The Dodd-Frank Act transferred consumer protection oversight and other authorities over certain consumer financial protection laws from multiple federal regulators to CFPB, creating a single federal entity to, among other things, ensure consistent enforcement of federal consumer financial laws. The Dodd-Frank Act charged CFPB with the following responsibilities, among others: ensuring that consumers are provided with timely and understandable information to make responsible decisions about financial transactions; ensuring that consumers are protected from unfair, deceptive, or abusive acts and practices, and from discrimination; monitoring compliance with federal consumer financial law and taking appropriate enforcement action to address violations; identifying and addressing outdated, unnecessary, or unduly burdensome regulations; ensuring that federal consumer financial law is enforced consistently, without regard to the status of a person as a depository institution, in order to promote fair competition; ensuring that markets for consumer financial products and services operate transparently and efficiently to facilitate access and innovation; and conducting financial education programs. Furthermore, the Dodd-Frank Act gave CFPB supervisory authority over certain nondepository institutions, including certain kinds of mortgage market participants, private student lenders, and payday loan lenders.Such institutions generally lacked federal oversight before the financial crisis of 2007-2009. The Dodd-Frank Act grants CFPB certain authorities that govern its collection of consumer financial data. The act also includes certain restrictions on CFPB’s collection and use of personally identifiable financial information and requirements to ensure that CFPB protects such data. The primary authorities and related restrictions we examined are included in three sections of the act: Market monitoring. Under section 1022(c), CFPB is directed to monitor for risks to consumers in the offering or provision of consumer financial products or services, including developments in consumer financial markets for such products or services, in order to support its rulemaking and other functions. The act provides CFPB with the authority, in conducting such monitoring, to gather information from time to time regarding the organization, business conduct, markets, and activities of covered persons and service providers, from a variety of sources, including several sources specified in the act. Under this data collection authority, CFPB is prohibited from obtaining records from covered persons and service providers participating in consumer financial services markets for the purposes of gathering or analyzing the personally identifiable financial information of consumers. Supervision of nondepository covered persons. Section 1024 provides CFPB with the authority to supervise entities (other than depository institutions or insured credit unions) that provide certain consumer financial products or services. This authority also extends to service providers.these entities comply with federal consumer financial laws and obtaining information about their activities and compliance systems or procedures, this section charges CFPB with requiring reports and conducting examinations of the nondepository persons the section covers for purposes of detecting and assessing associated risks to consumers and markets for consumer financial products and In addition to assessing the extent to which services.CFPB’s ability to collect personally identifiable financial information. Section 1024 does not contain any explicit restrictions on Supervision of large institutions and affiliates. Section 1025 of the Dodd-Frank Act provides CFPB with supervisory authority over insured depository institutions and credit unions with assets of more than $10 billion and their affiliates, including the authority to collect information from them for purposes of detecting and assessing associated risks to consumers and to markets for consumer financial products and services. CFPB also has some supervisory authority under section 1025 over service providers of insured depository institutions and credit unions with over $10 billion in assets, as well as service providers to a substantial number of insured depository institutions or credit unions with $10 billion or less in assets. Section 1025 does not contain any explicit restrictions on CFPB’s ability to collect personally identifiable financial information. The Dodd-Frank Act also contains additional restrictions on CFPB’s ability to collect consumer financial data and includes requirements on how such data must be protected once they are collected. The act requires CFPB to take steps to ensure that certain information, including personal information, is not disclosed to the public when such information is protected by law. In addition, CFPB must not obtain personally identifiable financial information about consumers from the financial records of covered persons or service providers, unless consumers provide written permission, or other legal provisions specifically permit or require such collections. CFPB interacts with other financial regulators that also collect consumer financial data and have responsibility for overseeing federal consumer financial laws. These agencies include the four prudential regulators that supervise depository institutions for safety and soundness of their financial condition: OCC charters and supervises national banks and federal thrifts; the Federal Reserve supervises state-chartered banks that opt to be members of the Federal Reserve System, bank holding companies, thrift holding companies, the nondepository institution subsidiaries of those institutions, and nonbanks designated as significantly important by the Financial Stability Oversight Council; FDIC supervises FDIC-insured state-chartered banks that are not members of the Federal Reserve System and federally insured state savings banks and thrifts; insures the deposits of all banks and thrifts approved for federal deposit insurance; and resolves by sale or liquidation all failed insured banks and thrifts and certain nonbank financial companies; and NCUA charters and supervises federally chartered credit unions and insures savings in federally and most state-chartered credit unions. As part of their overall supervision programs, the prudential regulators have consumer compliance examination authority for insured depository institutions with $10 billion or less in assets and CFPB is required to coordinate its supervisory activities with the supervisory activities of the prudential regulators for insured depository institutions with more than $10 billion in assets. Most of the depository institutions CFPB supervises for consumer protection are supervised for safety and soundness by OCC, the Federal Reserve, or FDIC and at a holding company level by the Federal Reserve. The Dodd-Frank Act requires CFPB to coordinate its supervisory actions and examinations of large depository institutions with the prudential regulators. Various other federal requirements apply to CFPB and other federal agencies’ data collection activities. The Paperwork Reduction Act (PRA) requires agencies to obtain OMB approval for identical collections of information from 10 or more individuals or entities. For data collections meeting the criteria of the act, agencies must seek public comment in the Federal Register and consult with the public and affected agencies on ways to minimize the burden associated with information collections and other issues. The general purposes of PRA include minimizing the federal paperwork burden for individuals, small businesses, state and local governments, and other persons; minimizing the cost to the federal government of collecting, maintaining, using, and disseminating information; and maximizing the usefulness of information collected by the federal government. The Office of Information and Regulatory Affairs within OMB provides oversight over federal data collections and PRA compliance. Privacy Act of 1974, Pub. L. No. 93-579, 88 Stat. 1896 (1974) (codified as amended at 5 U.S.C. § 552a); E-Government Act of 2002, Pub. L. No. 107-347, 116 Stat. 2899 (2002). safeguards to ensure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity that could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained. The Privacy Act also requires agencies to notify the public in the Federal Register when they establish or make changes to a system of records. Among the things this notice must identify are: the categories of data collected; the categories of individuals about whom information is collected; the intended “routine” uses of data; and procedures that individuals can use to review and correct information about them. The privacy provisions of the E-Government Act of 2002 require that agencies conduct privacy impact assessments before developing, using, or contracting for an information security system that contains personal information. These assessments are analyses of how personal information is collected, stored, shared, and managed in a federal system. According to OMB guidance, the purpose of such assessments is to (1) ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (3) examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. Title III of the E-Government Act, known as the Federal Information Security Management Act of 2002 (FISMA), established a framework designed to ensure the effectiveness of security controls of information and information systems that support federal operations and assets. This includes the information and information systems that are provided or managed by another agency, contractor, or other source (known as third- party providers). FISMA assigns specific responsibilities to the head of an agency to provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency. FISMA also states that agencies are to develop, document, and implement an agency-wide information security program.