Consumer Financial Protection Bureau: Some Privacy and Security Procedures for Data Collections Should Continue Being Enhanced
Released: 2014-09-22T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: Congress created CFPB in 2010 as an independent agency to regulate the provision of consumer financial products and services, such as mortgages and student loans. CFPB has begun collecting consumer financial data from banks, credit unions, payday lenders, and other institutions. GAO was mandated to examine CFPB's collection of consumer financial data. This report addresses (1) the scope, purposes, uses, and authorities of CFPB consumer financial data collections and (2) CFPB's compliance with laws and federal requirements, including government-wide privacy and information security requirements.

GAO reviewed laws, regulations, and contracts pertaining to CFPB's data collections; reviewed privacy and information security policies; reviewed inspector general reports on CFPB's information security program; assessed how CFPB applied NIST's framework for managing risks of storing data; examined access controls on the system maintaining consumer financial data; and interviewed CFPB and other regulatory officials, privacy experts, and representatives from randomly selected financial institutions.

section_title: What GAO Found
paragraphs: To carry out its statutory responsibilities, the Consumer Financial Protection Bureau (CFPB) has collected consumer financial data on credit card accounts, mortgage loans, and other products through one-time or ongoing collections. As the following table shows, these large-scale data collections varied from about 11,000 consumer arbitration case records from a trade association to 173 million mortgage loans from a data aggregator. Of the 12 large-scale collections GAO reviewed, 3 included information that identified individual consumers, but CFPB staff indicated that those 3 were not subject to statutory restrictions on collecting such information. Other regulators, such as the Board of Governors of the Federal Reserve System (Federal Reserve) and the Office of the Comptroller of the Currency (OCC), collect similarly large amounts of data.

CFPB has taken steps to protect and secure these data collections. For example, it created a data intake process that brings together staff with relevant expertise to consider the statutory, privacy, and information security implications of proposed consumer financial data collections. CFPB staff described a process for anonymizing large-scale data collections that directly identify individuals. In addition, CFPB had taken steps to implement an information security program that is consistent with Federal Information Security Management Act requirements, according to the Office of Inspector General for the Federal Reserve and CFPB. GAO found that CFPB had implemented logical access controls for the information system that maintains the consumer financial data collections and was appropriately scanning for problems or vulnerabilities. CFPB also established a risk-management process for the information system that maintains consumer financial data consistent with guidelines developed by the National Institute of Standards and Technology (NIST).

However, GAO determined that additional efforts are needed in several areas to reduce the risk of improper collection, use, or release of consumer financial data.

Written procedures and documentation: CFPB lacks written procedures and comprehensive documentation for a number of processes, including data intake and information security risk assessments. The lack of written procedures could result in inconsistent application of the established practices. For example, CFPB unnecessarily retained sensitive data in two collections GAO reviewed, but its staff said they plan to remove this information. GAO recommends CFPB establish or enhance written procedures for (1) data intake, including reviews of proposed data collections for compliance with applicable legal requirements and restrictions; (2) anonymizing data; (3) assessing and managing privacy risks; and (4) monitoring and auditing privacy controls; and (5) documenting results of information security risk-assessments consistently and comprehensively.

Implementation of privacy and security steps: CFPB has not yet fully implemented a number of privacy control steps and information security practices, which could hamper the agency's ability to identify and monitor privacy risks and protect consumer financial data. GAO recommends CFPB take or complete action to (1) develop a comprehensive written privacy plan that brings together existing privacy policies and guidance; (2) obtain periodic independent reviews of its privacy practices; (3) develop and implement targeted privacy training for staff responsible for working with sensitive personal information; (4) update remedial action plans to include all identified weaknesses and realistic planned remediation dates that reflect priorities and resources; and (5) include an evaluation of compliance with contract provisions relating to information security in CFPB's review of the service provider that processes consumer financial data on its behalf.

Paperwork Reduction Act compliance: Under the Paperwork Reduction Act (PRA), agencies generally must obtain Office of Management and Budget (OMB) approval when collecting data from 10 or more entities to minimize burden and maximize the practical utility of the information collected. CFPB and OCC collect, on an ongoing basis, credit card data from different institutions—representing about 87 percent of outstanding credit card balances—and agreed to share data. However, OMB staff said the agencies' collections and data-sharing agreement may warrant OMB review and approval. Additional consultation with OMB regarding these collections and the data-sharing agreement would help both agencies ensure they are fully complying with the law. Furthermore, OCC had not obtained OMB approval for its credit card and mortgage data collections, which each included more than nine entities. Without approval, OCC lacks reasonable assurance that its collections comply with PRA requirements intended to reduce burden. GAO recommends (1) CFPB consult further with OMB about its credit card collection and data-sharing agreement, and (2) OCC seek OMB approval for its credit card and mortgage data collections.

a CFPB has access to credit card data from additional credit card issuers through an information-sharing agreement with the Office of the Comptroller of the Currency, which collects more than 500 million total accounts on a monthly basis. When combined, these data contain information about 87 percent of outstanding credit card balances by volume as of March 2014.

b CFPB removed information that directly identifies individuals from the files staff use to analyze these data.

section_title: What GAO Recommends
paragraphs: GAO makes 11 recommendations to enhance CFPB's privacy and information security and 1 recommendation to OCC to ensure its data collections comply with appropriate disclosure requirements. CFPB and OCC agreed with GAO's recommendations and noted steps they plan to take or have taken to address them.

section_title: Letter
paragraphs: The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd- Frank Act) created the Bureau of Consumer Financial Protection—also  known as the Consumer Financial Protection Bureau (CFPB)—to regulate  the offering and provision of consumer financial products or services  under the federal consumer financial laws. According to the act, CFPB’s  mission is to implement and enforce federal consumer financial law  consistently to ensure that markets for consumer financial services and  products are fair, transparent, and competitive, among other things. The  act directs CFPB to carry out its mission by, among other things,  collecting, researching, monitoring, and publishing information relevant to  the functioning of markets for consumer financial products and services to  identify risks to consumers and the proper functioning of such markets.  Prior to and during the 2007-2009 financial crisis, we and others noted  that the lack of data on consumer financial products and services  hindered federal oversight in areas such as mortgages and fair lending.

Since its creation, CFPB has undertaken activities including conducting  examinations of financial institutions and taking enforcement actions  against various entities. The independent agency also has issued reports  on consumer financial issues (credit card markets, student loans, and  consumer credit reports) as required by the Dodd-Frank Act.issued numerous rules required by the act.

To carry out these activities, CFPB has begun collecting consumer  financial data—information on individual consumers’ financial activity at  the account, loan, or transaction level—including information on credit  card accounts, credit reporting agency records, and mortgage loans.   However, some industry participants and members of Congress have  raised questions about the nature and scope of CFPB’s data collections,  including whether the collections comply with statutory restrictions on  CFPB’s ability to collect personally identifiable financial information.also questioned whether the agency has taken sufficient steps to ensure  that these data will not be subject to unauthorized disclosure.

We were asked to review CFPB’s collection of consumer financial data.  Subsequently, the Consolidated Appropriations Act of 2014 mandated us  to study similar issues.financial data collection efforts, including the scope, purposes, uses, and  authorities for these collections, and the extent to which CFPB has  collaborated with other federal financial regulators as part of these  collections; (2) the extent to which CFPB complied with statutory  restrictions on its consumer financial data collection authorities and  federal privacy requirements; and (3) the extent to which CFPB has  assessed the risks of these collections and applied appropriate  information security protections over these data.

We focused our analysis of CFPB’s data collections, studies, and examination materials  on consumer financial data collections that occurred since January 2012, as CFPB had  limited data collections before that time. We reviewed the inclusion of information that  directly identifies individuals in the large scale consumer financial data collections of OCC,  FDIC, and the Federal Reserve. We did not assess the privacy or information security  controls of these collections for this report.

Housing Finance Agency (FHFA), Federal Trade Commission (FTC), and  Securities and Exchange Commission (SEC). We also reviewed reports  and interviewed staff from organizations that analyzed privacy issues,  monitored consumer financial topics, and serve as industry associations  for financial institutions.

To examine data collection restrictions and requirements and privacy  protections for consumer financial data maintained by CFPB, we  compared CFPB’s practices against statutory requirements and guidance  from the Office of Management and Budget (OMB) and the National  Institute of Standards and Technology (NIST). We reviewed CFPB  privacy policies and procedures, and interviewed CFPB’s Chief  Information Officer, Chief Privacy Officer, and other staff about their  privacy-related policies, practices, and controls implemented. We  discussed CFPB’s consumer financial data collections with OMB staff  who review federal data collections and compliance with statutory  requirements. We also spoke with consumer and privacy advocacy  groups about their views on CFPB’s consumer financial data collections  and with an academic expert about the extent to which data collections  containing personal information can be de-anonymized. We took steps to  ensure the accuracy of key information used in this report, including  interviewing agency officials, obtaining original source documents, and  physically observing database contents on-site when necessary, and  determined that the information was sufficiently reliable for our purposes.

To examine the extent to which CFPB had assessed the risks of these  collections and applied appropriate information security protections, we  reviewed CFPB’s security policies and procedures for systems that store  consumer financial data and compared them with applicable NIST  guidance and CFPB’s own security standards. We interviewed CFPB’s  Chief Information Officer, Chief Information Security Officer, and other  staff about their information security policies, practices, and controls. We  also reviewed the logical access controls for the hardware and systems environment CFPB uses to store and analyze consumer financial data.See appendix I for more information about our scope and methodology.

We conducted this performance audit from August 2013 to August 2014  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The Dodd-Frank Act transferred consumer protection oversight and other  authorities over certain consumer financial protection laws from multiple  federal regulators to CFPB, creating a single federal entity to, among  other things, ensure consistent enforcement of federal consumer financial  laws. The Dodd-Frank Act charged CFPB with the following  responsibilities, among others: ensuring that consumers are provided with timely and understandable  information to make responsible decisions about financial  transactions; ensuring that consumers are protected from unfair, deceptive, or  abusive acts and practices, and from discrimination; monitoring compliance with federal consumer financial law and taking  appropriate enforcement action to address violations; identifying and addressing outdated, unnecessary, or unduly  burdensome regulations; ensuring that federal consumer financial law is enforced consistently,  without regard to the status of a person as a depository institution, in  order to promote fair competition; ensuring that markets for consumer financial products and services  operate transparently and efficiently to facilitate access and  innovation; and conducting financial education programs.

Furthermore, the Dodd-Frank Act gave CFPB supervisory authority over  certain nondepository institutions, including certain kinds of mortgage  market participants, private student lenders, and payday loan lenders.Such institutions generally lacked federal oversight before the financial  crisis of 2007-2009.
subsections: section_title: CFPB’s Data Collection Authorities and Restrictions under the Dodd-Frank Act
paragraphs: The Dodd-Frank Act grants CFPB certain authorities that govern its  collection of consumer financial data. The act also includes certain  restrictions on CFPB’s collection and use of personally identifiable  financial information and requirements to ensure that CFPB protects such  data. The primary authorities and related restrictions we examined are  included in three sections of the act:

Market monitoring. Under section 1022(c), CFPB is directed to  monitor for risks to consumers in the offering or provision of consumer  financial products or services, including developments in consumer  financial markets for such products or services, in order to support its  rulemaking and other functions. The act provides CFPB with the  authority, in conducting such monitoring, to gather information from  time to time regarding the organization, business conduct, markets,  and activities of covered persons and service providers, from a variety  of sources, including several sources specified in the act. Under this  data collection authority, CFPB is prohibited from obtaining records  from covered persons and service providers participating in consumer  financial services markets for the purposes of gathering or analyzing  the personally identifiable financial information of consumers.

Supervision of nondepository covered persons. Section 1024  provides CFPB with the authority to supervise entities (other than  depository institutions or insured credit unions) that provide certain  consumer financial products or services. This authority also extends  to service providers.these entities comply with federal consumer financial laws and  obtaining information about their activities and compliance systems or  procedures, this section charges CFPB with requiring reports and  conducting examinations of the nondepository persons the section  covers for purposes of detecting and assessing associated risks to  consumers and markets for consumer financial products and   In addition to assessing the extent to which  services.CFPB’s ability to collect personally identifiable financial information.

Section 1024 does not contain any explicit restrictions on

Supervision of large institutions and affiliates. Section 1025 of the  Dodd-Frank Act provides CFPB with supervisory authority over  insured depository institutions and credit unions with assets of more  than $10 billion and their affiliates, including the authority to collect  information from them for purposes of detecting and assessing  associated risks to consumers and to markets for consumer financial  products and services. CFPB also has some supervisory authority  under section 1025 over service providers of insured depository  institutions and credit unions with over $10 billion in assets, as well as  service providers to a substantial number of insured depository  institutions or credit unions with $10 billion or less in assets. Section  1025 does not contain any explicit restrictions on CFPB’s ability to  collect personally identifiable financial information.

The Dodd-Frank Act also contains additional restrictions on CFPB’s ability  to collect consumer financial data and includes requirements on how such  data must be protected once they are collected. The act requires CFPB to  take steps to ensure that certain information, including personal  information, is not disclosed to the public when such information is  protected by law. In addition, CFPB must not obtain personally  identifiable financial information about consumers from the financial  records of covered persons or service providers, unless consumers  provide written permission, or other legal provisions specifically permit or  require such collections.

section_title: The Role of the Federal Prudential Regulators
paragraphs: CFPB interacts with other financial regulators that also collect consumer  financial data and have responsibility for overseeing federal consumer  financial laws. These agencies include the four prudential regulators that  supervise depository institutions for safety and soundness of their  financial condition:

OCC charters and supervises national banks and federal thrifts;  the Federal Reserve supervises state-chartered banks that opt to be  members of the Federal Reserve System, bank holding companies,  thrift holding companies, the nondepository institution subsidiaries of  those institutions, and nonbanks designated as significantly important  by the Financial Stability Oversight Council;

FDIC supervises FDIC-insured state-chartered banks that are not  members of the Federal Reserve System and federally insured state  savings banks and thrifts; insures the deposits of all banks and thrifts  approved for federal deposit insurance; and resolves by sale or  liquidation all failed insured banks and thrifts and certain nonbank  financial companies; and

NCUA charters and supervises federally chartered credit unions and  insures savings in federally and most state-chartered credit unions.

As part of their overall supervision programs, the prudential regulators  have consumer compliance examination authority for insured depository  institutions with $10 billion or less in assets and CFPB is required to  coordinate its supervisory activities with the supervisory activities of the  prudential regulators for insured depository institutions with more than  $10 billion in assets. Most of the depository institutions CFPB  supervises for consumer protection are supervised for safety and  soundness by OCC, the Federal Reserve, or FDIC and at a holding  company level by the Federal Reserve. The Dodd-Frank Act requires  CFPB to coordinate its supervisory actions and examinations of large  depository institutions with the prudential regulators.

section_title: Other Requirements and Standards Related to Federal Data Collection Efforts
paragraphs: Various other federal requirements apply to CFPB and other federal  agencies’ data collection activities. The Paperwork Reduction Act (PRA)  requires agencies to obtain OMB approval for identical collections of  information from 10 or more individuals or entities. For data collections  meeting the criteria of the act, agencies must seek public comment in the  Federal Register and consult with the public and affected agencies on  ways to minimize the burden associated with information collections and  other issues. The general purposes of PRA include minimizing the federal  paperwork burden for individuals, small businesses, state and local  governments, and other persons; minimizing the cost to the federal  government of collecting, maintaining, using, and disseminating  information; and maximizing the usefulness of information collected by  the federal government. The Office of Information and Regulatory Affairs  within OMB provides oversight over federal data collections and PRA  compliance.

Privacy Act of 1974, Pub. L. No. 93-579, 88 Stat. 1896 (1974) (codified as amended at 5  U.S.C. § 552a); E-Government Act of 2002, Pub. L. No. 107-347, 116 Stat. 2899 (2002). safeguards to ensure the security and confidentiality of records and to  protect against any anticipated threats or hazards to their security or  integrity that could result in substantial harm, embarrassment,  inconvenience, or unfairness to any individual on whom information is  maintained. The Privacy Act also requires agencies to notify the public in  the Federal Register when they establish or make changes to a system of  records. Among the things this notice must identify are: the categories of  data collected; the categories of individuals about whom information is  collected; the intended “routine” uses of data; and procedures that  individuals can use to review and correct information about them.

The privacy provisions of the E-Government Act of 2002 require that  agencies conduct privacy impact assessments before developing, using,  or contracting for an information security system that contains personal  information. These assessments are analyses of how personal  information is collected, stored, shared, and managed in a federal  system. According to OMB guidance, the purpose of such assessments is  to (1) ensure handling conforms to applicable legal, regulatory, and policy  requirements regarding privacy; (2) determine the risks and effects of  collecting, maintaining, and disseminating information in identifiable form  in an electronic information system; and (3) examine and evaluate  protections and alternative processes for handling information to mitigate  potential privacy risks.

Title III of the E-Government Act, known as the Federal Information  Security Management Act of 2002 (FISMA), established a framework  designed to ensure the effectiveness of security controls of information  and information systems that support federal operations and assets. This  includes the information and information systems that are provided or  managed by another agency, contractor, or other source (known as third- party providers). FISMA assigns specific responsibilities to the head of an  agency to provide information security protections commensurate with the  risk and magnitude of the harm resulting from unauthorized access, use,  disclosure, disruption, modification, or destruction of information collected  or maintained by or on behalf of the agency.

FISMA also states that agencies are to develop, document, and  implement an agency-wide information security program. The information  security program should include periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life-cycle of each system, and (4) ensure compliance with applicable  requirements; subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems, as  appropriate; security awareness training to inform personnel of information security  risks and of their responsibilities in implementing agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually—including  testing of management, operational, and technical controls for every  system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency.

To assist agencies in meeting the requirements of FISMA, NIST was  tasked with developing standards and guidelines for agencies. NIST has  issued a series of special publications addressing privacy and security  concerns both at organizational and information system levels that federal  agencies generally follow.

Security and Privacy Controls: NIST Special Publication 800-53  gives agencies guidance on selecting and specifying security and  privacy controls to meet federal standards and requirements.  According to NIST, the guidance provides a holistic approach to  information security and risk management by providing organizations  with the breadth and depth of security controls necessary to  fundamentally strengthen their information systems and the  environments in which those systems operate. The guidance also  organizes privacy controls into eight areas: authority and purpose;  accountability, audit, and risk management; data quality and integrity;  data minimization and retention; individual participation and redress;  security; transparency; and use limitation. These controls are based  on the Fair Information Practice Principles, an internationally  recognized privacy framework.

Protecting Personal Information: NIST Special Publication 800-122  provides guidelines for agencies to use in developing a risk-based  approach for protecting personal information. NIST recommends  that agencies evaluate how easily information can be used to identify  specific individuals and evaluate the sensitivity of each individual data  field, as well as the sensitivity of the collective data fields.

Information Security Risk Management Framework: NIST Special  Publication 800-37 describes a security risk-management framework  for use by federal agencies and their contractors. This framework is  a six-step process that helps agencies integrate information security  and risk-management activities into the system development life- cycle.

section_title: CFPB’s Privacy and Information Security Program
paragraphs: When CFPB began operations in 2011, it relied on the information  security program and systems of the U.S. Department of the Treasury  (Treasury). As the agency has grown, CFPB has begun transferring its  information infrastructure (including e-mails, file shares, and data storage)  to an independent hardware and systems environment owned by CFPB,  but at the time of our review, some of CFPB’s data were still being  transmitted using Treasury systems and CFPB was still using Treasury to  manage its workstations.

CFPB created a Data Intake Group consisting of CFPB staff from across  the agency with expertise in legal, cybersecurity, and privacy issues.  CFPB staff told us the group was formed in spring 2013 and has evolved  into a standard business practice. The group regularly meets to discuss  proposed data collections and to help ensure the agency takes all steps  required under applicable law or guidance. CFPB staff said the group  provides a forum for staff in various parts of the agency to raise issues  relevant to their areas of expertise. For example, staff with legal expertise  are expected to ensure appropriate use of collection authorities and  compliance with any legal restrictions for a proposed data collection and  staff with PRA expertise ensure that the group considers whether PRA  might apply to the collection and whether to consult with OMB. The  group’s collective decision to proceed with a data collection is  summarized in an e-mail to the Chief Information Officer, who makes the  final determination about the proposed collection. CFPB staff who are  involved in coordinating the Data Intake Group have begun compiling  information about each approved data collection, although this effort is  still at an early stage.

section_title: CFPB Collects a Wide Range of Consumer Financial Data
paragraphs: From January 2012 to July 2014, CFPB undertook 12 large-scale data  collection efforts. These collections spanned products including  mortgages, student loans, and credit cards, and have been used for a  variety of purposes, such as informing rulemaking and statutorily required  studies. CFPB obtains data for five of these collections on an ongoing  basis; data for the other collections were obtained only once. The types of  information in each consumer financial data collection vary depending on  the product type and nature of the inquiry, and may include some  account-level data (such as account balance and amount of available  credit), transaction-level information (such as the timing of deposits or  withdrawals in checking accounts, or merchant names for some  transactions), or disclosures of product policies and terms. Some  collections represent a sample of accounts from one source while others  represent all data from selected institutions. The data come from a variety  of sources, including financial institutions, credit reporting agencies, data  aggregators, and industry groups. Table 1 provides more information on  these consumer financial data collections.

As noted in table 1, CFPB’s credit card and online payday collections  include data from account holders’ credit reports. For each of these  collections, CFPB requests that consumers’ account-level credit card or  loan information is matched with their credit reports from the credit  reporting agency. The credit reporting agency sends the combined data,  which does not identify individual consumers, to CFPB through the  commercial data aggregator. Aside from these two data collections,  CFPB staff told us that large-scale collections are not aggregated or  combined into larger databases.
subsections: section_title: CFPB Uses Its Supervisory Authorities to Collect Most Consumer Financial Data
paragraphs: CFPB staff told us that most of CFPB’s large-scale data collections were  conducted under its supervisory authorities. These authorities require  CFPB to periodically require reports and conduct examinations of entities  they oversee to assess compliance with federal consumer financial laws,  obtain information about those entities’ activities, and detect and assess  risks to consumers and markets for consumer financial products and  services. CFPB staff noted that financial institution representatives  generally requested that CFPB collect data under its supervisory authority  to provide the institutions with greater confidentiality and legal protections.  CFPB staff stated that data collected under CFPB’s supervisory  authorities are considered confidential and therefore not subject to  disclosure under certain federal information transparency requirements,  such as the Freedom of Information Act. CFPB has used its supervisory  authorities to collect certain data on credit cards, storefront payday loans,  deposit advance products, and overdraft fees. Information collected under  these authorities sometimes includes personally identifiable financial  information.

CFPB staff told us they need to collect and review consumer financial  data at the institution level to effectively carry out their supervisory  authorities. For example, they told us that they have used the data  obtained on credit cards to identify risks and areas to be reviewed during  examinations of financial institutions. According to CFPB staff, these  analyses can identify changes at a particular institution, such as an  increase in late fees charged or allow comparisons that identify  divergences in practices across institutions and help CFPB determine  where to allocate its supervisory resources.

CFPB staff also noted that certain large-scale data collections facilitate a  supervisory approach based on determining the relative risk consumer  financial products and services posed to consumers in the relevant  product and market. CFPB staff noted that this supervisory approach  differs from the approaches the prudential regulators have taken.  Moreover, CFPB legal staff said use of consumer financial data collected  under the agency’s supervisory authorities for certain additional purposes  is allowed under the Dodd-Frank Act. Specifically, CFPB legal staff noted  the act authorizes CFPB to use information gathered from various  sources, including “examination reports concerning covered persons or  service providers,” to conduct its market monitoring. They said they  interpret this provision as permitting them to use information gathered as  part of the supervisory process for other purposes, including market  monitoring. For example, CFPB staff told us they needed data on various  markets because within their first 18 months of operations they had to  issue numerous rules including those relating to electronic transfers of  consumers’ funds to recipients abroad (remittances), the characteristics  of mortgages that would qualify lenders for protection from borrower  lawsuits (qualified mortgage requirements), and prohibitions on incentives  to steer borrowers to particular mortgage loans. CFPB staff told us the  collections were necessary to help them understand the functioning of  those markets and consumers’ experience with them. CFPB also had to  obtain data on markets that were previously unregulated, such as payday  lending, credit reporting, and private student lending.

In addition to these large-scale collections, CFPB staff collect some  consumer financial data from individual entities through the examination  process, also under the agency’s supervisory authorities. CFPB staff told  us that collecting consumer financial data during examinations is key to  helping them carry out their mission to supervise markets. Such data  allow CFPB’s examiners to better understand the institution under review  and inform the decisions they make about what areas and activities to  include in the scope of examinations. Staff told us they collect information  throughout the supervisory examination process in order to assess risk to  consumers from particular financial institutions and to monitor markets.  For example, CFPB staff collect market and institution data from available  sources (for example, during a baseline review of an institution, from  commercial data vendors, or from their own research staff or other federal  regulators) before collecting an institution’s consumer account information  or internal documents relating to compliance management, such as  training materials and internal policies. They explained that CFPB  collected and analyzed data during the scoping phase to inform its  supervisory staff about an institution’s activities and identify the risks the  activities pose.

Our analysis suggests that the scope and extent of the consumer  financial data CFPB collected during individual examinations has varied.  For example:

We reviewed information request letters CFPB sent to a payday  lender, debt collector, and credit reporting agency. In one of these  letters, CFPB asked for detailed information about certain accounts,  such as all new accounts or all consumer disputes within a certain  review period. The data requests included account numbers,  consumer contact records, and consumer disputes and their  resolutions.

We reviewed 46 examinations CFPB completed in 2012 and 2013 for  10 depository institutions that previously had been subject to  prudential oversight by the Federal Reserve, OCC, or FDIC. Slightly  more than half (25 of 46) of the examinations included requests for  consumer financial data. During those examinations that included  requests for consumer financial data, examiners sought data for a  sample of accounts, such as accounts with deposit advance products.  In other cases, examiners sought access to all accounts or loan  applications, as with several mortgage or private student loan  application examinations. Some CFPB examiners sought consumer  financial data to verify the accuracy of mortgage loan data these  institutions had been reporting to prudential regulators, pursuant to the requirements of the Home Mortgage Disclosure Act (HMDA).

Representatives of the nine institutions we interviewed that had been  providing consumer financial data to CFPB and the other regulators told  us that CFPB’s examination-related requests were more extensive than  the data requests from their prudential regulators. According to CFPB  staff, some of the differences arise because CFPB needed to obtain more  comprehensive information on institutions that might not have been  subject to the same level of consumer protection oversight before  passage of the Dodd-Frank Act or were conducting activities that had  raised supervisory concerns. CFPB staff told us examiners generally  request financial institutions’ account- and transaction-level data to  conduct various analyses and test for compliance with relevant federal  consumer financial laws, and they instruct institutions to alert CFPB if  their prudential regulators already have collected the requested data, so  that they can coordinate efforts.

section_title: CFPB Also Has Used Its Market Monitoring Authority and Voluntary Requests to Collect Data
paragraphs: CFPB also has used its market monitoring authority, as well as voluntary  data submissions, to collect data. Under the Dodd-Frank Act, CFPB is  prohibited from obtaining information under its market monitoring  authority from covered persons and service providers participating in  consumer financial services markets for purposes of gathering or  analyzing the personally identifiable financial information of consumers,  and none of these collections appeared to include personally identifiable  financial information. Data collected under the CFPB’s market  monitoring authorities included automobile sales, consumer credit report  information, mortgage loan performance, and online payday loans. CFPB  purchased these collections from commercial data aggregators, and each  collection was obtained either monthly or quarterly (except for data on  online payday loans, a one-time purchase). Other financial regulators,  banks, and other financial market participants use many of these same  commercial databases (such as those covering credit report information  and mortgages).

CFPB staff also told us that several voluntary data collections have been  instrumental for three statutorily required reports on consumer financial  products and markets. For these reports, CFPB asked companies or  industry associations to provide information on consumer financial  products and services through voluntary, one-time collections. These  voluntary collections included information on arbitration case records,  consumer reports and credit reports, and private student loan data  (described in table 1). The private student loan data collection informed  CFPB’s analysis of the number of loan originations and their associated  interest rates and allowed CFPB to determine any trends in lending in the  private student loan market. CFPB found that the market for private  student loans had increased from 2003 to 2007 and lender underwriting  requirements loosened. Similarly, analysis of consumer credit report  data informed CFPB’s report comparing consumer and creditor- purchased credit scores.CFPB’s use of consumer financial data in its reports.

section_title: Prudential Regulators Collect Similarly Large Amounts of Consumer Financial Data
paragraphs: Like CFPB, the prudential regulators (FDIC, Federal Reserve, OCC, and  NCUA) collect consumer financial data associated with products offered  by the financial institutions they regulate. Staff from these regulators told  us that they undertake the collections as part of their supervisory  responsibilities to analyze markets that affect the institutions they  oversee. For example, FDIC, OCC, and the Federal Reserve all obtain  mortgage data, including loan origination dates, outstanding balances,  and payment status, from commercial data aggregators similar to the  aggregators CFPB has used. The Federal Reserve collects mortgage  application data submitted under HMDA on behalf of CFPB, OCC, FDIC,  NCUA, and the Department of Housing and Urban Development and  aggregates these data on behalf of the Federal Financial Institutions  Examination Council. Federal Reserve staff told us the Federal Reserve also purchases credit reporting data from credit reporting agencies.  Furthermore, the Federal Reserve and OCC have ongoing data  collections of credit card accounts that they obtain from financial  institutions they supervise (using the same commercial data aggregator  as CFPB). FDIC and NCUA staff told us FDIC and NCUA collect  consumer financial data in their roles as insurers for banks and credit   Table 2 provides information  unions through the resolution process.about OCC’s, FDIC’s, and the Federal Reserve’s consumer financial data  collections.

Generally, the large-scale data collections by the prudential regulators do  not contain information that directly identifies individuals. As noted in table  2, both the Federal Reserve and OCC collect address data as part of their  mortgage collections to match first-lien mortgages to home equity loans  and lines of credit on the same property, but do not identify individual  borrowers by name. Several of the regulators told us that they routinely  collect consumers’ personal information as part of their examinations of  supervised entities but do not retain the information after the examination  is completed. However, OCC told us that they generally only collect  anonymized data from banks during examinations.

The Federal Reserve, OCC, and FDIC staff told us that they use these  collections for research on consumer markets affecting the financial  institutions they supervise. For example, OCC began its credit card  collection in 2009 and it analyzes these data to better understand the  credit card market in which large national banks operate, determine the  current status of banks’ credit card portfolios, and develop examination  strategies. Like CFPB, OCC has contracted to have credit reporting  agency attributes (such as the account holders’ number of other  accounts, outstanding balances, and their payment status) appended to  the credit card account data supplied by banks. OCC uses the mortgage  data it collects to develop its quarterly public Mortgage Metrics report and  to further analyze trends in the mortgage marketplace. The Federal  Reserve relies on its credit card and mortgage data collections—part of  institutions’ broader data submissions—to support its assessments of the  capital adequacy of bank holding companies (stress testing) and to more  effectively supervise large banks. Staff told us the Federal Reserve  Bank of New York collects data on consumer credit reports to review  anonymized consumers’ credit behavior over time and they have  published several reports on these data. Federal Reserve staff and  other researchers have used data from the Survey of Consumer Finances  to issue numerous reports on trends in household wealth changes in the  U.S. FDIC staff told us they use the mortgage data the agency  purchases to conduct market and aggregate-level research and analysis.

section_title: Other Federal Regulators Collect Consumer Data According to their Missions
paragraphs: We also examined the data collections of four other federal agencies with  consumer protection responsibilities and found their collections generally  were less extensive than CFPB’s data collections. For example, SEC,  which regulates the securities industry, and CFTC, which regulates the  derivatives markets, collect only limited consumer financial data related to  their roles in overseeing their respective industries. SEC staff told us the  agency’s mission generally does not necessitate large collections of  consumer financial data, but that staff obtain some consumer financial  data as part of their efforts to oversee the entities the agency regulates  and to enforce the federal securities laws. CFTC staff similarly told us  their agency is not required to undertake any large consumer financial  data collections, but does obtain limited amounts of such information  when reviewing traders and auditing futures market participants.

FTC, which is responsible for ensuring that consumers are protected from  unfair or deceptive acts or practices, collects consumer complaint data to  detect patterns of fraud and abuse. FTC compiles the data into a  nonpublic database that is shared with other law enforcement agencies.  Apart from this database, FTC staff told us that they review the  complaints and other investigative information and generally do not  compile other consumer information databases to detect fraud and  deception. Staff from another agency that addresses consumer issues,  the Consumer Product Safety Commission, also told us that their agency  is not mandated to make any consumer data collections, but that they are  required to maintain a public database containing complaints about  consumer products that helps them promote the safety of consumer  products. This agency also collects information relating to the causes and  prevention of death, injury, and illness associated with consumer  products.

section_title: CFPB and Other Regulators Have Established Information- Sharing Agreements, but Some Overlap Exists
subsections: section_title: CFPB’s Information-Sharing Agreements and Coordination
paragraphs: To minimize overlap and burden on financial institutions, CFPB has  coordinated with the prudential regulators and shared consumer financial  data through various formal agreements. The Dodd-Frank Act mandates  that CFPB coordinate with the prudential regulators on its supervisory  examinations of large banks and credit unions. CFPB supervisory staff  told us that they interpret this mandate to include the sharing of  information (which may include consumer financial data) collected during  the examination process. As a result, CFPB has established a  supervisory examination coordination framework that includes an  overarching memorandum of understanding (MOU) on supervisory  coordination with all the other prudential regulators for the sharing of  supervisory information on an ongoing basis.

12 U.S.C. § 5581 (transferring certain consumer financial protection functions to CFPB).  The Federal Reserve and Treasury had an MOU related to sharing information during the  establishment of CFPB; CFPB staff told us that they are working on developing a separate  information-sharing agreement with the Federal Reserve. NCUA, in addition to its  information-sharing agreement with CFPB, also has an MOU for sharing consumer  complaints with CFPB. In addition, CFPB has nine MOUs with seven separate federal  agencies, including the U.S. Department of Justice and the U.S. Department of Housing  and Urban Development. In some cases, the MOUs set up information-sharing  arrangements and discuss coordination on efforts such as enforcement activities. We  reviewed 26 MOUs CFPB has established with various state attorneys general, state  banking regulators, two cities, and one American Indian tribe and found that they generally  discussed information sharing and confidentiality and only one included a data-sharing  arrangement for CFPB to receive consumer financial data from a state regulatory agency.  We also reviewed three MOUs CFPB established with three private companies that allow  CFPB to receive consumer financial data related to the manufactured housing loans  industry and the payday lending industry. have an information-sharing agreement related to the sharing of large- scale collections of consumer financial data.

CFPB has two information-sharing agreements relating to large-scale  data collections—one current collection and one collection that was in  development at the time of our review. In 2013, CFPB entered into an  agreement with OCC covering any sharing of information from their  respective credit card collections. As a result of this agreement, CFPB  accesses account-level data from the 16 institutions from which OCC  collects data in addition to the 9 institutions from which CFPB collects  data. In total, the collections cover approximately 87 percent of  outstanding credit card balances by volume. The agreement establishes  ownership of the data and how OCC and CFPB will coordinate on the  collection of credit card data, including which data fields to collect, what  validation checks should be done to verify the data, the timing of the  collections, and how the agencies should communicate.

CFPB also established an interagency agreement with FHFA related to  the development of the National Mortgage Database, which staff told us  will provide a comprehensive view of the mortgage market and allow for  greater mortgage market monitoring, supervision, and research.  FHFA  has reported that it is developing the database partly to facilitate  mandatory reporting requirements under the Housing and Economic  Recovery Act of 2008.provide any nonpublic data to the database, and FHFA and CFPB staff  said that neither agency will directly collect the primary information for the  database. Rather, staff said the agencies will purchase the data from a  credit reporting agency. The credit reporting agency will provide an  anonymized 5 percent sample—which will include about 3.5 million  currently active mortgages—of first-lien, single-family mortgage loans   CFPB staff told us that they do not plan to  active as of 1998 or later that are reported to the credit reporting agency,  as well as credit report information on the borrowers in the selected  sample. FHFA staff told us they approached CFPB to collaborate on the  database because they felt that CFPB would be interested in the  mortgage data and they did not want to duplicate efforts. CFPB has been  funding half of the costs associated with database development, but  CFPB staff told us that their involvement as of July 2014 in the  development of the database has been limited.

Representatives from most of the financial institutions we interviewed said  they observed CFPB coordinating with other prudential regulators during  examinations at their institutions, with a few noting that coordination  between the regulators had been increasing. However, others noted  areas where CFPB could improve coordination. For example, the Federal  Reserve’s Office of Inspector General, which conducts internal audits of  CFPB’s operations, noted in a recent report that (1) CFPB did not  consistently retain evidence of its information-sharing activities with  prudential regulators and (2) CFPB could take additional steps to improve  coordination with the prudential regulators by sharing draft supervisory  letters (which describe the scope and findings of the examinations and  highlight any corrective actions that should be taken) as part of these  interactions. In addition, a 2013 report issued by the Bipartisan Policy Center, which studies federal regulatory issues, found that CFPB’s  examination efforts focus more on the products that institutions offer  rather than the examination efforts of the prudential regulators. The  center’s report notes that the difference in approach means it can take  CFPB longer to complete its examinations and can make coordination  between the regulators more challenging. The center recommended that  CFPB and the prudential regulators coordinate more closely to better  integrate CFPB’s product-based approach and examination schedule with  the other regulators’ approach.

section_title: Some Overlap Exists in CFPB, OCC, and Federal Reserve Data Collections
paragraphs: Although CFPB, OCC, and the Federal Reserve often collect different  information from different financial institutions, our analysis found some  similarities in the types of data collected and overlap in the financial  institutions reporting to each regulator in their large-scale mortgage and  credit card collections (submitted directly from the institutions  themselves). The extent to which the same institutions provided the  same types of data to CFPB, OCC, and the Federal Reserve is shown in  figure 1 below.

As shown in figure 1, CFPB and OCC collect similar credit card  information, but from different institutions. However, as figure 1 also  shows, four institutions that provide credit card data to CFPB also  currently provide the same types of data to the Federal Reserve.  However, staff from the two regulators noted that each uses its data for  different purposes. As mentioned earlier, CFPB staff told us that they use  the data obtained from their credit card collection to better understand  card markets and help ensure compliance with federal consumer financial  protection laws through the supervision and examination process. In  contrast, the Federal Reserve uses the information in analyses that  assess how changes in market conditions could affect the credit card  accounts in ways that impact the safety and soundness of these  institutions’ holding companies.

Our analysis also found some overlap in the data collections of OCC and  the Federal Reserve. Fifteen of the 16 national banks submitting credit  card data to OCC submit similar data through eight holding companies to  the Federal Reserve. In addition, 48 national bank affiliates that report  mortgage data to OCC also report these data through their eight holding  companies to the Federal Reserve. As a result, the holding company- level data the Federal Reserve obtains provides it with the information on  these activities conducted by any national bank affiliates and non-national  bank affiliates as well. OCC staff noted that OCC began its collection of  mortgage data in March 2008 and credit card data in April 2009 in  response to market events at the time. The Federal Reserve first  proposed collecting similar credit card and mortgage data in February  2012. Subsequently, in a notice published in the Federal Register in June  2012, the Federal Reserve noted that its own collection effort was  necessary because it needed data at the holding company level for its  stress test analyses of the institutions, whereas OCC’s data collection  was only from the institutions’ national bank affiliates.  Federal Reserve staff told us that the purpose of their collection is to assess the impact of  economic changes on credit card accounts and how this affects the  soundness of the holding companies, whereas OCC staff told us that they  use the credit card data they collect to monitor the status of the national  banks’ credit card portfolios and identify potential issues to review in  examinations. Staff from the Federal Reserve and OCC said they  coordinated on development of their respective collections, aligned data  fields, and established an information-sharing agreement to share  account-level data for the institutions. However, OCC staff told us that  coordinating the collections has been challenging and that one regulator  can make changes to its respective collection without the consent of the  other regulator.

section_title: Limited Information Exists on the Costs of CFPB’s Data Collections and Views about the Benefits Varied
paragraphs: Limited quantitative information about costs of CFPB’s large-scale data  collections is available. CFPB’s consumer financial data collections were  not conducted through a rulemaking and therefore CFPB was not  required to conduct a formal cost-benefit analysis before undertaking the  collections. But CFPB has identified some of the costs its data  collections pose. After obtaining CFPB contracts relating to data  acquisition, we determined that since 2011 CFPB has entered into five  contracts with private firms to obtain consumer financial data. These  contracts cover as long as 5 years, with obligations totaling over $33  million over this span, although CFPB staff noted that they would not  expend this entire amount if some option years are not exercised.staff reported that they were unable to quantify other costs borne by the  agency, such as those relating to storing the data collected.

CFPB staff acknowledged that their collections create costs and some  burden for financial institutions, but also noted the primary benefit of  these collections is that they provide data that inform much of CFPB’s  work to protect consumers, including its supervisory process,  rulemakings, and reports. For example, staff told us that the analysis from  their ongoing credit card collections will provide input into the scope of  some of CFPB’s 2015 supervisory examinations of credit card issuers  and will continue to help determine the scope of the agency’s  examinations. Staff also said that they used data from the credit card  collection to inform part of CFPB’s “ability to repay” rule, which amended  requirements so that card issuers no longer had to consider whether  certain younger consumers have an independent ability to pay; the  previous rule had affected the ability of nonworking spouses or partners  of these consumers to obtain credit.

Some of the consumer and industry groups we interviewed agreed that  CFPB collections of consumer financial data produced benefits and said  CFPB needed this type of data to carry out its mission. For example, one  group explained that the data are needed to aid CFPB staff’s  understanding of the financial products CFPB regulates. Two other  groups said that CFPB’s data collections may be justified because the  collections help CFPB regulate and monitor the markets. In addition, one  of the two groups said that CFPB’s collections result in more informed  decisions and actions, such as more targeted regulations. Furthermore,  representatives from several privacy groups and one consumer group we  interviewed noted that the commercial aggregators are more likely to be  targeted by individuals seeking unauthorized access to consumer  information than would CFPB.

However, representatives of financial institutions we interviewed had  differing perspectives on the relative costs and benefits of providing data  to CFPB. Representatives of most of the financial institutions we  interviewed said that CFPB requests for consumer financial data during  supervisory examinations have been more extensive than those of their  prudential regulators. They said CFPB’s data requests were broader and  required more information than requests from their prudential regulators.  However, some representatives offered explanations for these  differences, noting that CFPB’s focus for its collections (consumer  protection) is different from the focus of their prudential regulators and  CFPB’s examiners must collect more data to familiarize themselves with  the institutions they oversee.

Representatives of five institutions providing credit card data to CFPB’s  ongoing credit card collection generally reported that the initial  submission process was burdensome, but costs to supply the data  decreased over time. Representatives from several institutions reported  that determining what data to submit to CFPB and how to provide them  was particularly burdensome. For example, representatives cited  challenges in consolidating different data on their credit card accounts  from across different areas within their financial institutions and in  establishing new internal procedures for reviewing the monthly data  submission. However, the majority of financial institution representatives  we interviewed stated that costs or the amount of time their staff spend  preparing these data submissions has decreased over time.

In contrast, representatives of some financial industry and business trade  associations we interviewed expressed concerns about the burden CFPB  data collections place on financial institutions. Several representatives  cited the costs to produce consumer financial data for CFPB, suggesting  it may be greater than collections for other regulators. The recent report  by the Bipartisan Policy Center noted that the impact of CFPB’s data  requests create real costs for entities because of the size of requests and  institutions can be affected differently depending on their size.

Letter of David Hirschmann, Senior Vice President, U.S. Chamber of Commerce, to  CFPB Director Richard Cordray, June 19, 2013. agencies have provided, which other federal agencies or private  organizations that experienced breaches have done.

CFPB has taken steps to minimize burden on financial institutions. For  example, instead of requesting that the same institutions provide CFPB  with credit card data, CFPB entered into a MOU with OCC to share the  credit card data they collect. CFPB staff also reported coordinating their  examination information requests with the other prudential regulators.  CFPB staff said that they try to inform other regulators 90 days before  sending information requests so that they can coordinate information  requests when possible. In its information request letters, CFPB instructs  institutions to alert CFPB if the institutions’ prudential regulator already  obtained the information CFPB requested. CFPB then would coordinate  its requests with the regulator and alleviate the burden on the institution.

In a letter to the House Financial Services Committee, an economist  noted that CFPB could obtain a 1 percent sample of credit card accounts  to achieve its goals and also reduce some of the concerns relating to the  costs of providing an entire portfolio of data. We agree that providing  samples of data, as opposed to entire portfolios of data, sometimes can  reduce the burden on financial institutions. However, the regulators and  institutions we interviewed and our analysis indicated obtaining only  samples could hamper CFPB’s regulatory efforts and likely would not  produce cost savings for institutions.

CFPB uses samples in some examinations, but agency staff told us that  they collect all accounts for the ongoing credit card collection—because  the effort required to maintain a sample that represents the population of  accounts would be burdensome to institutions. For example, if too many  accounts in that sample are closed or the sample did not include newly  created accounts, it would become less representative over time. Rather  than having the institution re-sample its credit card population for each  data submission, CFPB asks for all accounts on file. Similarly, OCC staff  said that collecting samples of data on an ongoing basis would be less  cost effective because they would have to redesign the sample for the  institutions each time they wanted to conduct a different analysis. They  said the additional requests for different samples would create further  burden on the financial institutions.nearly all the financial institutions with whom we spoke said that supplying  CFPB with a sample of credit card data rather than all accounts would not  significantly reduce submission costs. They explained that providing a  sample might reduce data storage costs, but the submission process  would remain the same. GAO staff with expertise in research  methodologies and statistics reviewed information related to CFPB’s  credit card collection and agreed that that obtaining all accounts rather  than a sample is likely more efficient for creating and maintaining a  dataset that tracks changes in the same accounts over time. For  example, over time, cardholders may close some accounts, which would  create the burden and costs of continually adjusting the sample by adding  other accounts to maintain the desired level of precision in the sample.

section_title: CFPB Lacks Written Procedures and Documentation Needed to Address Privacy Risks and Better Ensure Ongoing Compliance with Requirements
paragraphs: CFPB has taken steps to protect the privacy of consumers and comply  with requirements, restrictions, and recommended practices in the Dodd- Frank Act, PRA, Privacy Act, E-Government Act, and NIST guidelines.  These steps include creating privacy policies, issuing public notices of  data collection activities, and establishing a group to consider and assure  the appropriateness of proposed data collections. However, CFPB has  not yet developed and implemented written procedures for its data intake  process, which includes a review of proposed data collections for  compliance with specific Dodd-Frank restrictions (among other things)  and for anonymizing data. The agency also does not have written  procedures for obtaining and documenting PRA determinations. CFPB  and OCC have an information-sharing agreement for their respective  credit card collections, but OMB staff raised concerns that such an  agreement may require OMB review and approval. In addition, OCC has  not obtained OMB approval for its credit card and mortgage data  collections under PRA. Finally, CFPB generally met statutory privacy  requirements, but lacked elements of certain privacy controls.
subsections: section_title: CFPB Lacks Written Procedures for Data Intake
paragraphs: CFPB reviews data collections to determine whether the Dodd-Frank  Act’s restrictions apply, but it has not yet created written procedures for its  data intake process.
subsections: section_title: Dodd-Frank Restrictions and Applicability to Data Collections
paragraphs: Under the act, CFPB must not obtain personally identifiable financial  information about consumers from the records of covered persons or  service providers, unless (a) consumers provide written permission or (b)  other legal provisions specifically permit or require such collections.  However, CFPB legal staff cited the agency’s supervisory authorities as  being among the legal provisions that permit collections of consumers’  personally identifiable financial information. In particular, these staff said  that CFPB’s supervisory authorities permit the agency to compel entities it  oversees to provide information (which, according to CFPB staff, may  include consumers’ personally identifiable financial information) it needs  to assess compliance with federal consumer laws and detect and assess  risks to consumers and markets. Therefore, information obtained through  supervisory activities, such as information requested during examinations  of large depository and certain nondepository institutions, does not violate  the restriction on collection of personally identifiable financial information  without consumer permission or as permitted by law, according to CFPB’s  legal staff. As mentioned earlier, the act has an additional restriction that  prohibits CFPB from using its market monitoring authority, which enables  CFPB to gather data to monitor risks to consumers to support its  rulemaking and other functions, to obtain records from covered persons  and service providers participating in consumer financial services markets  for the purposes of gathering or analyzing the personally identifiable  financial information of consumers. CFPB defines “personally  identifiable financial information” by regulation and states that data that do  not contain direct personal identifiers such as account numbers, names,  or addresses do not meet the definition of “personally identifiable financial  information.”

As shown in table 3, most of the data collections CFPB obtained do not  directly identify individuals and therefore, according to CFPB staff, their  contents do not meet the definition of “personally identifiable financial  information.” We analyzed the data fields and field descriptions for  CFPB’s 12 consumer financial data collections in our review and found  that 9 collections do not include direct personal identifiers among the  fields of information CFPB obtained. To the extent that the providers of  the data (e.g., financial institutions and credit reporting agencies) had  direct personal identifiers in their internal systems related to the nine  collections, they did not include them in the data they provided to CFPB.  We also visually inspected data extracts for 4 of these 9 data  collections—credit cards, consumer credit report information, overdraft  fees, and private student loans—and further verified that the data in the  fields CFPB obtained did not directly identify individuals.

Three of the data collections directly identified individuals using names  and addresses. CFPB staff said that the Dodd-Frank restrictions did not  apply to one of the three collections—arbitration case records—because  the entity that voluntarily provided the data was not a covered person or  service provider from which CFPB was prohibited from obtaining  personally identifiable financial information. According to CFPB staff, the  other two data collections that included direct personal identifiers— deposit advance products and storefront payday loans— were obtained  from covered persons but do not violate Dodd-Frank restrictions because  they were collected under CFPB’s supervisory authority and not its  market monitoring authority.

section_title: CFPB Actions to Anonymize Data
paragraphs: CFPB has taken steps, such as adopting informal procedures for  anonymizing data, to remove the information that directly identifies  consumers from these collections before the data are made available to  staff for analysis that may have nonsupervisory purposes. In particular:

Deposit advance products: CFPB staff showed us that for deposit  advance products, each institution had provided the consumers’  personal data—including names and addresses—in a file separate  from files containing the account and transaction data. CFPB staff  who analyze these data had not been granted access to these files.  We reviewed files from two of the institutions that submitted data and  confirmed that consumers were not directly identified in the files  available to staff who work on large-scale data collections.

Storefront payday loans: A CFPB staff member made copies of the  files sent by the payday lenders and removed all the directly  identifying information—names and complete address information.  We observed files from three of the lenders that submitted data and  confirmed that consumers were not directly identified in the files  available to staff who analyze these data. The original files were  stored in a separate file directory with restricted access, and CFPB  staff who analyze these data did not have access.

CFPB staff also applied similar procedures to the overdraft fees data  collection. This collection did not contain fields that directly identified  consumers but had information—nine-digit zip codes (five-digit zip code  plus the four-digit geographic extension)—that CFPB staff said they  considered sensitive. CFPB staff replaced the zip codes with a randomly  generated number string to further anonymize individuals. Staff stored the  files with the original zip codes and the match key to the random strings  that had replaced the zip codes in a separate location from the analysis  files. We reviewed files from two of the institutions that submitted data  and confirmed that consumers were not directly identified in the files  available to staff who analyze these data.

For initial determinations of whether Dodd-Frank restrictions apply to a  particular data collection, CFPB staff stated they rely on the legal division  to raise any concerns during Data Intake Group meetings when proposals  for data collections are considered. Legal staff said that their reviews  consist of determining whether the data will be collected from a covered  person or service provider, whether the collection will include personally  identifiable financial information, and whether CFPB plans to anonymize a  collection that contains personally identifiable financial information. Under  current practice, legal staff participating in the Data Intake Group  complete a section of a worksheet to indicate under what authority CFPB  is obtaining the data and the type of agreement (such as a contract or  interagency agreement) by which it would obtain the data. The legal  division must review and vote to proceed on every proposed data  collection before data may be brought into or collected by CFPB.  However, CFPB staff told us the Data Intake Group as a whole does not  have written procedures to guide its reviews. They said they recognized  the lack of written procedures and documentation requirements for the  Data Intake Group was a weakness in their current practices. CFPB’s  Chief Information Officer told us that CFPB established a data  governance working group to formalize CFPB’s information governance  policies, procedures, and responsibilities, including those of the Data  Intake Group. The working group’s initial product, the June 2014  information governance policy, states that information to which access is  restricted by law, including the Dodd-Frank restrictions, must be treated in   The policy also incorporates existing  accordance with such restrictions.policies and lays out high-level principles, guidelines, and responsibilities  for the intake, management (including storage, internal sharing and  access, and use), disclosure, and disposition of information. However, the  standards and written procedures to implement this policy are still under  development, according to CFPB staff.

Federal internal control standards and guidance discuss the importance  of having written documentation and procedures for control activities.  CFPB staff said that in setting up the new agency, they emphasized  adopting practices that help ensure that these issues were addressed but  had not yet formally defined roles, responsibilities, and documentation  requirements for the Data Intake Group in written procedures.  Establishing such procedures for its data intake process will help CFPB  ensure that staff consistently take appropriate steps when evaluating  proposed data collections, including reviewing them to determine whether  the Dodd-Frank restrictions apply.

section_title: CFPB Lacks Written Policies and Procedures for Anonymizing Data
paragraphs: In addition to Dodd-Frank restrictions that CFPB must follow, NIST  guidance calls for agencies to minimize collection and use of personal  information when possible. Although CFPB has taken steps to minimize  use of information that directly identifies individuals in certain data  collections, the agency has not developed standard policies and written  procedures to document the practices it uses for anonymizing data,  including clarifying how data sensitivity will be assessed and defining  specific roles, responsibilities, and steps in accordance with NIST  guidance and privacy controls. We found instances in which the agency  failed to fully remove sensitive information in some of its data collections,  as described below.

Data identifiability and sensitivity: NIST recommends that agencies  evaluate how easily data fields can be used to identify specific  individuals, the sensitivity of individual data fields, and the sensitivity  of groups of data fields. Federal internal control standards also call  for appropriate documentation of decisions and control activities.

According to CFPB staff, discussions among staff about removing  sensitive data elements were informal and not documented. CFPB  also has not specified in policy which data fields are considered  sensitive or potentially identifying and should be removed or masked.

Our observation of files from two of the institutions providing deposit  advance products data found that, although no individuals were  directly identified in the files used for analysis, one file from one  institution (with more than 1 million records) contained the nine-digit  zip code for each record. According to CFPB staff, this information  should not have been in that file. In the consumer credit data, CFPB  procured the complete data package the credit reporting agency  offered (a standard product), which included marketing data, without  any personal identifiers. The marketing data contained demographic  characteristics—including a religion variable that the credit reporting  agency obtained or developed internally—on the sample of individuals  whose credit record information CFPB obtained. When we observed  an extract of the data with CFPB staff, we noted the existence of the  religion variable. Not all CFPB staff realized the database contained  that information. They said that CFPB considered this particular  information sensitive and staff would remove it from their database.  The Privacy Act generally prohibits federal agencies from maintaining  records describing how any individual exercises rights guaranteed by   However, as noted previously, to be a record  the First Amendment.under the Privacy Act, information about an individual must contain  the person’s name or other identifier, and the information CFPB  acquired did not contain personal identifiers.

Minimization of personal information used in research: NIST  recommends that agencies (1) develop policies and procedures that  minimize the use of personal information for research and other  purposes and (2) implement controls to protect personal information  used for research and other purposes.  However, CFPB staff said  they have not developed written procedures for removing personal  identifiers from supervisory data or implemented controls such as  requiring reviews of anonymized files to ensure that all fields with  information that directly identifies individuals had been removed.

NIST SP 800-53, Revision 4. personal information as possible and they expect staff to know which data  elements are sensitive and should be removed. CFPB staff also said they  had not performed formal assessments of the sensitivity of data elements  because they have no plans to release such data publicly. However,  some privacy experts have noted that re-identification of consumer  financial data has become easier with the increase of online databases  and the rise of “big data.” For example, a recent report found that  anonymization strategies used in the past may not be robust enough in  light of current and emerging technology and techniques. Some privacy  experts have noted that only removing direct identifiers from a database  generally does not sufficiently anonymize the data. However, two  researchers noted that the risk of re-identifying data that have been  properly anonymized likely is overstated because identifying large  numbers of individuals in many anonymized data is difficult and takes  specialized expertise. Nevertheless, written policies and procedures for  assessing the sensitivity of data fields and removing sensitive data fields  would allow CFPB to comprehensively assess its data collections to help  ensure they are sufficiently anonymized and contain no unnecessary  sensitive information. In turn, such formal assessments would enhance  CFPB’s assurance that the privacy of the consumer financial data in its  data collections has been adequately protected.

section_title: CFPB Lacks Written Procedures for Documenting Decisions for the Paperwork Reduction Act
paragraphs: 5 C.F.R. § 1320.3(c)(4)(ii). estimates of burden, ways to enhance the quality, utility, and clarity of the  information collected, and ways to minimize the burden of the collection  on respondents before submitting the proposal to OMB.

According to CFPB staff, at the time they began these various large-scale  data collections, CFPB staff considered their contents and determined  that, for two reasons, they did not need to seek formal OMB approval  under PRA for these collections. First, CFPB procured much of the data  from private companies that serve as information resellers. Such data are  commercially available products and did not constitute information  collections under PRA, according to CFPB staff. Second, when CFPB  collected the information itself, staff said the agency did not ask exactly  the same questions of more than nine financial institutions, which would  have necessitated OMB approval.

But CFPB does not have written procedures for consistently and  appropriately documenting PRA determinations (both internally and from  OMB) for proposed collections. Instead, CFPB staff told us that initially  colleagues with PRA expertise (PRA team) provided internal training on  PRA, including the need to consult with the team and OMB staff about  determinations. After the Data Intake Group was established in 2013, the  PRA team began participating in the group’s meetings to ensure  discussions about PRA applicability and the need for OMB consultation  took place. CFPB staff said that under current practice, staff from the  PRA team who participate in the Data Intake Group complete a section of  a worksheet to specify the number of respondents in the collection, the  share of the market, whether OMB approval is required, and the status of  OMB approval. E-mails that document the Data Intake Group decisions  that we reviewed include information on whether the group determined  that PRA applied, but do not specify whether OMB was consulted or the  basis for determinations by the PRA team.

In the specific case of CFPB’s credit card collection and its information- sharing agreement with OCC, CFPB did not have appropriate  documentation of its consultations with OMB about PRA applicability. In  2012, CFPB sought to collect monthly account data from nine credit card  issuers while also obtaining (through an information-sharing agreement)  nearly identical data OCC had been collecting since 2009 from 9 different  issuers. According to internal June 2012 e-mails that we reviewed, CFPB  staff stated that by collecting information from 9 of more than 3,000  issuers, neither CFPB nor OCC were triggering PRA requirements under  the “substantial majority of an industry” standard in OMB regulations.  These e-mails also indicated that CFPB staff had discussed with OCC  whether PRA approval from OMB was needed and learned that OCC had  not sought OMB approval for its ongoing collection.

In the same e-mails from June 2012, the CFPB PRA team reported that  OMB had said (1) CFPB could collect information from nine banks, (2)  OCC could continue to collect information from another nine banks, and  (3) OCC could share its data with CFPB without going through the PRA  process. CFPB staff told us that they did not obtain documentation from  OMB staff because the advice had been received by telephone. However,  OMB staff with whom we spoke said that they were not aware of either  CFPB’s or OCC’s credit card collections and did not recall a discussion  with CFPB about its collection. OMB staff also could not find  documentation of such a discussion, although they acknowledged that  informal telephone consultations generally are not documented.  Furthermore, OMB staff told us that an information-sharing agreement  that could result in agencies bypassing the requirements of PRA—in  particular, the public notice and comment provisions—by collecting data  from more than nine entities would warrant closer examination to ensure  PRA compliance. They added that OMB would want to assess whether  these collections met the “substantial majority of an industry” standard,  which also would necessitate the need for a formal PRA review.

Federal internal control standards call for appropriate documentation of  decisions and control activities. In the initial period of agency  operations, CFPB staff said they emphasized complying with the  requirements over documenting decisions and establishing written  procedures. However, without written procedures for consistently and  appropriately documenting PRA-related decisions and discussions with  OMB, including about the credit card collection and information-sharing  agreement, CFPB lacks reasonable assurance that its collections are  conducted in compliance with requirements intended to help avoid  inefficiencies and minimize burden.

In our review of OCC’s collections of credit card and mortgage data, we  found information indicating that OCC was now obtaining data from more  than nine entities in these collections, which would require OMB approval.  OCC began collecting credit card data from nine institutions in 2009, and  OCC staff told us that they had determined that they did not need an  OMB PRA review because they were obtaining data from fewer than 10  institutions. In addition, OCC reported that the nine institutions  represented less than 1 percent of all national banks and federal savings  associations, which therefore did not meet the “majority of the industry”  provision in OMB’s regulations. However, in the information-sharing  agreement with CFPB, OCC listed nine entities as “reporters” (reporting  institution) for the credit card collection, but also indicated several  instances in which two or more national banks that were part of the same  holding company were combined into a single “reporter.” After our  analysis showed that OCC had data from more than nine entities, OCC  staff told us they reviewed the information requests they had sent to  financial institutions and confirmed the requests were sent to institutions  beyond the original nine. They said that as of July 2014, 16 entities were  providing credit card data to OCC. As a result, they planned to submit the  collection to OMB for approval under PRA. In addition, after reviewing  OCC’s information-sharing agreement with the Federal Reserve for its  first-lien mortgage and home equity data collections, we found that OCC  was collecting data from 61 entities for first-lien mortgage data, and 64  entities for home equity data. On September 5, 2014, OCC published  notices in the Federal Register describing these collections in advance of  submitting them to OMB for approval. Until completing steps to obtain  OMB’s approval for each of these three data collections, OCC will lack  reasonable assurance that the collections are in compliance with statutory  requirements intended to minimize burden on the financial institutions and  maximize the practical utility of the information collected.

section_title: CFPB Generally Met Statutory Privacy Requirements, but Lacked Elements of Certain Recommended Privacy Controls
paragraphs: CFPB has taken steps to comply with other requirements and  recommended controls aimed at protecting the privacy of personal  information that include publishing notices about information collections  and adopting policies. Beyond the specific Dodd-Frank requirements and  general PRA requirements, CFPB also is subject to the Privacy Act and  the privacy provisions of the E-Government Act, which require all federal  agencies to conduct certain steps when collecting data that includes  personal or direct identifiers of individuals. CFPB follows NIST guidance in implementing privacy controls, which are designed to facilitate  compliance with these statutes.
subsections: section_title: Privacy Act Requirements
paragraphs: CFPB has published notices as required under the Privacy Act, which is  intended to regulate agencies’ collection, maintenance, use, and  dissemination of information about individuals. Under the Privacy Act,  federal agencies must publish system of records notices (SORN) in the  Federal Register if they plan to maintain, collect, use, or disseminate  records about individuals that are retrieved from a system of records by  the name of an individual or other personal identifier. are required for systems of records operated by contractors on behalf of  an agency.

According to CFPB staff, most of CFPB’s consumer financial data  collections are not a system of records and do not require the issuance of  a SORN because the data are not typically retrieved by personal  identifiers, which is necessary for the information to be covered by the  Privacy Act. However, CFPB issued three SORNs relevant to our review  that provide public notice covering other information the agency obtains  during the course of its operations and which its staff may at times  retrieve using personal identifiers. Two of the SORNs (both published in  August 2011) are for its supervision databases, which cover data  collected from and about the depository and nondepository institutions  CFPB supervises. The third SORN (published in November 2012)

SORNs must identify the type of data collected, the types of individuals about whom  information is collected, and procedures that individuals can use to review and correct  personal information. covers market and consumer research records. Consistent with the  Privacy Act, the SORNs included a general description of CFPB’s  authority and purpose for collecting and using personal information and  how individuals could access and correct information maintained about  them. The inclusion of these elements is also consistent with NIST  privacy controls.before CFPB collected information maintained in these systems.

CFPB staff told us that the SORNs were published  While most CFPB data collections likely do not constitute systems of  records, agency staff said other activities involving personal information,  such as matching across databases, also were covered by the SORNs  they had issued. For example, CFPB staff said that a matching process  conducted by a third party on behalf of CFPB on the credit card data uses  personal identifiers obtained from supervised depository institutions to  retrieve records in the third party’s system. To the extent this matching  process creates a temporary system of records by virtue of retrieving the  records by personal identifiers, CFPB staff told us the need for public  notice is met by the SORN issued for the depository institution  supervision database. According to CFPB staff, the third party  immediately removes all identifiers once the records have been matched  and then transmits the resulting database to CFPB’s contractor, which  transmits the data to CFPB. Staff said that neither CFPB nor its contractor  retrieves records in the database by personal identifier and therefore the  database CFPB maintains does not constitute a system of records under  the Privacy Act.

section_title: E-Government Act Requirements
paragraphs: The E-Government Act has provisions that require federal agencies to  review data to help ensure sufficient protections for the privacy of  personal information held electronically. Federal agencies subject to this  act must conduct privacy impact assessments (PIA) that analyze how  personal information is collected, stored, shared, and managed in their  information systems. Agencies must make PIAs public to the extent  practicable, although this requirement can be modified or waived for  security reasons or to protect sensitive or private information. To comply  with these requirements, in June 2013 CFPB prepared a PIA for its  “Cloud 1” general support system (GSS), the information system in which  it maintains its consumer financial data collections.completed the PIA (which has not been made public) as part of the  security assessment and authorization process for the GSS. However, we  found that the PIA discussed consumer financial data very generally and  contained few details about the privacy risks raised by collections of  consumer financial data.

After completing the GSS PIA, CFPB staff said that they subsequently  changed the focus of PIAs from assessments of information systems to  assessments of categories of data collections. They said this change  would provide clearer information to the public about privacy risks for  specific data collections. As part of this new privacy analysis, they  published a PIA for market analysis of administrative data under research  authorities in December 2013 and another PIA covering the use of  supervisory data for market research in July 2014. Both PIAs note that re-identification of individuals is a risk posed by the data collections.  However, in both PIAs CFPB states that its staff will not attempt to re- identify individuals in databases that are anonymized. In addition, CFPB  is contractually prohibited from attempting to re-identify individuals in at  least one data collection procured from a contractor. Table 4 summarizes  which of CFPB’s data collections are covered by PIAs.

CFPB has implemented certain controls intended to ensure the proper  treatment of consumer financial data obtained, but CFPB has not yet  developed documentation or implemented plans, procedures, programs,  and training as specified in several controls. NIST’s guidance includes  controls for protecting privacy and ensuring the proper handling of  personal information.NIST-recommended controls, including the following:   CFPB has taken actions to address many of the

Data quality and integrity: CFPB included data quality provisions in  its contract with the aggregator for the credit card data collection.  These provisions outlined quality assurance steps for the aggregator  to take to help ensure the accuracy and completeness of the  information the credit card issuers provided. In addition, CFPB has  issued information quality guidelines for information it publishes.  These steps are consistent with control steps calling for an  organization to check for (and correct as necessary) inaccurate  information and issue guidelines maximizing the quality, utility,  objectivity, and integrity of disseminated information.

Security: CFPB has adopted a privacy incident response plan and  standard operating procedures for such incidents. The privacy  incident response plan included most of the components  recommended by NIST: the establishment of a privacy incident  response team; a process to determine whether notice to oversight  organizations or affected individuals is appropriate; a process to  assess the privacy risk posed by the incident; and internal procedures  to ensure prompt reporting by employees and contractors of any  privacy incident to appropriate officials. The CFPB privacy team has  created a log for privacy incidents and completed after-action reports  that detail what was reported, what the investigation found, and what  steps were taken. These steps are consistent with the control for an  organization to develop and implement a privacy incident response  plan and provide an organized and effective response to privacy  incidents in accordance with the plan.

Use limitation: CFPB has entered into MOUs with federal and state  agencies, which describe the purposes for which personal information  (and other nonpublic information) may be used by receiving parties.

CFPB also developed a policy for staff that governs when confidential  information may be shared with external parties. These steps are  consistent with control steps for information sharing with third parties,  which call for an organization to enter into MOUs that specify the  personal information covered and enumerate the purposes for which it  may be used.

Accountability, audit, and risk management: CFPB has outlined  privacy roles, responsibilities (which include safeguarding nonpublic,  business-sensitive, confidential, or personal information or data), and  access requirements for all CFPB contractors and service providers in  various policy documents. General privacy and confidentiality clauses  were included in several contracts we reviewed. CFPB subsequently  prepared guidance for its staff on privacy-specific clauses to be  included in data collection and analysis contracts. In addition,  members of the Data Intake Group review contracts to help ensure  that contracts for collections that include personal information are  flagged to include appropriate privacy clauses. These steps are  consistent with the control for an organization to establish privacy  roles, responsibilities, and access requirements for contractors and  service providers, and to include privacy requirements in contracts  and other acquisition-related documents.

However, CFPB does not yet have (1) a comprehensive privacy plan  incorporating its various privacy policies and guidance; (2) a documented  privacy risk management process; (3) a comprehensive, documented  program for monitoring and auditing privacy controls or a regularly  scheduled independent review of its program; and (4) role-based privacy  training, as specified in other controls relating to accountability, audit, and  risk management.

Comprehensive privacy plan: NIST’s “governance and privacy  program” control calls for agencies to develop a strategic  organizational plan for implementing applicable privacy controls,  policies, and procedures. CFPB has developed a number of privacy  policies and guidance documents, including a high-level privacy  policy, a handbook for sensitive information, a PIA policy (which takes  effect in December 2014), a PIA template, and guidance for preparing  SORNs. However, CFPB privacy staff stated that they had not yet  brought them together to develop a comprehensive plan that covers  all of CFPB’s privacy operations.

Documented privacy risk-management process: NIST’s “privacy  impact and risk assessment” control calls for agencies to document  and implement a process for privacy risk management that assesses  risks to individuals resulting from collecting, sharing, storing,  transmitting, using, and disposing of personal information. Agencies  also should conduct PIAs for information systems, programs, or other  activities that pose a privacy risk in accordance with applicable law,  OMB policy, or organizational policies or procedures. Supplemental  guidance for this control states that tools and processes for managing  risk “include, but are not limited to, the conduct of PIAs.” We reported  on the importance of assessing privacy risks to help program  managers and system owners determine appropriate policies and  techniques to implement the policies. Currently, CFPB follows an  informal process for managing privacy risks that does not fully  document risks involved with data collections or the methods CFPB  plans to use to address the risks. CFPB staff stated that the agency  has centralized all privacy activities with the Chief Privacy Officer and  a team of CFPB staff (privacy team), who perform all assessments of  privacy risks, primarily through the PIA process. In June 2014, CFPB  adopted a formal PIA policy that will take effect in December 2014  and that places responsibility with the Chief Privacy Officer for  determining whether PIAs are required. But the policy does not  specify the procedures to be used and documentation required for  making such determinations. CFPB staff said that privacy team  representatives to the Data Intake Group currently use a worksheet to  assess and document whether proposed collections require a PIA and  whether an existing PIA would cover the collections. The privacy team  follows CFPB’s PIA template to create new PIAs. However, CFPB  staff said there are no written procedures they follow to guide their  assessments, although such procedures are being developed. CFPB  staff were not always able to clearly identify whether a specific data  collection required a PIA and if so, which one, because these prior  determinations had not been documented. Furthermore, staff said  they do not document discussions or analyses that lead to the  conclusions published in their PIAs.

Comprehensive, documented program for monitoring and  auditing privacy controls: According to NIST’s “privacy monitoring  and auditing” control, agencies are to monitor and audit privacy  controls and internal privacy policy to ensure effective implementation.

NIST guidance calls for regular assessments and mentions external  audits as means to obtain these assessments. CFPB is required to  have an annual independent audit of its operations and budget.  CFPB identified the areas that the auditor reviewed and selected its  privacy programs, policies, and processes as one of the areas for  review in 2012. In its 2012 report, CFPB’s independent auditor  identified the lack of a formal privacy compliance program as an  opportunity to improve performance. CFPB staff said they had  addressed this finding, noting their policy for annually reviewing  SORNs and PIAs and a worksheet CFPB prepared for an information  technology application that lists the NIST privacy controls and the  steps CFPB had taken to implement them. CFPB staff said they  planned to complete similar worksheets for each new application and  system. However, staff do not plan to prepare such worksheets for  applications and systems already in place, and have not established  procedures for reviewing and updating the worksheets. Although  CFPB has adopted a checklist for reviewing SORNs, staff said they  do not have a similar checklist or documentation requirements for  reviewing PIAs. In addition, CFPB staff said they had not had an  external audit of their privacy practices other than the 2012 audit.

Role-based privacy training: NIST’s “privacy awareness and  training” control calls for agencies to administer targeted, role-based  privacy training (in addition to basic privacy training that all staff  receive) for personnel having responsibility for personal information or  for activities that involve personal information. CFPB has developed a  training process for privacy awareness, and CFPB employees and  contractors receive privacy training as part of annual security  awareness training. CFPB also trains staff on the treatment of  confidential supervisory information, which may contain consumers’  personal information. CFPB staff said they adopted organization-wide  privacy awareness training from the Department of the Treasury, but  were still developing role-based privacy training and did not yet have  an estimated date for completion.

CFPB staff said that, in setting up the new agency, they had adopted  policies and practices that would address privacy issues. However, the  agency has not yet comprehensively documented its policies and  procedures or completed development of its role-based privacy training.  By not fully implementing controls to include written procedures,  comprehensive documentation, a regular review of its privacy practices,  and targeted training, CFPB is hampered in its ability to identify and  monitor privacy risks and ensure the proper handling of personal  information.

section_title: CFPB Has Implemented Information Security Measures to Protect Consumer Financial Data, but Weaknesses Exist
paragraphs: CFPB has taken actions to protect the consumer financial data it has  collected from unauthorized disclosure, but some documentation lacked  key information and its evaluation of how a service provider protects data  was not comprehensive. CFPB has established an information security  program, implemented controls to protect access to sensitive data, and  assessed the risks of its consumer financial data collections using a risk- management framework that adhered to federal information security  guidance. However, CFPB’s documentation of its risk assessments and  remedial action plans to correct identified weaknesses for the information  system and related components that maintain and process consumer  financial data lacked key elements. Further, the initial evaluation CFPB  had completed of its service provider was not sufficiently comprehensive.
subsections: section_title: CFPB Established an Information Security Program
paragraphs: In a 2013 audit of the CFPB’s information security program, the Office of  Inspector General (OIG) for the Federal Reserve and CFPB determined  that CFPB had taken multiple steps, consistent with FISMA requirements,  to develop, document, and implement an information security program.  FISMA requires agencies to develop, document, and implement an  information security program. OMB and the Department of Homeland  Security (DHS) have instructed agencies to report annually on a variety of  metrics, which are used to gauge implementation of information security   The OIG reported that CFPB’s overall information security  programs.program in 2013 was generally consistent with requirements in 6 of 11  information security areas outlined in DHS reporting instructions: (1)  identity and access management; (2) incident response and reporting; (3)  risk management; (4) plan of action and milestones; (5) remote access  management; and (6) contractor systems. For a seventh area—security  capital planning—the OIG noted that CFPB has been taking sufficient  actions to establish a security capital planning program in accordance  with DHS requirements.

The OIG identified several opportunities to improve CFPB’s information  security program through automation, centralization, and other  enhancements. Specifically, the agency had not defined metrics to  facilitate decision-making and improve performance of its information  security continuous monitoring program; implemented tools to more  comprehensively assess security controls and system configurations;  developed and implemented an organization-wide configuration  management plan and consistent process for patch management;  designed, developed, and implemented a role-based training program for  individuals with significant security responsibilities; or fully implemented a  capability to centrally track, analyze, and correlate audit log and incident  information. In addition, CFPB’s contingency planning for a selected  system needed improvement. The OIG made four recommendations to  address these issues, with which CFPB concurred. The OIG noted that  CFPB’s planned actions were responsive to the recommendations, but as  of July 2014, the recommendations remained open pending the OIG’s  review during the 2014 FISMA audit.

section_title: CFPB Established Access Controls for Protecting Consumer Financial Data
paragraphs: CFPB had implemented several logical access controls for the  component of the information system that maintains the consumer  financial data collections we reviewed and was scanning for problems or  vulnerabilities. Agencies can protect the resources that support their  critical operations from unauthorized access by designing and  implementing controls intended to prevent, limit, and detect unauthorized  access to computing resources, programs, information, and facilities.  Inadequate access controls diminish the reliability of computerized  information and increase the risk of unauthorized disclosure, modification,  and destruction of sensitive information and disruption of service. As part  of assessing the controls that CFPB uses to protect consumer financial  data it collects, we reviewed the logical access controls the agency  implemented on the primary servers that staff use to process and store  these data. As one of the ways CFPB seeks to mitigate the risk of  unauthorized re-identification of individuals, the agency has controlled  which staff have access to data collections that directly identify  individuals.

Based on interviews with CFPB staff who manage these servers and  observations and reviews of information technology security controls and  settings we determined that CFPB had installed and configured  automated tools to perform regular configuration management and  periodic security scans of the servers supporting the component. CFPB  also leveraged its existing centralized account management system to  manage who had access to these servers. The agency also had  implemented controls intended to prevent staff members who are not on  the approved list from accessing consumer financial data. According to  CFPB, there have been no security incidents resulting in unauthorized  disclosures of information in the information system component that  maintains consumer financial data.

In July 2014, the Federal Reserve and CFPB OIG issued a report on a  review of the cloud-based system in which CFPB maintains its consumer   The OIG made recommendations to address  financial data collections.weaknesses they identified in work conducted in fall 2013, including  recommending improvements to CFPB’s procedures for system and  information integrity and configuration management. OIG staff told us that  CFPB has implemented corrections in these areas. The OIG report also  recommended that CFPB take actions related to contingency planning  and incident response; CFPB actions to address these were still  underway.

section_title: CFPB Generally Followed Steps of the NIST Risk Management Framework for the System That Maintains Consumer Financial Data
paragraphs: Although the collection of consumer financial data can create concerns  over improper use or unauthorized disclosure, CFPB has taken steps to  assess the risks posed by these data and implemented controls or taken  other actions to address the risks. NIST has published a risk- management framework, which recommends that agencies follow a six- step process involving (1) security categorization; (2) security control  selection; (3) security control implementation; (4) security control  assessment; (5) information system authorization; and (6) security control  monitoring.management activities into the system development life-cycle.

The framework integrates information security and risk- CFPB has adopted this framework as the basis for the process it uses to  assess the risks of the consumer financial data and other data it collects  and generally applied the framework to the information system and  related components that maintain, process, and store the consumer  financial data collections we reviewed. To address the steps of the risk- management framework, CFPB generally completed information security  documentation required by FISMA (such as risk assessments, system  security plans, and remedial action plans) or outlined in NIST guidance  (including security assessment plans and reports) to address the steps of  the risk management framework. Table 5 provides additional information  on CFPB’s actions to implement the framework for the information system  and its components.

section_title: CFPB’s Information Security Documentation Lacked Key Elements
paragraphs: Although CFPB generally completed the information security  documentation required by FISMA or outlined in NIST guidance for  implementing the risk management framework, several key elements  were missing from various documents. NIST has issued guidance for  conducting risk assessments that outline elements that should be  included in documentation of risk assessment results. In addition, CFPB  adopted a risk management process and guidance for preparing remedial  action plans that outline its internal documentation requirements.
subsections: section_title: Risk Assessments
paragraphs: Conducting and documenting risk assessments help ensure agencies  fully assess the risks of data they maintain and apply appropriate  protections, but CFPB’s risk assessment documentation did not include  all the elements NIST guidance recommends for communicating results  of risk assessments. Specifically, the three risk assessment and  recommendation forms we reviewed did not include the following  essential elements identified by NIST: (1) the assumptions and  constraints under which the risk assessment was conducted; (2)  information sources to be used in the assessment; (3) the risk model and  analytical approach used in the risk assessment; (4) threat sources; (5)  potential threat events; (6) vulnerabilities and predisposing conditions that  affect the likelihood that potential threat events will result in adverse  impacts; (7) the likelihood that potential threat events will result in adverse  impacts; (8) the adverse impacts from potential threat events; and (9) the  risk to the organization from threat events. The results of a fourth risk  assessment were documented in a security assessment report. Although  the security assessment report identified the assumptions and constraints  under which the risk assessment was conducted and the risk model that  was used (elements 1 and part of 3 above), it did not include the other  elements listed above.

Enhancing its documentation of risk assessment results to be more  comprehensive and consistent would help CFPB demonstrate that it has  effectively assessed risk and identified and considered all threats and  vulnerabilities to its operations.

section_title: Remedial Action Plans
paragraphs: Remedial action plans can assist agencies in tracking and ensuring that  information security weaknesses are addressed in a timely way.  However, CFPB’s remedial action plans did not always include all the  weaknesses identified. CFPB policy states that weaknesses identified  during internal and external system reviews should be included in  remedial action plans. We compared the CFPB system documentation  and testing results with the remedial action plans for the information  system and related components that maintain consumer financial data  and found instances in which not all security weaknesses identified were  included in the plans. For example, the system documentation for its  information system identified 20 controls we reviewed that were not fully  implemented—16 were listed as partially implemented, 3 were listed as  planned for implementation, and 1 was listed as a new control. However,  the 3 planned controls and 1 new control were not recorded in the  system’s remedial action plan.

In addition, CFPB had not remediated all weaknesses in its remedial  action plans by their scheduled completion date in accordance with CFPB  guidance. CFPB guidance included required completion dates for  remediating all high-risk weaknesses (within 30 days), all medium-risk  weaknesses (within 90 days), and all low-risk weaknesses (by the  scheduled completion date documented in the remedial action plan). In  addition, CFPB guidance states that staff should assign scheduled  completion dates, which may extend beyond the required completion  dates, based on realistic timelines given agency priorities and available  resources. Of the 16 partially implemented controls we reviewed that  were recorded as weaknesses in the remedial action plan, CFPB had not  completed remedial steps for 9 weaknesses by the scheduled completion  date of September 2013. Further, the scheduled completion dates had  not been updated to reflect current plans for remediation. CFPB’s testing  of one of the system components that maintains and processes consumer  financial data identified three high-risk weaknesses that were scheduled  to be remediated by October 2013. One weakness was the aggregate risk  posed by numerous medium- and low-risk findings identified during  testing and automated scans. The remedial action plan required CFPB to  analyze each finding to determine its risk impact and prioritize them for  remediation or mitigation. According to the Chief Information Security  Officer, CFPB has been making steady progress towards remediating the  findings that make up this high-risk weakness; however, as of June 2014,  CFPB had not addressed all these findings or updated the scheduled  completion date in the remedial action plan to reflect the current timeline  for completing these actions.

Ensuring that its remedial action plans are comprehensive and updated to  reflect current timeframes for remediating weaknesses would enhance  CFPB’s ability to identify, assess, prioritize, and monitor the progress of  corrective efforts for security weaknesses.

section_title: CFPB Developed a Process for Evaluating Service Providers but Initial Assessments Were Not Comprehensive
paragraphs: Under the FISMA information security program, agencies are required to  develop a risk-management process that helps ensure that information  and information systems provided or managed by another agency,  contractor, or other source are protected with appropriate information  security controls. CFPB has developed a risk management process that  covers all agreements and contracts between CFPB and service  providers that process information on its behalf. One step in the process  is conducting assessments of these service providers based on the types  of applications, tools, or services provided. Once the appropriate  assessment is conducted, CFPB generates a risk assessment and  recommendation form, including appropriate risk mitigation activities. The  form is then submitted to the appropriate approval authorities. CFPB also  tracks the implementation of its recommendations by creating risk  mitigation items and activities that will be tracked through CFPB’s  remedial action plans.

Some actions have been taken to assess whether the service provider  that processes consumer financial data on CFPB’s behalf was  implementing adequate protections. We reviewed a 2012 report by the  service provider’s independent auditor about certain controls the provider  had in place. The independent auditor found the controls were suitably  designed to provide reasonable assurance that control objectives would  be achieved and that the tested controls were operating effectively  throughout the review period. Officials from the provider told us that other  federal agencies for which they process data also have reviewed their  information security program. In addition, they said they had never had a  breach of the environment in which they process and maintain CFPB’s  data. CFPB also conducted an initial review of this service provider to  assess the risks associated with utilizing the providers’ systems and  services, and documented the findings and recommendations, which  were reviewed and approved in March 2014. CFPB’s contract with the  service provider includes specific information security requirements and  states that CFPB shall conduct annual reviews to help ensure security  requirements in the contract are implemented, enforced, effective, and  operating as intended. However, CFPB did not examine how the provider  had implemented these requirements as part of its initial review of this  provider.

Without effectively reviewing its service provider and following its own  process of tracking risk mitigation items and activities, CFPB lacks  assurance that it is fully safeguarding its information resources and  making fully informed decisions related to managing risk and  implementing risk mitigation controls.

section_title: Conclusions
paragraphs: To better detect risks in consumer financial markets and improve federal  oversight of consumer financial protection laws, CFPB has collected  consumer financial data on products ranging from credit card accounts to  payday loans. CFPB has used the consumer financial data it collects to  inform required rulemakings, develop examination strategies, and issue  congressionally mandated reports. Recognizing the sensitivity of some of  the consumer financial data it has collected, CFPB has taken steps to  protect and secure these data collections, including adopting high-level  privacy and security policies and processes. For example, the agency  created a data intake process that brings together staff with relevant  expertise to consider the statutory, privacy, and information security  implications of proposals to collect consumer financial data. Staff also  described a process for anonymizing large-scale data collections that  directly identify individuals. In addition, CFPB recently developed  overarching policies on information governance and privacy impact  assessments.

However, CFPB staff said they were primarily focused on taking  necessary actions to effectively carry out their mission during these early  years of agency operations and as a result, a number of policies and  processes were not fully documented or implemented, as required by  federal internal control guidelines or outlined in NIST guidance. In  particular:

Lack of written procedures: CFPB lacks written procedures for its  data intake process, including for evaluating whether statutory  restrictions related to collecting personally identifiable financial  information apply to large-scale data collections, documenting  determinations of whether these collections are subject to PRA, and  assessing and managing privacy risks of these collections. CFPB has  not established written procedures for anonymizing data collections to  help ensure staff take the appropriate steps each time or for  monitoring and auditing privacy controls. In addition, CFPB did not  consistently or comprehensively document its information security  risk-assessment results. Developing written procedures with  consistent, comprehensive documentation requirements would help  provide CFPB with reasonable assurance that its collections comply  with statutory requirements and that it will not place consumers’  privacy at risk.

Incomplete implementation of privacy and security steps: CFPB  has not yet developed a comprehensive privacy plan that brings  together existing policies and guidance. It has not established a  regular schedule of periodic reviews of its privacy program, or  completed development of a role-based privacy training program.  CFPB also did not capture all information security weaknesses  identified in its remedial action plans or update the plans to include  current planned dates for remediation based on priorities and  available resources. In addition, CFPB did not comprehensively  evaluate the service provider that processes consumer financial data  on its behalf for compliance with contract provisions. Taking these  actions will help strengthen CFPB’s privacy program and enhance its  ability to identify, track, and mitigate security risks to consumer  financial data stored on its systems.

Insufficient efforts on PRA compliance: CFPB did not sufficiently  document its consultation with OMB about the information-sharing  agreement with OCC relating to the agencies’ separate credit card  collections and the implications under PRA, and OMB staff told us it  warranted further review. OCC also had not sought OMB approval for  its credit card and mortgage data collections even though it now  obtains data from more than nine entities for each of these collections.  Obtaining further guidance from OMB on whether the information- sharing agreement requires CFPB and OCC to follow procedures  outlined in PRA and getting OMB approval for OCC’s credit card and  mortgage data collections would help both agencies ensure they fully  comply with the law, do not unduly burden financial institutions, and  maximize the practical utility of the information collected.

section_title: Recommendations for Executive Action
paragraphs: To help improve CFPB’s efforts to protect and secure collected consumer  financial data, we are making the following 11 recommendations to the  Director of CFPB.

To help ensure consistent implementation of its current processes and  practices, the Director of CFPB should establish or enhance written  procedures for:  1.  the data intake process, including reviews of proposed data  collections for compliance applicable legal requirements and  restrictions and documentation requirements for consultations with  OMB about PRA applicability;  2.  anonymizing data, including how staff should assess data  sensitivity, which steps to take to anonymize data fields, and  responsibilities for reviews of anonymized data collections;  3.  assessing and managing privacy risks, including documentation  requirements to support statements about potential privacy risks in  PIAs and for determinations that PIAs are not required;  4.  monitoring and auditing privacy controls; and  5.  documenting information security risk-assessment results  consistently and comprehensively to include all NIST- recommended elements.

To enhance the protection of collected consumer financial data, the  Director of CFPB should fully implement the following five privacy and  security steps:  1.  develop a comprehensive written privacy plan that brings together  existing privacy policies and guidance;  2.  obtain periodic reviews of the privacy program’s practices as part  of the independent audit of CFPB’s operations and budget;  3.  develop and implement role-based privacy training;  4.  update remedial plans for the information system that maintains  consumer financial data and related components to include all  identified weaknesses and realistic scheduled completion dates  that reflect current priorities and available resources; and  5.  include an evaluation of compliance with contract provisions  relating to information security in CFPB’s review of the service  provider that processes consumer financial data for CFPB.

To provide greater assurance of compliance with PRA, the Director of  CFPB should also consult further with OMB about whether PRA  requirements apply to its credit card data collection and information- sharing agreement with OCC, and document the result of this  consultation.

We are also making a recommendation to the Comptroller of the  Currency. To ensure compliance with federal law, the Comptroller of the  Currency should seek timely approval from OMB under PRA for OCC’s  credit card and mortgage collections, including the information-sharing  agreement with CFPB for credit card data.

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to CFPB, CFTC, the Consumer Product  Safety Commission, FDIC, the Federal Reserve, FHFA, FTC, NCUA,  OCC, OMB, SEC, and Treasury for review and comment. CFPB, OCC,  and NCUA provided written comments that we reprinted in appendixes III,  IV, and V, respectively. CFPB, FDIC, the Federal Reserve, FTC, OCC,  and OMB provided technical comments that we incorporated, as  appropriate. CFTC, the Consumer Product Safety Commission, FHFA,  SEC, and Treasury did not provide comments.

In written comments, CFPB concurred with our recommendations and  noted that the report provides important information about the data CFPB  uses to meet its statutory responsibilities and ways that CFPB can further  enhance privacy and security safeguards. CFPB further noted that other  federal prudential regulators collect similar amounts of consumer financial  data and discussed ways in which CFPB has been working to reduce the  burden or costs to financial institutions providing the data.

CFPB outlined the actions the agency was taking or planned to take in  response to our recommendations.  For example, CFPB agreed to adopt  formal procedures for its Data Intake Group for documenting its practices  to ensure compliance with applicable requirements and consultations with  OMB about PRA applicability. CFPB also noted it will develop written  procedures for the de-identification of data containing personal identifiers.  CFPB also agreed to review existing procedures related to its risk- assessment documentation for information security controls.

Furthermore, CFPB said it has been developing a comprehensive written  privacy plan, which will discuss how the agency will assess and manage  privacy risks and monitor and audit privacy controls. CFPB also plans to  develop additional role-based privacy training for its staff, review its  remedial action plans to ensure appropriate details are documented and  remediated on schedule, and review its information security risk- management process to further refine oversight of service providers.  Finally, CFPB agreed to consult with OMB again about its credit card  collection.

In written comments, OCC also agreed with our recommendation to seek  PRA approval from OMB for its credit card and mortgage collections.  OCC noted that during the course of our review, OCC officials found that  they were collecting data from more than 10 banks, which would require  OMB approval under PRA. OCC noted that on September 5, 2014, it  published a notice in the Federal Register about these collections and  indicated that it planned to submit packages to OMB seeking the  appropriate approval.

In its written comments, NCUA noted the importance of safeguarding  consumer financial data and the role of CFPB in consumer protection.

We are sending copies of this report to the appropriate congressional  committees, the Director of CFPB, the Chairman of CFTC, the Chairman  of the U.S. Consumer Product Safety Commission, the Chairman of  FDIC, the Chair of the Federal Reserve, the Director of FHFA, the  Chairwoman of FTC, the Chairman of NCUA, the Comptroller of the  Currency, the Director of OMB, the Chair of SEC, and the Secretary of  the Treasury. In addition, the report is available at no charge on the GAO  website at http://www.gao.gov. If you or your staff have any questions  about this report, please contact me at (202) 512-8678 or  clowersa@gao.gov.  Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  GAO staff who made key contributions to this report are listed in appendix  VI.

section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of this report were to review (1) the Consumer Financial  Protection Bureau’s (CFPB) consumer financial data collection efforts,  including the authorities, scope, purposes, and uses of these collections,  and the ways in which CFPB has collaborated with other federal financial  regulators as part of these collections; (2) the extent to which CFPB  complied with statutory restrictions on its consumer financial data  collection authorities and federal privacy requirements; and (3) the extent  to which CFPB has assessed the risks of these collections and applied  appropriate information security protections over these data.

To describe the authorities, scope, purposes, and uses of CFPB’s data  collections, we reviewed relevant portions of the Dodd-Frank Wall Street  Reform and Consumer Protection Act (Dodd-Frank Act), CFPB studies,  regulations, and contracts with data aggregators. Our review focused on  large-scale consumer financial data collections CFPB obtained under  supervisory or market monitoring authorities, as well as voluntary  requests, and not data collected related to consumer complaints or for  investigative or enforcement purposes. We studied 12 large-scale CFPB  data collections that included consumer financial data the agency was  collecting or had collected during the period from January 1, 2012 through  July 1, 2014. CFPB research staff identified and confirmed that these 12  data collections represented the extent of large-scale data collections  from multiple institutions being studied by CFPB staff during this time  period. We excluded any planned data collections or collections under  development. We focused our analysis of CFPB’s data collections,  studies, and examination materials on consumer financial data collections  that occurred since January 2012, as CFPB had limited data collections  before that time.

We physically reviewed several of CFPB’s large-scale data collections  on-site: consumer credit report information, credit cards, deposit advance  products, overdraft fees, storefront payday loans, and private student  loans. For the other large-scale collections we reviewed the data field  names and descriptions: Mortgages (Corelogic contract), private-label  mortgages (Blackbox Logic contract), automobile sales, online payday  loans, credit scores, and arbitration case records. We did not assess the  appropriateness of any individual fields for which CFPB is collecting data.  We interviewed CFPB staff from the Research, Markets, and Regulation  and Supervision, Fair Lending, and Enforcement teams as well as CFPB  legal staff.

To describe the data collections from other prudential regulators as well  as any overlap or duplication of efforts, we reviewed relevant agency  publications and interviewed officials and staff from the Board of  Governors of the Federal Reserve System (Federal Reserve), Office of  the Comptroller of the Currency (OCC), Federal Deposit Insurance  Corporation, and the National Credit Union Administration. We also  reviewed the Federal Reserve’s public notifications about its collections  for conducting bank holding company stress tests (Y-14 collections),  which included notices in the Federal Register about its credit card and  mortgage data collections, and OCC’s documents related its credit card  and mortgage data collections, including its contract with a data  aggregator. We also reviewed the large scale consumer financial data  collections of OCC, FDIC, and the Federal Reserve to determine whether  they contained information that directly identifies individuals. We did not  assess the privacy or information security controls of these collections for  this report.

We also discussed the extent to which other agencies with financial  markets or consumer regulatory responsibilities also collect consumer  information, including with staff from the Commodity Futures Trading  Commission, the Consumer Product Safety Commission, the Federal  Housing Finance Agency (FHFA), the Federal Trade Commission, and  Securities and Exchange Commission. To describe the ways in which  CFPB coordinates with other regulators on data collections, we reviewed  memorandums of understanding and information-sharing agreements  CFPB has with other federal regulators and interviewed regulatory staff.  We focused our review on the CFPB’s information-sharing agreements  for large-scale data collections: one with FHFA for the National Mortgage  Database and another with OCC for the credit card database, and  interviewed relevant staff at each of these agencies about the  agreements and developments of the data sharing.

To describe what is known about the costs and benefits of CFPB’s data  collections, we reviewed CFPB contracts, reports, rulemakings,  testimonies and responses to congressional questions. To learn more  about financial institutions’ experiences providing consumer financial data  and how these experiences compared with other prudential regulators,  we interviewed representatives from 9 financial institutions. We randomly  selected and interviewed eight institutions that are supervised by CFPB  and that provide credit card account data to either CFPB or OCC on an  ongoing basis. We also randomly selected and interviewed 1 additional  financial institution to interview that was supervised by CFPB but does not  provide credit card data on an ongoing basis. In addition to the interviews  with representatives of these 9 institutions, we reviewed examination  workpapers from 10 randomly selected institutions. We reviewed  information requests and supervisory letters from 46 examinations at  these institutions that were completed in 2012 and 2013. We also  reviewed reports and interviewed staff from organizations that analyzed  privacy issues, monitored consumer financial topics, and served as  industry associations for financial institutions.

To determine the extent to which CFPB complied with federal data  collection requirements and privacy protections, we reviewed CFPB  privacy policies and information-sharing protocols, training requirements,  and public and nonpublic notices about collections involving personal or  direct identifiers. We compared CFPB’s policies and practices against  Dodd-Frank Act requirements, Office of Management and Budget (OMB)  guidance, and recommendations of the National Institute for Standards  and Technology (NIST). We reviewed publications by the White House,  Federal Trade Commission, and other policy research organizations  about the risks for re-identification associated with collecting anonymized  consumer data. We interviewed CFPB’s Chief Information Officer, Chief  Privacy Officer, and other data, research, and legal staff about their  privacy-related policies, practices, and controls implemented. We  discussed CFPB’s data collections with OMB staff who review federal  collections and compliance with statutory requirements. We also spoke  with consumer and privacy advocacy groups about their views on CFPB’s  data collections and with an academic expert about the extent to which  personal information can be de-anonymized.

We met with CFPB staff who analyze these data and physically observed  CFPB data collections on-site to understand the scope of the data  collections and how CFPB treated any personally identifying information.  We reviewed the data fields for each of the 12 databases under review.  For 3 of the 12 databases, CFPB stores the data at the institution level.  For these databases (payday lending, overdraft fees, and deposit  advance products), we reviewed a sample of seven of the institutions that  provided data. We took steps to ensure the accuracy of key information  used in this report, including interviewing agency officials, obtaining  original source documents, and physically observing database contents  on-site when necessary. We determined the data were reliable for the  purposes used in this report, specifically giving readers an estimate of the  number of records in each dataset.

To describe the adequacy and effectiveness of CFPB’s information  security protections, we reviewed CFPB’s security policies and  procedures for the information system and related components that store  consumer financial data. We compared CFPB’s current information  security policies and procedures against the NIST risk-assessment  framework, which emphasizes the selection, implementation, and  monitoring of security controls, and the authorization of information  systems. We reviewed and analyzed documentation and policies related  to CFPB’s system security plan, risk assessments, security assessment  reports, and remedial action plans and compared each against applicable  NIST and CFPB-defined standards. We evaluated the extent to which  CFPB has established and implemented policies and procedures to  ensure its service providers provide adequate security protections over  the consumer financial data which is collected and maintained on its  behalf. This was done by reviewing and analyzing documentation of  CFPB’s evaluation of a service provider and comparing it against CFBP  requirements. We reviewed prior audit work conducted by the Inspector  General for the Federal Reserve and CFPB in this area. We interviewed  the Chief Information Officer, Chief Information Security Officer, and other  CFPB staff about these policies, procedures, and reports. We reviewed  logical access controls for the information system component in which  CFPB stores and analyzes consumer financial data. We reviewed and  observed access control lists, authentication and account management,  server administration and configuration, firewall technology, and  vulnerability and compliance scanning. We also interviewed the CFPB  staff who manage these servers about these controls.

We conducted this performance audit from August 2013 to August 2014  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

section_title: Appendix II: List of Reports CFPB Prepared Using Collected Consumer Financial Data, as of July 15, 2014
subsections: section_title: Date of publication August 29, 2012
paragraphs: Use of consumer financial data   Loan-level origination information for all  educational loans of nine major lenders for  all loans that originated from 2005 through  2011. Analysis of the number of loan  originations and their associated interest  rates.

To compare credit scores sold  to creditors (lenders) and those  sold to consumers by  nationwide credit reporting  agencies and determine  whether differences between  those scores disadvantage  consumers.

Random sample of 200,000 consumer  credit reports from each of three  nationwide credit reporting agencies. Zip  code and age information allowed  comparison of scores by consumer  demographics.

To understand the payday loan  and deposit advance product  market and present facts  related to CFPB’s analysis of  these markets.

Sample of account- and loan- level data  from five to nine storefront payday lenders  and some depository institutions providing  deposit advance products.

To understand financial  institutions’ overdraft programs  for consumer checking  accounts.

Sample of consumer checking account and  transaction data from a sample of large  depository institutions.

To review the consumer credit  card market and the effect of  the CARD Act on the cost and  availability of credit and the  adequacy of protections relating  to credit card plans.

Credit card account data provided by  financial institutions submitting data to  CFPB and OCC.

To provide preliminary results  on the use of pre-dispute  arbitration contract provisions in  consumer financial products or  services.

More than 1,000 arbitration case records  from the American Arbitration Association  from January 2010 through 2012. Sample  of consumer credit records from CFPB’s  Consumer Credit Panel.

To describe patterns of  consumer borrowing after the  consumer obtains a payday  loan and use of consumer loan  products.

Same sample of data described in the April  2013 report above on payday loans and  deposit advances.

To review the use of medical  debt collections in credit scoring  models.

Sample of consumer credit files from  CFPB’s Consumer Credit Panel.

To discuss empirical research  about whether data on  remittance transfers can  enhance the credit scores of  consumers.

Random sample of consumer records,  provided by a large remittance transfer  provider and matched with credit records,  as well as a control sample of randomly  selected credit records.

The CARD Act originally directed the Federal Reserve to complete the biennial report, but the Dodd- Frank Act transferred this authority to CFPB.

section_title: Appendix III: Comments from the Consumer Financial Protection Bureau

section_title: Appendix IV: Comments from the Office of the Comptroller of the Currency

section_title: Appendix V: Comments from the National Credit Union Administration

section_title: Appendix VI: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Cody Goebel (Assistant Director),  Katherine Bittinger Eikel (Analyst-in-Charge), Edward R. Alexander, Jr.,  Rachel Batkins, Don Brown, William Chatlos, West Coile, Nathan  Gottfried, Fatima Jahan, Anjalique Lawrence, Bryan Maculloch, Marc  Molino, Patricia Moye, David Plocher, Barbara Roesmann, Maria Stattel,  Anne Stevens, Shaunyce Wallace, and Heneng Yu made significant  contributions to this report.


Question-summary annotations: questions: question: What has CFPB done to carry out its statutory responsibilities?
answer: To carry out its statutory responsibilities, the Consumer Financial Protection Bureau (CFPB) has collected consumer financial data on credit card accounts, mortgage loans, and other products through one-time or ongoing collections.
child_questions: question: How did these records vary?
answer: As the following table shows, these large-scale data collections varied from about 11,000 consumer arbitration case records from a trade association to 173 million mortgage loans from a data aggregator.

question: How did CFPB justify records identifying individual consumers?
answer: Of the 12 large-scale collections GAO reviewed, 3 included information that identified individual consumers, but CFPB staff indicated that those 3 were not subject to statutory restrictions on collecting such information.

question: What other organizations collect similarly large amounts of data?
answer: Other regulators, such as the Board of Governors of the Federal Reserve System (Federal Reserve) and the Office of the Comptroller of the Currency (OCC), collect similarly large amounts of data.

questions: question: What steps has CFPB taken to protect data collections?
answer: CFPB has taken steps to protect and secure these data collections. For example, it created a data intake process that brings together staff with relevant expertise to consider the statutory, privacy, and information security implications of proposed consumer financial data collections. CFPB staff described a process for anonymizing large-scale data collections that directly identify individuals.
child_questions: question: According to  the Office of Inspector General for the Federal Reserve, what else has CFPB done?
answer: In addition, CFPB had taken steps to implement an information security program that is consistent with Federal Information Security Management Act requirements, according to the Office of Inspector General for the Federal Reserve and CFPB.

question: What did GAO find in regards to vulnerabilities?
answer: GAO found that CFPB had implemented logical access controls for the information system that maintains the consumer financial data collections and was appropriately scanning for problems or vulnerabilities.

question: What kind of risk-management process did CFPB establish?
answer: CFPB also established a risk-management process for the information system that maintains consumer financial data consistent with guidelines developed by the National Institute of Standards and Technology (NIST).

questions: question: What does the CFPB lack?
answer: CFPB lacks written procedures and comprehensive documentation for a number of processes, including data intake and information security risk assessments.
child_questions: question: What issues could this cause?
answer: The lack of written procedures could result in inconsistent application of the established practices. For example, CFPB unnecessarily retained sensitive data in two collections GAO reviewed, but its staff said they plan to remove this information.

question: What does GAO recommend doing to amend this?
answer: GAO recommends CFPB establish or enhance written procedures for (1) data intake, including reviews of proposed data collections for compliance with applicable legal requirements and restrictions; (2) anonymizing data; (3) assessing and managing privacy risks; and (4) monitoring and auditing privacy controls; and (5) documenting results of information security risk-assessments consistently and comprehensively.

questions: question: What must agencies do under the PRA?
answer: Under the Paperwork Reduction Act (PRA), agencies generally must obtain Office of Management and Budget (OMB) approval when collecting data from 10 or more entities to minimize burden and maximize the practical utility of the information collected.

question: What do CFPB and OCC collect?
answer: CFPB and OCC collect, on an ongoing basis, credit card data from different institutions—representing about 87 percent of outstanding credit card balances—and agreed to share data.
child_questions: question: What might this collections process warrant?
answer: However, OMB staff said the agencies' collections and data-sharing agreement may warrant OMB review and approval.
child_questions: question: How might OMB review and approval be beneficial?
answer: Additional consultation with OMB regarding these collections and the data-sharing agreement would help both agencies ensure they are fully complying with the law.

question: What issues might lack of OMB approval cause?
answer: Furthermore, OCC had not obtained OMB approval for its credit card and mortgage data collections, which each included more than nine entities. Without approval, OCC lacks reasonable assurance that its collections comply with PRA requirements intended to reduce burden.

question: What does GAO recommend?
answer: GAO recommends (1) CFPB consult further with OMB about its credit card collection and data-sharing agreement, and (2) OCC seek OMB approval for its credit card and mortgage data collections.

questions: question: Why did Congress create CFPB in 2010?
answer: Congress created CFPB in 2010 as an independent agency to regulate the provision of consumer financial products and services, such as mortgages and student loans.
child_questions: question: How has CFPB started to regulate the provision of these products and services?
answer: CFPB has begun collecting consumer financial data from banks, credit unions, payday lenders, and other institutions.

question: What was GAO asked to examine?
answer: GAO was mandated to examine CFPB's collection of consumer financial data.

question: What does this report address?
answer: This report addresses (1) the scope, purposes, uses, and authorities of CFPB consumer financial data collections and (2) CFPB's compliance with laws and federal requirements, including government-wide privacy and information security requirements.