I 
113TH CONGRESS 
2D SESSION 
H. R. 4604 
To amend the Consumer Financial Protection Act of 2010 to create a con-
sumer opt-out list for data collected by the Bureau, to put time limits 
on data held by the Bureau, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 7, 2014 
Mr. WESTMORELAND (for himself, Mr. DUFFY, Mrs. BACHMANN, Mr. LONG, 
Mr. POSEY, Mr. BENTIVOLIO, and Mr. LUETKEMEYER) introduced the 
following bill; which was referred to the Committee on Financial Services 
A BILL 
To amend the Consumer Financial Protection Act of 2010 
to create a consumer opt-out list for data collected by 
the Bureau, to put time limits on data held by the 
Bureau, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘CFPB Data Collection 
Security Act’’. 
VerDate Mar 15 2010 
21:56 May 14, 2014
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4604.IH
H4604
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(I) IN
GENERAL.—This sub-
paragraph shall not apply with respect 
to consumer complaints. 
‘‘(II) USE OF DATA.—Personally 
identifiable information contained in a 
consumer complaint with respect to a 
consumer that is listed on the opt-out 
list may not be used for any purpose 
other than the consumer complaint, 
including supervisory functions or 
market monitoring. 
‘‘(11) TIMING LIMITATION ON DATA HELD BY 
THE BUREAU.—The Bureau shall delete or otherwise 
destroy— 
‘‘(A) any information related to a con-
sumer complaint regarding consumer financial 
products or services, not later than the end of 
the 60-day period following the completion of 
any review into such complaint where no fur-
ther action will be taken; 
‘‘(B) any reports issued by, or data col-
lected while conducting an examination of, any 
covered person, depository institution, or credit 
union over which the Bureau has supervisory 
authority, after three examinations, except for 
VerDate Mar 15 2010 
21:56 May 14, 2014
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4604.IH
H4604
TKELLEY on DSK3SPTVN1PROD with BILLS
enforcement actions that specifically address 
payments to consumers; and 
‘‘(C) any information collected by the Bu-
reau about a particular consumer or other per-
son not described under subparagraph (A) or 
(B), not later than the 60-day period following 
the date on which the Bureau collected such in-
formation. 
‘‘(12) REQUIREMENT
IN
EVENT
OF
PRIVACY 
BREACH.—If the Bureau experiences a data breach 
that exposes personally identifiable information 
about a consumer, the Bureau shall provide such 
consumer with one year of free credit monitoring 
and publicly notify consumers of the breach on the 
front page of the Bureau’s website. 
‘‘(13) REQUIREMENT FOR SENATE-CONFIRMED 
DIRECTOR.—Notwithstanding any other provision of 
law, the Bureau may not collect any data or perform 
any market monitoring unless the Bureau has a 
Senate-confirmed Director.’’. 
SEC. 3. PERSONNEL REQUIREMENT. 
Section 1013(a) of the Consumer Financial Protec-
tion Act of 2010 (12 U.S.C. 5493(a)) is amended by add-
ing at the end the following: 
VerDate Mar 15 2010 
21:56 May 14, 2014
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4604.IH
H4604
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(6) CONFIDENTIAL SECURITY CLEARANCE RE-
QUIRED FOR CERTAIN EMPLOYEES.—No employee of 
the Bureau may access personally identifiable infor-
mation collected by the Bureau unless such employee 
holds a ‘confidential’ security clearance.’’. 
Æ 
VerDate Mar 15 2010 
21:56 May 14, 2014
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H4604.IH
H4604
TKELLEY on DSK3SPTVN1PROD with BILLS