regulated entities, as it assesses the efficacy of the Final Policy

Statement.

Several commenters commended the Bureau on providing the opportunity to comment on the Proposed Policy

Statement. A number of trade

associations commented that the proposal could not be finalized in a general statement of policy and was instead a binding legislative rule subject to the procedural requirements of notice and comment rulemaking. 8 Several of these groups argued that rulemaking was required because the policy would obligate companies to provide public responses or else suffer reputational harm from unanswered complaint narratives. Some groups stated that the policy would impose new duties on the Bureau to verify the details contained in the narratives or to protect consumer privacy by removing information that

could lead to consumer reidentification. Two groups commented
that § 1022(c)(6)(A) of the Dodd-Frank Act, which requires the Bureau to issue rules concerning the confidential
treatment of information, dictates that any decision involving confidential

information has to be enacted as a legislative rule. 9 These groups also commented that the proposal would effectively amend the Bureau’s existing privacy regulations by releasing

confidential information and therefore had to be enacted through notice and comment. Two groups pointed to the example of the Consumer Product Safety Commission, which provided details about its statutorily mandated database of consumer product safety complaints via a legislative rule. The groups argued that the Bureau was required to follow the same process in announcing this policy. Finally, several of these groups suggested that the importance of releasing consumer narratives or the interest in transparency

meant that full notice and comment procedures were required.

The Final Policy Statement is meant to inform the public about the Bureau’s intended use of its discretionary authority to release certain de-identified information. The planned addition of narratives to the Consumer Complaint Database is properly the subject of a policy statement and does not require formal rulemaking. 10 The Bureau has made minor changes to the Final Policy Statement to clarify its nature as a general statement of policy. The policy neither binds private parties with any legal responsibilities nor creates any legal rights. As the Final Policy Statement makes clear, companies are under no obligation to recommend public-facing responses and will face no legal consequences by declining to do so. That some companies may decide it is worthwhile to recommend a public response does not rise to the level of a legal obligation. 11 For their part, consumers are under no obligation to opt in to sharing their stories, as the consent language will make clear by stating that the decision whether to provide consent for public disclosure

does not otherwise affect how the Bureau handles the complaint.

The Bureau is also not binding itself with new legal duties. As explained below, the Bureau is not committing to verify the details contained in each complaint narrative. Although the Bureau plans to scrub identifying

information from the consumer
narratives, it intends to do so in order

to assist consumers and ensure its compliance with existing laws, rather than through the assumption of such a duty through the present Final Policy

Statement. The addition of narratives to the Consumer Complaint Database is also in keeping with the Bureau’s stated intent to continue refining the way it
receives, shares, and makes use of consumer complaint information as well as with its past practice of making improvements to the Database. 12 As part of advancing that effort, and in response to comments it received in response to the Proposed Policy Statement, the Bureau is also publishing a Request for Information on how it might create or enhance opportunities for consumers to share accounts of positive experiences they have had with providers of consumer financial products and

services.

The suggestion that § 1022(c)(6)(A) requires the Bureau to finalize this policy as a legislative rule is unpersuasive. That provision mandates that the Bureau ‘‘prescribe rules regarding the confidential treatment of information’’ it obtains in exercising its authorities. The Bureau has previously prescribed rules regarding the


### 15575 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

13 Disclosure of Records and Information, 78 FR
11484 (Feb. 15, 2013).

14 2012 Notice of Final Policy Statement, 77 FR at 37560–61 (June 22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21220 (April 10, 2013).

15 12 U.S.C. 5534(a). 16 Two commenters point to American Petroleum

Institute v. SEC, 953 F. Supp. 2d 5 (D.D.C. 2013), in support of the argument that the Bureau lacks authority for the Database. In that case, the SEC contended that a statutory provision unambiguously required public disclosure of certain annual reports from regulated entities. The court held that the provision did not unambiguously require public disclosure and that the SEC had improperly cabined its discretion. Id.

at 12–18. The Bureau believes American Petroleum

Institute does not suggest the Bureau lacks authority to disclose consumer complaint narratives. That case addressed statutory provisions not at issue here. Moreover, the Bureau acknowledges its discretion with respect to the public disclosure described in the Policy Statement, and it does not believe that such disclosure is unambiguously required under the statute.

17 12 U.S.C. 5493(b)(3)(A).

18 12 U.S.C. 5534(a) & (b). 19 12 U.S.C. 5511.

20 12 U.S.C. 5512(c)(3)(B) (emphasis added).

21 12 CFR 1070.40 through 1070.47.

22 12 CFR 1070.41 (prohibiting Bureau employees from disclosing confidential information other than as provided in subpart D); 12 CFR 1070.2 (defining

‘‘confidential information’’ to include ‘‘confidential consumer complaint information’’). confidential treatment of information. 13 The disclosure contemplated by this policy is consistent with those rules, and therefore does not require an amendment to those rules. Finally, as noted previously, several commenters contend that the past practice of the Consumer Product Safety Commission, the general interest in transparency, or the importance of releasing consumer narratives require the Bureau to proceed via legislative rulemaking. None of these factors provides a legal basis for concluding that notice and comment rulemaking is required under the

Administrative Procedure Act. The

Bureau also notes that it has made the policy process transparent by voluntarily soliciting public comment and extending the comment period from 30 to 60 days.

B. Legal Authority for Consumer Complaint Database

In the Bureau’s previous notices of its policy statements establishing and expanding the Consumer Complaint
Database, the Bureau addressed in detail

several comments related to the Bureau’s authority to establish a

Database. 14 Several comments in response to the Proposed Policy Statement implicate the same or similar arguments concerning the Bureau’s legal authority. The Bureau directs readers to and incorporates its prior discussions, and clarifies portions here.

As was true with respect to the Bureau’s prior two policy statements,

commenters contend that the DoddFrank Act expressly delineates the

circumstances and manner in which the Bureau may collect, resolve, and share consumer complaints with others, and that a public-facing database is not explicitly included. Therefore, by adverse inference, they assert that the

Dodd-Frank Act does not authorize the

Database.

Similarly, as was true with respect to the Bureau’s prior policy statements, commenters argue that § 1034 of the Dodd-Frank Act, which requires the

Bureau to establish ‘‘reasonable procedures to provide a timely response to consumers . . . to complaints against, or inquiries concerning, a covered person,’’ 15 does not authorize the creation of a public-facing complaint database that, instead of aiding complainants, enables data mining and

market research. Commenters also make arguments, similar to past comments, that § 1021 and § 1022 do not expressly grant authority for the Bureau to establish a public-facing database or disclose consumer complaint narratives to the public. 16 They also contend that

the Dodd-Frank Act’s restrictions on publishing confidential information block the implementation of such a database, including narratives.

The Bureau has considered these

comments and concluded that theDatabase is authorized by the DoddFrank Act. Among other things,
§ 1013(b)(3) authorizes the

establishment of a unit ‘‘whose functions shall include establishing a single, toll-free telephone number, a Web site, and a database or utilizing an existing database to facilitate the centralized collection of, monitoring of, and response to consumer complaints regarding consumer financial products

or services.’’ 17 Section 1034(a) directs

the Bureau to establish ‘‘reasonable procedures to provide a timely response to consumers, in writing where appropriate, to complaints against, or inquiries concerning, a covered person . . .,’’ and § 1034(b) provides that ‘‘[a] covered person subject to supervision and primary enforcement by the Bureau pursuant to section 1025 shall provide a timely response, in writing where appropriate, to the Bureau, the prudential regulators, and any other agency having jurisdiction over such covered person concerning a consumer complaint or inquiry. . . .’’ 18 These provisions require and establish conditions for specific methods of disclosure and responses, but do not express or imply any limit on the Bureau’s authority to disclose consumer complaint information in other ways.

The Database as described would facilitate and supplement, not contravene, these provisions. The Database is reasonably encompassed
within the Bureau’s authorities, especially in light of the Bureau’s other statutory objectives and functions, including promoting financial education, providing timely information, and ensuring that markets operate transparently. 19 In addition, with prescribed limitations, the Bureau has broad discretionary authority to release information obtained during the exercise of its statutory functions and
the Database, as described in the Proposed Policy Statement, would not contravene any legal constraints on the

Bureau.

Publication of such information would also be authorized by the Bureau’s express authority pursuant to
§ 1022 to make certain information, including information from consumer complaints, public: Section
1022(c)(3)(B) states that the Bureau ‘‘may make public such information obtained by the Bureau under this section as is in the public interest, through aggregated reports or other appropriate formats designed to protect

confidential information in accordance with paragraphs (4), (6), (8), and (9).’’ 20 This subparagraph permits the Bureau to disclose consumer complaint information in a non-aggregated format as long as the format is designed to protect confidential information in accordance with other specific provisions of § 1022(c). The Database would satisfy those criteria.

The disclosure of information contemplated by this policy is also consistent with subpart D of the

Bureau’s Final Rule on the Disclosure of
Records and Information, 21 which the Bureau promulgated pursuant to
§ 1022(c)(6). Commenters are correct to point out that subpart D generally restricts the authority of the Bureau to publicly disclose ‘‘confidential information,’’ including ‘‘confidential consumer complaint information.’’ 22 However, such disclosure restrictions only apply to the extent that consumer complaint information is confidential in nature. The Bureau’s regulations define ‘‘confidential consumer complaint

information’’ to mean ‘‘information received or generated by the [Bureau], pursuant to [sections 1013 and 1034 of the Dodd-Frank Act], that comprises or documents consumer complaints or inquiries concerning financial

institutions or consumer financial products and services and responses
thereto, to the extent that such information is exempt from disclosure


### 15576 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

23 12 CFR 1070.2(g). 24 2012 Notice of Final Policy Statement, 77 FR at 37561 (June 22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21221 (April 10, 2013). 25 2012 Notice of Final Policy Statement, 77 FR at 37562 (June 22, 2012). pursuant to 5 U.S.C. 552(b)
[FOIA].’’ 23 Because the information to be disclosed in the public database is disclosed with the consumer’s express consent and not exempt from disclosure
under FOIA, such information does not

constitute ‘‘confidential consumer complaint information.’’ Accordingly, § 1022(c)(6)(A)’s grant of authority to issue rules regarding when the Bureau will treat information confidentially

does not limit the Bureau’s discretion to

disclose information consistent with those rules, but provides further authority for the policy.

Furthermore, the Bureau intends to

obtain consent from consumers to publish their complaint narratives. Obtaining written consent for disclosure aligns with requirements of 1022(c)(8), FOIA, the Privacy Act, and the Bureau’s confidentiality rules. The Bureau does

not intend to release a narrative until the consumer expressly consents to publication and the Bureau has

determined that the narrative has been de-identified according to a robust scrubbing standard.

C. The Impact of the Disclosure of Consumer Complaint Narratives on

Consumers

Comments from consumer groups, open government groups, privacy groups, and individual commenters asserted that the publication of narratives would empower consumers

to better understand the context of the data currently provided in the Consumer Complaint Database. The Reporters Committee for Freedom of the Press, on behalf of nine major news organizations and press trade associations, supported the publication of all narratives regardless of consent, stating that the Database is an invaluable resource for journalists as the experiences reflected in the narratives contribute to the public’s understanding of the relationships between consumers

and financial institutions and inform the ongoing democratic debate regarding financial regulation. Consumer groups

added that consumer narratives would

be a valuable resource for researchers to identify trends in the business practices of companies, particularly as they relate to traditionally underserved consumers.

Some commenters noted that narratives would encourage companies

to address the sources of common complaints. Consumer groups stated that the publication of narratives would allow companies to better compete through customer service, further increasing the improvement in customer care resulting from the introduction of the Database. Other consumer groups

commented that narratives would aid consumer advocacy and legal aid groups in serving their communities by helping to identify local trends.

Industry commenters, by contrast, asserted that the publication of

narratives in the Database would
mislead consumers because the data is,
in the commenters’ words, unverified and unrepresentative. And despite the

fact that the Bureau confirms the existence of a commercial relationship before publishing complaints, multiple commenters expressed concern that complaints, and thus narratives, from

individuals without a commercial relationship with the relevant company would appear in the Database.

In general, the Bureau believes that greater transparency of information does tend to improve customer service and identify patterns in the treatment of consumers, leading to stronger compliance mechanisms and customer

service. These have been features of the Consumer Complaint Database since its inception. In addition, disclosure of consumer narratives will provide companies with greater insight into issues and challenges occurring across their markets, which can supplement their own company-specific perspectives and lend more insight into appropriate practices. Other issues raised in the comments received by the

Bureau are addressed below.

1. Consumer Narratives

a. Verification

In its 2012 Notice of Final Policy
Statement, the Bureau addressed several

comments related to the disclosure of unverified consumer complaints. In response to the Proposed Policy
Statement, several trade associations and companies continued to express concern, stating that unverified complaint narratives are likely to

mislead consumers. Some trade associations suggested that the Bureau should only disclose narratives after a substantive investigation by the Bureau had been completed on that particular complaint. Some industry comments recommended distinguishing between unverified and verified complaints. Consumer groups and privacy groups,
on the other hand, commented that the lack of verification presented minimal risk of misleading consumers.

The Bureau incorporates its previous statements and analysis on this issue. 24 The Bureau acknowledges that the Complaint System does not adjudicate the merits of each individual complaint disclosed in the Consumer Complaint Database, specifically stating on the

Bureau’s Web site that it does not ‘‘verify the accuracy of all facts alleged in complaints.’’ However, the Bureau does screen each complaint according to various criteria. The complaint is

reviewed to determine whether it should be routed to another regulator. A

determination is made whether each submission is a complaint, an inquiry,

or feedback. Submissions in the latter two categories are not forwarded to the identified company for handling as complaints. Importantly, the commercial relationship between the company and the consumer is verified before disclosing it in the Database. The Bureau also verifies that the complaint is submitted by the identified consumer or by his or her specifically authorized representative before disclosure in the Database. Lastly, complaints are only forwarded to companies when they contain the required fields, including the complaint narrative, the consumer’s requested resolution, and the

consumer’s contact information. The

Bureau believes that with the information currently made public, supplemented by the contextual
richness of the de-identified narratives, the public and the marketplace will have the capacity to assess all the data with the appropriate level of

confidence.

b. Manipulation

Several trade associations and companies commented that third parties like debt negotiation companies could use complaint submission as a strategic tool to unfairly aid their clients. A company commenter claimed that at least one outside party has been using the company’s name unlawfully to
defraud consumers, and that several complaints have been mistakenly lodged against the company as a result. Specifically, a third party was contacting consumers under the name of the other company to collect money and defraud consumers, and subsequently, several consumers lodged complaints against the other company.

The Complaint System has a number of protections against manipulation. These protections were addressed in the 2012 Notice of Final Policy Statement. 25 For example, while the process of submitting a complaint is designed to be user-friendly and straightforward, it does require deliberate action and a moderate time commitment by the consumer. According to the Bureau’s


### 15577 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

26 Disclosure of Consumer Complaint Narrative Data, 79 FR at 42768 (July 23, 2014). own calculations, the average amount of time required to complete a complaint submission via the Web site is eight

minutes. Consumers must also affirm to the government that the information they provide is true to the best of their knowledge and belief. Again, the commercial relationship between the consumer and company is confirmed by the company before any complaint data is disclosed in the Consumer Complaint Database. With regard to the example provided regarding fraudulent use of a company’s identity: (1) Companies have the ability to alert the Bureau via an administrative response of any suspected fraud; (2) if properly identified by the company, such complaints do not appear in the Database; (3) if the Bureau finds any pattern of fraud by any entity within its jurisdiction, the Bureau can bring appropriate enforcement actions; and (4) in sending such complaints to the company, the Bureau is assisting company operations in quickly identifying and addressing instances of potential fraud.

c. Misidentification

Several trade associations and companies commented that consumers’

confusion about consumer financial products and services would lead to mistaken identification of the company against which the complaint is lodged. For example, one company commented that a consumer is likely to lodge a complaint against a credit reporting agency, when the consumer’s complaint should be against the data furnisher.

Trade associations and other commenters suggested the inclusion of company relationships. For example, one consumer group recommended including the parent company when that company has multiple subsidiaries against which complaints are lodged.

As previously noted, companies have the ability to notify the Bureau if no commercial relationship exists between the consumer and the company; such complaints are not suitable for disclosure in the Consumer Complaint Database. Regarding the credit reporting example that was provided, the Bureau empowers the consumer to elect whom to submit a complaint against (dependent, as noted, on an existing commercial relationship). Specific to the suggestion regarding inter- and intra-company relationships, the Bureau is exploring expansion of the Database to include additional company relationship information.

d. Positive Feedback

Several trade associations and companies commented that the Consumer Complaint Database should include positive narratives about companies in conjunction with complaint narratives. One commenter suggested that if the Database is to function as a marketplace of ideas, then

it should reflect the entire market and not solely consumers submitting complaints. Several trade associations

stated that if the Database is to be likened to private web-based review sites, then positive feedback is

necessary.

Consistent with these comments, the

Bureau believes that the Bureau should share data that provides an unbiased perspective on company behavior toward consumers. At present, the Bureau already collects and shares some elements of positive feedback regarding company complaint handling. For example, the Consumer Complaint Database currently discloses

information that can be used to highlight positive company behavior,

e.g., companies with timely responses or low consumer dispute rates. However, the Bureau intends to further explore ways in which positive company behavior may be highlighted. Concurrent with the Final Policy Statement, the Bureau is publishing a Request for Information to solicit and collect input from the public on the potential collection, identification, and sharing of data and feedback specific to positive interactions with providers of consumer financial products and

services.

e. Language Access

Several consumer groups commended the accessibility of the Bureau’s contact
center, with translation available in over 180 languages. These groups requested

that the Bureau make the online complaint submission form available in multiple languages.

In addition to telephone support for non-English speaking consumers, the Bureau plans over time to make its online complaint intake form on consumerfinance.gov available in Spanish, and subsequently to explore making the form available in other languages as well. The Bureau is committed to providing persons with limited English proficiency meaningful access to its programs and services.

f. Third Party Submissions and Referrals

Several trade associations and companies raised concerns that narratives from third parties without authority to make a complaint on behalf

of a consumer nevertheless would be published, and companies would be compelled to respond publicly. The Conference of State Bank Supervisors requested clarification on whether narratives within complaints referred from other government agencies would

be disclosed.

This Final Policy Statement does not apply to complaints submitted by any third parties or via agency referral, and

the Bureau does not intend to disclose

such narratives at this time. The Complaint System affords companies the opportunity to alert the Bureau if they are unable to verify the commercial relationship with the consumer who submitted the complaint before the complaint is disclosed in the Consumer Complaint Database.

2. Company Responses

In its Proposed Policy Statement, the

Bureau stated that:

Where the consumer provides consent to publish their narrative, the related company will be given the opportunity to submit a narrative response for inclusion in the Consumer Complaint Database. The company will be instructed not to provide direct identifying information in its public-facing response, and the Bureau will take reasonable steps to remove personal information from the response to minimize
(but not eliminate) the risk of reidentification. The Company Portal will include a data field into which companies have the option to provide narrative text that would appear next to a consumer’s narrative in the Consumer Complaint Database. 26

The Bureau received comments from companies and trade associations arguing that, because of business and legal considerations, they would be limited in their ability to provide meaningful public-facing unstructured narrative responses and that such responses would be impracticable or unhelpful. In response, the Bureau intends to adopt an alternative approach based on structured company responses,

as discussed below.

a. Quality of Company Responses

Trade associations and companies both questioned the fairness of publicly disclosing consumer narratives because they argued that, under the Bureau’s proposal, companies would be limited in their ability to provide public-facing unstructured narrative responses. Several companies, trade associations and individual commenters expressed concern that their ability to provide meaningful public-facing unstructured narrative responses would be limited by laws such as the Gramm-Leach-Bliley Act and Regulation P, the Fair Credit Reporting Act and Regulation V, and the

Fair Debt Collection Practices Act. Commenters argued that, under the


### 15578 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

Bureau’s proposal to permit voluntary narrative company responses, theymight not be able to provide any publicfacing response at all due to legal, business, and reputational

considerations. These commenters argued that frank responses may be viewed negatively by the public and companies would be discouraged from attempting to articulate individualized responses. They argued that, in practice, voluntary public-facing company responses would not provide the balance suggested in the Proposed Policy Statement. Some commenters suggested various ways the Bureau could mitigate these concerns, including providing specific interpretive guidance. Consumer groups stated that making consumer narratives and company responses public would allow

for consumers to make individual determinations regarding the quality of the company’s service.

Responsive to company and trade
association feedback, the Bureau acknowledges that unstructured company narratives may not effectively provide companies with a mechanism to

balance a consumer’s narrative.
Therefore, the Bureau intends to provide companies with a finite list of optional structured responses from which they can choose. Within the secure web portal companies use to respond to complaints, the Bureau intends to add a set list of company responses, giving companies the ability to recommend a public-facing response addressing the substance of the consumer’s complaint. Companies will be under no obligation to avail themselves of this opportunity. The Bureau plans to adopt company recommendations as a general matter,

but it reserves discretion to assess whether there are good-faith bases for
the recommendations. In addition, the Bureau plans to assess its review process over time. The Bureau plans for this functionality to apply to all consumer complaints disclosed via the Consumer Complaint Database (and not only those with consumer consent to
disclose the associated narrative).

Although this approach was not specifically proposed by commenters,

the Bureau believes that it should eliminate or significantly mitigate the concerns, raised by companies, arising from the risk of public disclosure of protected confidential information. Companies that voluntarily decide to provide a public-facing response will not be put in a position of assessing

what level of detail will address a complaint while protecting confidential

information. The Bureau believes companies will be more likely to recommend public-facing structured responses than they would be to provide unstructured public-facing responses, and that the reputational risks of recommending structured responses

will be lower. The Bureau also believes that this approach will lead to more standardized information that may

facilitate the Bureau’s other functions and goals with respect to the Consumer Complaint System, such as monitoring and reporting on complaints.

Companies are ultimately responsible for ensuring their compliance with all legal requirements. The Bureau believesthat its approach of making publicfacing structured responses voluntary allows companies sufficient flexibility to assess legal, business, reputational,

and other considerations relevant to thedecision of whether to provide publicfacing responses. Finally, whileproviding an opportunity for publicfacing structured company responses offers significant benefits, the Bureau notes that the benefits of publicly disclosing unstructured consumer complaint narrative data, as explained in this Final Policy Statement, justify
such disclosures, even absent an opportunity for public-facing company

responses.

b. Public and Private Company Responses

The Bureau solicited feedback on whether any potentially public-facing company response should be distinct and in addition to the response companies currently send directly to the consumer. Several companies and trade

associations commented that it should be distinct as the public response will have to be adapted to conform to applicable privacy laws. Several consumer groups and one company, on
the other hand, commented that the same response, but in redacted form, should be publicly displayed in order to provide the public with the necessary context to interpret the data. Some trade

associations commented that it would be operationally burdensome to create

two separate responses.

The Bureau plans to ensure that companies have the option to provide both a private (to-consumer) response and recommended public-facing
structured (to be shared via the Database) response to a consumer’s complaint. One of the principal benefits for consumers of the Bureau’s complaint handling services is the requirement that companies respond to the consumer

and the Bureau remains committed to keeping the focus on assisting consumers with their complaints. Based

on data available in the Consumer Complaint Database, approximately 62% of complaints are ‘‘closed with explanation’’ and the majority of those (75%) are not disputed by the

consumer. The Bureau is concerned that mandating that the to-consumer company responses be made publiccould have a chilling effect on wellreceived, detailed responses to consumers, potentially leading to higher consumer dispute rates. Based on comments received by companies on this issue, this concern would appear to be well founded. Allowing the company the choice to provide one very detailed private communication to its consumer, as well as a separate public-facing response, would address the Bureau’s, companies’ and consumers’ interests on

this issue.

c. Response Time

Currently, companies have 15 days to provide an initial response to a consumer complaint. Several trade associations and companies commented that the response time should be

extended in order to accommodate the drafting of a separate, public-facing response. Some comments recommended extending the initial response time to as many as 60 days.

The Bureau believes that the marginal

increase in burden associated with voluntarily recommending a separate structured public response does not

necessitate a deviation from the current complaint handling requirements, which themselves are designed to provide the complaining consumer with a timely response.

d. Timing of Narrative and Response Posting

Trade associations, consumer groups, and individual commenters supported the simultaneous posting of the consumer narrative and company response. One consumer group recommended posting the consumer narrative after 15 days, and posting the company’s public response as it

becomes available. Several commenters recommended 45 days; one company recommended 60 days. One commenter recommended publication after 35 days, to align generally with timing provided under the Fair Credit Reporting Act for consumer reporting agencies to reinvestigate and respond to consumer disputes.

There are at least three timing options regarding the disclosure of the consumer narrative and company response: (1) Disclose the consumer narrative and company response (if available) when the company provides an initial response, but no later than 15 days after the complaint is routed to the company (the system currently in place


### 15579 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

27 2012 Notice of Final Policy Statement, 77 FR at 37564 (June 22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21222 (April 10, 2013). 28 ‘‘Our Mission’’ http:// www.consumerfinance.gov/strategic-plan/. for non-narrative complaint data), (2)

disclose the consumer narrative and company response (if available) 15 days after the complaint is routed to the company, or (3) disclose the consumer narrative when the company provides its public-facing response, but no later than 60 days after the complaint is routed to the company. Under all three options, the complaint’s structured closure responses would continue to follow the current disclosure timing (option number 1) and the consumer narrative would only be disclosed once it is scrubbed of personal information. However, only option three guarantees that a public-facing company response, to the extent one is provided within the 60-day period, would be disclosed contemporaneously with the consumer

narrative.

After careful consideration, therefore, the Bureau intends to adopt option number three. Option number one could force the company to choose between its desire to respond to and close complaints quickly versus its desire to provide an appropriate public facing response. Option number two may

result in instances in which the company legitimately needs additional time, has appropriately communicated to the Bureau an ‘‘in progress’’ response (allowing for up to 60 days to respond), and yet the consumer narrative is made public on day 15 and possibly without an accompanying company response. Option three carries a similar risk to option number one, potentially creating the incentive for companies to delay providing an optional public-facing response for the full 60-day allowance (and thus delaying disclosure of the consumer narrative). However, erring on the side of fairness to companies by ensuring contemporaneous release, the Bureau plans to implement option three.

3. Maintaining the Complaint Database

a. Updates to Published Narratives

Several consumer groups commented

that consumers should be allowed to update narratives to inform the public of the status of the complaint. Some trade

associations asked that consumers be provided the ability to remove their narratives if they are satisfied with the complaint resolution.

Once given, at any point in the process, consumers will have the ability to withdraw their consent regarding publication of their narrative in the Consumer Complaint Database. At such

time the consumer’s narrative will be
removed from the Database. However, data already downloaded by the public cannot be recalled by the Bureau. Based on the Bureau’s experience to date reviewing consumer complaints, company responses, and ensuing
resolutions, the Bureau believes that no additional back-and-forth functionality is necessary at this time.

b. Removal of Old Narratives

Several trade associations and one company commented that complaints

and narratives should be removed from the database after a given step in the process or given amount of time, e.g., quarterly.

The Bureau believes that consumers and the marketplace are capable of independently assessing the value of complaints based in part on when those complaints were submitted and therefore has no plans to remove complaints from the Consumer Complaint Database based on their age

or status.

c. Normalization

Several trade associations and companies commented that the

unstructured narrative data should be accompanied by information providing context to the company’s profile, including how many transactions the company conducts per year, how many complaints are received, and how many complaints are satisfactorily resolved.

The Bureau notes the general agreement by commenters that normalization would improve the quality of the data in the Consumer Complaint Database. As discussed in the Bureau’s notices of its previous policy
statements, data normalization is a complicated issue, and one that the Bureau is continuing to explore. 27 The

Bureau also notes that market participants, news organizations, and consumer groups can and have created

normalized results.

d. Protected Group Information

Several consumer groups requested the inclusion of protected group information, such as sex, ethnicity, race, age, disability, marital status, or national origin, on complaint

submissions. These comments noted that it would be helpful to have this information to identify trends in companies’ business practices.

The Bureau agrees that the collection and public disclosure of protected group data has the potential to increase the quality of the dataset made available via the Consumer Complaint Database. However, there remain many open questions that the Bureau must first explore before moving forward on this suggestion, including the appropriateness of collecting protected group data, its representativeness, and the potential challenges with disclosing protected group data given the Bureau’s sensitivity to re-identification risk.

Furthermore, as discussed elsewhere, the Bureau’s Database scrubbing standard would remove demographic information such as gender, age, and race, and ethnicity provided by

consumers in the text of their narratives.

D. Consumer Consent to Disclose

Narratives

1. Opt-in Consumer Consent

Trade associations, consumer groups, and individual commenters supported the proposed opt-in feature requiring a

consumer’s consent in order for narratives to be eligible for publication. A trade association representing news organizations asserted its view that narratives are subject to disclosure under FOIA regardless of consumer consent. Based on this viewpoint, it urged that at most the Bureau should permit consumers to opt-out ofpublication as opposed to having to optin. Commenters also generally agreed

that consumers should maintain the right to revoke their consent at any time.

A central tenet of the Bureau’s work is to empower consumers; providing them with the option to opt-in (as opposed to requiring them to opt-out) and the right to withdraw their consent to publication of their narrative in the Consumer Complaint Database at any

time advances that end. 28 With respect to the comment about the application of
the FOIA to narratives, the Chief FOIA Officer is authorized to grant or deny any request for a record of the CFPB, in accordance with the requirements of the FOIA and the Bureau’s regulations. 12

CFR 1070.15. If the Bureau receives FOIA requests for records that are not published in the Consumer Complaint Database pursuant to this Final Policy
Statement, the Chief FOIA Officer will determine whether to grant the request, or to deny it due to the applicability of FOIA exemptions.

2. Placement and Design of Consent

Some commenters discussed the appearance of the opt-in form.Consumer groups requested that the optin be presented to the consumer early in the complaint process so that consumers can consider the implications as they draft their complaints. One company recommended providing the option to opt-in only once the consumer has received a response and has had the


### 15580 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

29 The Bureau emphasizes that the consent procedure described in the text for authorizing public disclosure of narratives may not be adequate to satisfy consent requirements under other statutes and regulations that the Bureau administers or

enforces. 30 Disclosure of Consumer Complaint Narrative Data, 79 FR at 42769 (July 23, 2014). opportunity to consider the implications of publication. Some consumer groups recommended that, to encourage publication, the opt-in option be displayed prominently on the consent form. Additionally, some commenters requested that consumers have a distinct field on the form in which they can specify what personal information they want excluded from their narrative.

The Bureau plans to place the opt-in consent at the submission phase of the complaint. The Bureau believes the

decision whether or not to consent is most appropriate at the actual time of complaint submission. This decision is consistent with the practice of the Consumer Product Safety Commission,

which also obtains consent to disclose complaint narratives in its public-facing

database.

3. Elements of Informed Consent

Some commenters recommended including disclaimers with the opt-in feature that notify consumers of what the commenters perceived to be a risk of defamatory speech. Some trade associations and companies commented

that the Bureau should inform

consumers of the risks of narrative publication, including the possibility of

re-identification. Trade associations and companies generally commented that

the consumer should be notified of the company response procedure and risks of consenting to publication. One press group commented that the consumer

should be notified that his or her narrative is subject (in the commenter’s
view) to FOIA disclosure. One consumer group commented that

consumers should be notified that consenting to publication may provide

additional assistance to other consumers facing similar issues. The Bureau agrees that when a consumer is making the decision whether or not to opt-in, it is

essential that the consumer have the information to weigh appropriately the risks of consenting to the disclosure of their de-identified narrative against individual and public benefits of doing so. In support of that goal, in addition to the consent language, the Bureau intends to provide clear, easily understandable material describing the scrubbing standard, methodology, and publication process, the remaining riskto privacy, and the possibility of reidentification. The Bureau is committed to continuously improving these materials over time to empower the consumer to make the most appropriate

choice for his or her individual needs

and circumstances.

However, consumers do not waive any privacy interests they may have in the information merely by submitting it

to the Bureau. 29

E. Personal Information Scrubbing Standard and Methodology

1. Scrubbing Standard and Methodology

The Bureau requested feedback on the standard and methodology it intends to utilize for scrubbing personal

information in the narratives. This scrubbing standard would be applied comprehensively to all data shared via the Consumer Complaint Database. Consumer groups offered comments supporting the proposed use of modified Health Insurance Portability and Accountability Act (‘‘HIPAA’’) standards for scrubbing narratives. Some companies expressed concern that significant identifiers associated with major life events may remain, notwithstanding the scrubbing process. One company commented that scrubbing should be applied to all identifying information, including references to third parties. Another company noted the differences between
health data and unstructured narratives, expressing concern that a HIPAA-based methodology would not be effective and that the Bureau has not provided sufficient detail on the scrubbing mechanism to be used. One privacy organization recommended that the Bureau scrub company responses.

The Bureau’s Database scrubbing

standard is modeled after the HIPAA Safe Harbor Method, which is generally considered to represent a best practice for de-identifying data. In addition to adopting most of the specific HIPAA identifiers, the Bureau also plans to remove: (1) Demographic information such as gender, age, race, and ethnicity; (2) appropriate analogues to HIPAA

identifiers in the consumer financial
domain, e.g., credit card numbers; and
(3) identifiers which the Bureau knows appear in complaints and could reasonably be used to identify
individuals, e.g., references to third parties other than the company that is the subject of the complaint. The scrubbing methodology contemplates a computer-based automated step and a quality assurance step or steps performed by human reviewers.

2. ZIP Codes

The Bureau requested feedback on whether to disclose 5-digit ZIP codes alongside redacted narratives. 30 By and large the responses that were received supported two options. The majority of commenters suggested the Bureau disclose 5-digit ZIP codes, except where population in the ZIP code contains fewer than 10,000 people. The second most cited option recommended disclosing full 5-digit ZIP codes, regardless of population. On the other extreme, one commenter suggested that

ZIP codes should be excluded altogether, with state or county being used as the geographic identifier.

While the Bureau acknowledges the unique value of detailed geographic data, it is also acutely aware of the heightened risk 5-digit ZIP codes can create for re-identification. Accordingly, the Bureau plans to disclose 5-digit ZIP codes, except where the population in
the ZIP code contains fewer than 20,000 people. In such cases, the Bureau plans to disclose the 3-digit ZIP code, except where the 3-digit ZIP code population contains fewer than 20,000 people, in

which case the Bureau does not intend to disclose any ZIP code data. While this approach represents a different approach than those suggested by most
commenters, the Bureau believes that this option appropriately balances the utility of geographic data with the

associated risk to individual consumer privacy. As with all elements of its scrubbing standard, the Bureau intends to make adjustments in the future guided by the goal of simultaneously maximizing data utility and individual privacy.

3. Re-identification

Several trade associations and companies commented that despite the proposed scrubbing methodology, anunacceptably high risk of reidentification will remain. Some

commented that in areas with small populations, even scrubbed narratives

could lead to re-identification based on other details not covered by HIPAA standards. One company also

commented that the risk of narrative content being repeated through socialmedia raises the possibility of reidentification by individuals familiar

with the consumer. Consumer and privacy groups commented that the risk
of re-identification is minimal, and offset by the benefits of the policy and rigor of the scrubbing standard.

As the Bureau stated in the Proposed Policy Statement, sharing data containing any personal information presents a tension between data utility and individual privacy. As a particular


### 15581 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

31 2012 Notice of Final Policy Statement, 77 FR at 37562 (June 22, 2012). personal information scrubbing standard becomes more or less stringent, the utility of a given de-identified dataset may become respectively less or more useful. The publication of narratives involves risks, including thepotential harm associated with the reidentification of actual consumers within the Consumer Complaint

Database. The Bureau believes that it is appropriate to publish only those narratives for which opt-in informed
consumer consent has been obtained, that have also been subjected to scrubbing under a robust personal information scrubbing standard and methodology.

F. Impact of Narrative Publication on Companies and the Marketplace

1. Reputational Harm

Trade associations commented that the public disclosure of unverified narratives would result in reputational harm to companies. Some comments argued that any perceived benefit to consumers through narrative publication would be outweighed by the reputational harm suffered by companies.

The Bureau takes seriously company

and trade association concerns that

financial institutions could incur intangible reputational damage as a

result of the disclosure of narratives. As stated in previous policy statements, to a large extent, this risk is inherent in any release of complaint data. In deciding to release the structured complaint data, the Bureau considered
this concern and concluded that, while there is always a risk that market participants will draw erroneous
conclusions from available data, the marketplace of ideas would on the

whole be able to determine what the data show and their relative importance. The Bureau believes this to be equally true with respect to narratives, and that consumer narrative publication will in fact make it easier for the marketplace to evaluate the rest of the complaint data by providing more information and
context. Likewise, the Bureau also believes that the option for companies to provide public-facing structured responses will enhance the effectiveness of the Database and provide an opportunity for companies to enhance their reputation and mitigate potential

concerns.

Consistent with these comments, the

Bureau believes that the Database should include data that provides an unbiased perspective on company

behavior toward consumers. Accordingly, in parallel to the finalization of the instant Final Policy Statement, the Bureau intends to further explore ways in which positive company behavior may be highlighted. Concurrent with the Final Policy Statement, the Bureau is publishing a Request for Information to solicit and collect input from the public on the potential collection, identification, and sharing of data and feedback specific to positive interactions with providers of consumer financial products and

services.

2. Effect on Consumer Relations

Several companies, trade associations, and a public interest organization commented that publicly posting

narratives could create disincentives for consumers to deal directly with companies to resolve their disputes. Some commenters requested that narratives only be posted after the consumer has directly contacted the company. A few trade associations commented that narrative publication would cause general harm to customer relations by making the process more

adversarial.

The data collected from the Bureau’s credit card intake form and survey work shows that the vast majority of consumers have already attempted,
often several times, to resolve the complained-about issue with the company before seeking assistance from the Bureau. As previously stated, a

central element of the Bureau’s mission is to empower consumers; the Bureau believes that requiring consumers to contact the company before engaging the Bureau would work against that goal. Such an additional procedural hurdle may also discourage some number of consumers from submitting complaints, which would have the effect of depriving the Bureau of the information underlying the complaint.

This could serve to undermine Bureau functions that rely, at least in part, on complaint data to inform their respective activities.

Similarly the Bureau is skeptical of concerns that disclosing narratives

would create disincentives for consumers to deal directly with the company and would cause general harm to customer relations by making the process more adversarial. Feedback the Bureau has received suggests the

introduction of the Consumer Complaint Database and the Bureau’s activities generally have caused greater investment by companies in their customer service operations, which includes company complaint handling. The Bureau views this development as a positive step for customer service at companies that are making such

investments. 3. The Appearance of Validating Complaints by the Act of Disclosing

Them

Several trade associations, companies,

and individual commenters stated that by including unverified comments on a government Web site, the narratives will be portrayed as being validated by the

Bureau.

Similar concerns were previously raised and addressed by the Bureau in the 2012 Notice of Final Policy

Statement. 31 The Bureau acknowledged the possibility that some consumers may (or may be led to) draw erroneous
conclusions from the data. That is true, however, for any market data. In recognition of this risk the Bureau provides the following disclaimer on the Consumer Complaint Database: ‘‘We don’t verify all the facts alleged in these complaints but we take steps to confirm a commercial relationship between the consumer and company. Complaints are listed here after the company responds or after they have had the complaint for 15 calendar days, whichever comes first. We remove complaints if they don’t meet all of the publication criteria. Data is refreshed nightly.’’ The Bureau

believes this disclaimer to be sufficient to address the risk identified by

commenters.

As discussed elsewhere, it is noteworthy that several other government agencies make consumer complaint narratives available, including the Consumer Product Safety Commission, the National Highway Transportation Safety Administration, and, pursuant to FOIA requests, the

Federal Trade Commission.

4. Consumer Confusion and Lack of

Context

Several trade associations commented

that unstructured narrative data provides minimal benefit to consumers as required scrubbing would remove any useful information from the narrative and responses. Some trade

association comments added that the

Bureau’s resources would be better utilized by providing more context for data already provided in the Database. Some consumer groups requested better organization of the data provided in the

Database.

As noted previously, sharing data containing personal information presents a tension between data utility and individual privacy. The Bureau
believes, based on the comments

received from various consumer and privacy groups, that it is possible to

strike a balance between these two


### 15582 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

important interests and still disclose a dataset that provides significant benefit to the marketplace. The Bureau will continually monitor this balance for opportunities to adjust its personal information scrubbing standard, which

the Bureau intends to describe on its
Web site. Furthermore, the Bureau is

committed to the continuous improvement of the Consumer Complaint Database, which includes the addition of increasing levels of context, organization, and data normalization.

5. Increased Litigation

A few companies and trade

associations commented that the publication of narratives would lead to increased litigation, either through potentially ‘‘defamatory’’ narratives posted by consumers or as a result of

additional information available to prospective plaintiffs. One company expressed the concern that complaints

and narratives could be sources of information appropriately left to be obtained during the discovery process.

One trade association also commented that the privacy risks of published

narratives could increase the risk of legal liability and heighten litigation costs. One legal aid organization commented that the availability of complaint narratives would help consumer advocacy groups to identify

local trends of unlawful behavior and target legal efforts more effectively.

The Bureau believes the risk of increased litigation following the

disclosure of narratives to be low. The closest analogs to the Bureau’s plan for

narrative disclosure are the ConsumerProduct Safety Commission’s publicfacing complaint database and the

Federal Trade Commission’s disclosures pursuant to FOIA requests; the Bureau is not aware of any information that

those disclosures have increased litigation against companies. Ultimately, the Bureau believes there is significant value in making available Bureau complaint data to help in the identification of and calling attention to potentially unlawful behavior.

6. Increased Company Costs

Several trade associations and companies commented that the additional procedure of creating a second, public-facing response, and ensuring its compliance with potentially applicable laws, would increase operational costs for companies. Some of these commenters also emphasized

the increased costs to the Bureau resulting from additional infrastructure necessary to publish narratives. One public interest group also highlighted the financial burden of producing additional responses to narratives.

As noted above, and in light of the
comments received, the Bureau intends to provide companies with a finite list of optional structured responses that

will allow them to recommend to the Bureau an optional public response to

address the substance of consumers’ complaints. The Bureau believes that this approach significantly decreases the operational costs of providing independent public-facing responses, as compared to the Bureau’s proposal of providing separate narrative responses. Still, the Bureau acknowledges that additional effort and expense may be borne by companies in connection with preparing public-facing responses to

consumer narratives. The Bureau has weighed these factors, in addition to the

increased burdens on the Bureau’s own complaint handling operation. The

Bureau considers it a matter of fairness to provide companies with the opportunity to address publicly consumer complaints from the company’s perspective. It is important to recognize that no company will be required to recommend a public-facing response, and it is entirely up to the company whether it wants to take advantage of this forum. The Bureau

does not believe that the additional burden a company may bear in taking advantage of this opportunity, particularly given the Bureau’s movement to structured responses and away from unstructured narrative company responses, outweighs the benefit of publicly disclosing narratives to consumers and the marketplace.

7. Confidentiality Agreements

One individual commented that the public posting of consumer narratives would create an incentive for companiesto require consumers to sign nondisclosure agreements when creating an

account. This commenter recounted an experience in which he submitted a complaint to the Bureau and when settling the matter with the company, the company asked him to sign a confidentiality agreement.

The Bureau’s experience to date has not uncovered widespread company use of non-disclosure agreements in

connection with the Consumer Complaint Database, and no company comments on the proposed Policy have indicated that companies intend to utilize non-disclosure agreements as gag orders in the way envisioned by this

comment. The Bureau’s market monitoring will remain alert to developments along these lines. However, the Bureau would likely look disfavorably upon agreements that require a consumer to withdraw his or

her consent to have a narrative published as a condition of settlement.

IV. Implementing the Final Policy

Statement

Following publication of the Final Policy Statement, the Bureau will turn to implementation of the policy. The Bureau intends to modify its Web site and online complaint intake form to collect informed opt-in consumer consent. In conjunction with the
collection of consumer consent, the Bureau intends to finalize and post on its Web site the Consumer Complaint Database scrubbing standard. The Bureau will also modify the company web portal to add functionality to allow companies to provide the recommended public-facing responses, reach out to companies on the company web portal to offer training and provide technical support related to the policy. The

Bureau will finalize its automated and manual review processes and then begin scrubbing narratives.

The Bureau will not disclose any

scrubbed and consented-to narratives until sufficient time has elapsed to allow the Bureau to adequately complete and assess the above actions.

V. Final Policy Statement

The Bureau hears directly from the American public about their experiences with the nation’s consumer financial marketplace. An important

element of the Bureau’s mission is the handling of individual consumer complaints regarding consumer financial products and services.

In June 2012, the Bureau began making de-identified individual-levelcomplaint data available via its webbased, public-facing database (the ‘‘Consumer Complaint Database’’). Since launch, the Consumer Complaint Database has been expanded to include additional consumer financial products and data fields as products have been added to its complaint handling system. Consistent with its strategic vision, the

Bureau is committed to the continued growth and refinement of the Consumer Complaint Database in a manner that helps inform consumers and the marketplace while still protecting privacy and incorporating appropriate security controls.

A. Consumer Narratives

The Bureau plans to provide consumers who submit their complaints directly to the Bureau the opportunity to

share their individual stories with other consumers and the marketplace by including consumer complaint narratives in the Consumer Complaint


### 15583 Federal Register / Vol. 80, No. 56 / Tuesday, March 24, 2015 / Notices

32 45 CFR 164.514. Database where consent for publication

is first obtained from the consumer. Only those narratives for which opt-in

consumer consent is obtained and a robust personal information scrubbing standard and methodology is applied will be eligible for disclosure.

B. Consumer Consent To Disclose

Narratives

The Bureau intends to disclose only

narratives for which informed consent

has been obtained and that have been scrubbed for personal information. To
obtain informed consumer consent, the Bureau plans to give consumers who submit a complaint the opportunity to
check a consent box, with accompanying language that will state, among other things, and in plain language, that: (1) Whether or not consent is given will not otherwise impact how the Bureau handles the complaint; (2) if given, the consumer may thereafter inform the Bureau that the consumer withdraws consent at any

time and the narrative will be removed from the Consumer Complaint Database;
and (3) the Bureau will take reasonable steps to remove personal informationfrom the complaint to address risk of reidentification.

C. Personal Information Scrubbing Standard and Methodology

Sharing data containing personal information presents a tension between data utility and individual privacy. As a particular personal information scrubbing standard becomes more orless stringent, the utility of a given deidentified dataset may become respectively less or more useful.

Within its judgment and discretion,

and in order to address the risk of reidentification, the Bureau intends to apply to all publicly-disclosed narratives a robust personal information scrubbing standard and methodology. In designing its scrubbing standard, the Bureau relied heavily on guidance by the Department of Health and Human Services regarding de-identification of
health data, as outlined in the Health Insurance Portability and Accountability Act (‘‘HIPAA’’) Privacy

Rule. 32 The Bureau’s current scrubbing

standard is modeled after the HIPAA Safe Harbor Method, which is generally considered to represent a best practice for de-identifying data. In addition to adopting (and removing) most of the specific HIPAA identifiers, the Bureau also plans to remove: (1) Demographic information such as gender, age, race, and ethnicity; (2) appropriate analogues

to HIPAA identifiers in the consumer financial domain, e.g., credit card
numbers; and (3) identifiers which the Bureau knows appear in complaints and could reasonably be used to identify
individuals, e.g., personal information pertaining to third parties other than the company that is the subject of the complaint. All consumer complaint data shared via the Consumer Complaint Database will be subject to this standard and methodology, including, e.g., ZIP code. The Bureau plans to make this scrubbing standard available on the Bureau’s Web site. The scrubbingmethodology contemplates a computerbased automated step and a quality assurance step or steps performed by

human reviewers.

D. Company Response

The Bureau plans to give companies the opportunity to respond publicly to

the substance of the consumer complaints they receive from the Bureau. Within the secure web portal companies use to respond to complaints, the Bureau intends to add a set list of structured company response options; a responding company will be given an opportunity to recommend to the Bureau which option, if any, it would like included as a public-facing response to address the substance of the consumer’s complaint. Companies will be under no obligation to avail themselves of this opportunity.

E. Continuous Improvement

The Bureau plans to implement a testing and continuous improvement process to ensure that as applied, the Bureau’s standard and methodology for scrubbing personal information adequately protects consumers. The Bureau intends to continue to adjust its scrubbing standard and methodology, guided by the goal of simultaneously maximizing data utility and individual privacy.

VI. Effect of Policy Statement

This Policy Statement is intended to provide information regarding the Bureau’s plans to exercise its discretion to publicly disclose certain data derived from consumer complaints. The Policy Statement does not impose any legal obligations on third parties, nor does it create or confer any substantive or procedural rights on third parties that could be enforceable in any administrative or civil proceeding.

Dated: March 12, 2015.

Richard Cordray,

Director, Bureau of Consumer Financial

Protection.

[FR Doc. 2015–06722 Filed 3–23–15; 8:45 am]

**BILLING CODE 4810–AM–P BUREAU OF CONSUMER FINANCIAL** 

**PROTECTION**

**[Docket No. CFPB–2015–0013]**

**Request for Information Regarding the Consumer Complaint Database** 

**AGENCY :**  Consumer Financial Protection

Bureau.

**ACTION :**  Notice and request for

information.

**SUMMARY :**  The Bureau of Consumer
Financial Protection (the ‘‘Bureau’’) is issuing a Notice and Request for
Information (‘‘RFI’’) to solicit and collect input from the public on the potential collection and sharing of consumer compliments about providers of consumer financial products and

services and more information about a company’s complaint handling.

**DATES :**  Submit comments on or before
May 26, 2015.

**ADDRESSES :**  You may submit responsive
information and other comments, identified by Docket No. CFPB–2015– 0013, by any of the following methods:

• Electronic: http:// www.regulations.gov. Follow the instructions for submitting comments.

• Mail: Monica Jackson, Office of the Executive Secretary, Consumer Financial Protection Bureau, 1700 G Street NW., Washington, DC 20552.

• Hand Delivery/Courier: Monica Jackson, Office of the Executive Secretary, Consumer Financial

Protection Bureau, 1275 First Street NE., Washington, DC 20002.

Instructions: The Bureau encourages the early submission of comments. All

submissions must include the document title and docket number. Because paper mail in the Washington, DC area and at the Bureau is subject to delay, commenters are encouraged to submit comments electronically. In general, all comments received will be posted without change to http:// www.regulations.gov. In addition, comments will be available for public inspection and copying at 1275 First Street NE., Washington, DC 20002, on official business days between the hours of 10 a.m. and 5 p.m. Eastern Time. You can make an appointment to inspect the documents by telephoning (202) 435–

7275.

All submissions, including attachments and other supporting materials, will become part of the public record and subject to public disclosure. Sensitive personal information, such as account numbers or Social Security
numbers, should not be included.

Submissions will not be edited to remove any identifying or contact

information.