Disclosure of Consumer Complaint Narrative Data, 15572-15583 [2015-06722]

Agencies

• BUREAU OF CONSUMER FINANCIAL PROTECTION

[Federal Register Volume 80, Number 56 (Tuesday, March 24, 2015)]
[Notices]
[Pages 15572-15583]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2015-06722]


=======================================================================
-----------------------------------------------------------------------

BUREAU OF CONSUMER FINANCIAL PROTECTION

[Docket No. CFPB-2014-0016]


Disclosure of Consumer Complaint Narrative Data

AGENCY: Bureau of Consumer Financial Protection.

ACTION: Final Policy Statement.

-----------------------------------------------------------------------

SUMMARY: The Bureau of Consumer Financial Protection (the ``Bureau'') 
is issuing a final policy statement (``Final Policy Statement'') to 
provide guidance on how the Bureau plans to exercise its discretion to 
disclose publicly unstructured consumer complaint narrative data 
(``narratives'' or ``consumer narratives'') via its web-based, public 
facing database (the ``Consumer Complaint Database'' or ``Database''). 
Only those narratives for which opt-in consumer consent is obtained and 
a robust personal information scrubbing standard and methodology 
applied will be eligible for disclosure. The Final Policy Statement 
supplements and amends the Bureau's existing policy statements 
establishing and expanding the Consumer Complaint Database.\1\
---------------------------------------------------------------------------

    \1\ Disclosure of Certain Credit Card Complaint Data, 77 FR 
37558 (June 22, 2012) (``2012 Notice of Final Policy Statement''); 
Disclosure of Consumer Complaint Data, 78 FR 21218 (Apr. 10, 2013) 
(``2013 Notice of Final Policy Statement'').

DATES: Applicability date: The Bureau will not publish any consented-to 
narrative for at least 90 days after publication in the Federal 
---------------------------------------------------------------------------
Register.

FOR FURTHER INFORMATION CONTACT: Scott Pluta, Assistant Director, 
Office of Consumer Response, Bureau of Consumer Financial Protection, 
at (202) 435-7306.

SUPPLEMENTARY INFORMATION: 

    Authority:  12 U.S.C. 5492(a), 5493(b)(3), (d), 5496(c)(4), 
5511(b), (c), 5512, 5534(a), (b).

I. Overview

A. Final Policy Statement

    Under the Final Policy Statement, the Bureau extends its existing 
practice of disclosing data associated with consumer complaints via the 
Consumer Complaint Database to include narratives for which opt-in 
consumer consent is obtained and a robust personal information 
scrubbing standard and methodology has been applied. The purposes of 
the Consumer Complaint Database include providing consumers with timely 
and understandable information about consumer financial products and 
services, and improving the functioning, transparency, and efficiency 
of markets for such products and services. The Bureau believes that 
adding additional information to the Consumer Complaint Database, here 
narratives and structured company responses, is consistent with and 
promotes these purposes.

II. Background

A. Complaint System

    In the Bureau's previous notices of its policy statements, 
establishing and expanding the Consumer Complaint Database, the Bureau 
generally described how the Office of Consumer Response (``Consumer 
Response'') handles consumer complaints (collectively the ``Complaint

[[Page 15573]]

System'').\2\This Final Policy Statement does not affect how a 
consumer's complaint is substantively handled by the Bureau. Consumer 
Response screens all complaints submitted by consumers based on several 
criteria, including whether the complaint should be routed to another 
regulator and whether the complaint is complete. Screened complaints 
are forwarded via a secure web portal to the appropriate company. The 
company then has 15 calendar days to provide an initial response and up 
to 60 calendar days to provide a final response. Companies have the 
ability within these timeframes to respond administratively to the 
Bureau, e.g., responding that no commercial relationship exists between 
the complaining consumer and the company in question. Typically, the 
company reviews the complaint, communicates with the consumer as 
needed, and determines what action to take in response. After the 
company responds to the consumer and the Bureau via the secure company 
portal, the Bureau invites the consumer to review the response and 
provide feedback. Some complaints are individually reviewed by Consumer 
Response investigations staff. All complaints are subject to follow-up 
and further investigation by Consumer Response and other parts of the 
Bureau.\3\
---------------------------------------------------------------------------

    \2\ 2012 Notice of Final Policy Statement, 77 FR at 37559 (June 
22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21219 
(April 10, 2013).
    \3\ The Complaint System is described in more detail in the 2013 
Consumer Response Annual Report (March 31, 2014) at: https://www.consumerfinance.gov/reports/2013-consumer-response-annual-report./
---------------------------------------------------------------------------

    The Bureau makes publicly available some data it collects as part 
of its complaint handling function, while continually striving to 
protect the sensitive information contained within that data. One way 
the Bureau currently accomplishes this is by sharing some fields from 
de-identified individual-level complaint data with the public through 
the Consumer Complaint Database. The Database was launched on June 19, 
2012. It was initially populated with credit card complaint data but 
has since been expanded to include complaint data about other products, 
e.g., mortgages, bank accounts and services, student loans, vehicle and 
other consumer loans, credit reporting, money transfers, debt 
collection, payday loans, and prepaid cards. Data from complaints are 
disclosed in the Database the earlier of: (1) An initial response to 
the consumer and the Bureau (confirming a commercial relationship with 
the consumer) or (2) 15 calendar days after the complaint was sent to 
the company. Data from a complaint is not published in the Database if, 
among other reasons, the company suspects the complaint was submitted 
in furtherance of a fraud or it indicates to the Bureau that it does 
not have a commercial relationship with the consumer.

B. Overview of Public Comments

    In its Proposed Policy Statement Regarding Disclosure of 
Unstructured Narrative Data From Consumer Complaints and Company 
Responses (``Proposed Policy Statement''), the Bureau proposed 
expanding its Consumer Complaint Database to include narratives 
submitted by consumers as well as public-facing narrative responses 
from companies.\4\ The Bureau received 137 unique comments from, among 
others, consumer groups, trade associations, companies, and 
individuals. In some cases, several organizations jointly submitted a 
single comment letter. One financial reform organization, Americans for 
Financial Reform (``AFR''), submitted a single set of comments on 
behalf of 49 consumer, civil rights, privacy, and open government 
groups.\5\ The Bureau reviewed unique comments from 39 individuals, as 
well as substantially identical comment letters from approximately 
30,000 individuals expressing support for the Proposed Policy 
Statement.
---------------------------------------------------------------------------

    \4\ Disclosure of Consumer Complaint Narrative Data, 79 FR 
42765, 42767 (July 23, 2014).
    \5\ This group included: Americans for Financial Reform; 
Alliance for a Just Society; Arkansas Community Organization; 
California Reinvestment Coalition; Connecticut Citizen Action Group; 
Center for Digital Democracy; Center for Responsible Lending; 
Community Legal Services, Philadelphia; Connecticut Fair Housing 
Center; Consumer Action; Consumer Federation of America; Consumers 
for Auto Reliability and Safety; Consumer Watchdog; Demos; 
Electronic Privacy Information Center; Empire Justice Center; 
Florida Alliance for Consumer Protection; Home Defenders League; 
International Union, United Automobile, Aerospace & Agricultural 
Implement Workers of America (UAW); Keystone Progress; Leadership 
Conference on Civil and Human Rights; Massachusetts Consumers' 
Coalition; MASSPIRG; Miami Valley Fair Housing Center, Dayton, Ohio; 
Missourians Organizing for Reform and Empowerment; NAACP; National 
Association of Consumer Advocates; National Consumer Law Center (on 
behalf of its low income clients); National Council of La Raza; 
National Fair Housing Alliance; National People's Action; New 
Economy Project; New Jersey Citizen Action; New Jersey Communities; 
United Oregon Consumer League; Privacy Rights Clearinghouse; Privacy 
Times; Project on Government Oversight; Public Citizen; Public 
Justice Center; South Carolina Appleseed Legal Justice Center; 
Southwest Center for Economic Integrity; Texas Legal Services 
Center; The Institute for College Access and Success; U.S.PIRG; 
Virginia Citizens Consumer Council; Woodstock Institute; and the 
World Privacy Forum.
---------------------------------------------------------------------------

    Commenters provided feedback on numerous aspects of the Proposed 
Policy Statement. Almost all comments concerned the expansion of the 
Database to include narratives. Companies and their trade associations 
generally opposed the inclusion of narratives in the Database. Many 
industry commenters asserted that the publication of ``unverified'' 
consumer narratives would unfairly damage the reputations of companies. 
Several trade associations also commented that inclusion of 
unstructured narratives is contrary to the Bureau's stated mission of 
being data-driven.
    Per the AFR's comment letter, consumer, civil rights, privacy, and 
open government groups supported the inclusion of narratives, asserting 
that among other things narratives would: ``(1) Empower consumers with 
timely, valuable information pre-purchase, in order to prevent problems 
and reward companies that respect their customers, and post-purchase, 
in order to report unreasonable, unfair or deceptive practices and 
alert others in advance of problems; (2) allow others to assist the 
Bureau in detecting destructive patterns before they do extensive 
damage; and (3) encourage more people to use the Database, as it 
becomes a more useful tool, creating a cycle of increased information 
about consumer experiences in the financial services marketplace.'' 
These groups and individual commenters endorsed the goals underlying 
the publication of consumer narratives.
    Several commenters focused on normalization, or the use of some 
metric to provide context for data, for example, by including 
information on the number of accounts a company has for each particular 
product or service. Some industry commenters noted the risk of 
potential consumer re-identification and the impact certain laws may 
have on a company's ability to respond publicly to a consumer's 
complaint. Both trade associations and consumer groups submitted 
written comments advising the Bureau to be mindful of the privacy risks 
associated with narrative publication. Nonetheless, four nationally 
recognized privacy groups--Electronic Privacy Information Center, 
Privacy Rights Clearinghouse, Privacy Times, and World Privacy Forum--
signed AFR's comment letter in support of the Proposed Policy 
Statement. Additionally, Privacy Rights Clearinghouse submitted an 
individual comment generally supportive of disclosing narratives.
    Many submissions included comments directed to the Bureau's method 
of processing consumer

[[Page 15574]]

complaints, i.e., the Complaint System. To the extent that these 
comments also related to the scope of the Proposed Policy Statement, 
the Bureau addresses them below. Whether addressed below or not, the 
Bureau welcomes operational feedback and intends to continue to refine 
its Complaint System over time.\6\
---------------------------------------------------------------------------

    \6\ Consumer Response maintains several feedback mechanisms for 
participants in the Complaint System and has plans to expand this 
capability over time.
---------------------------------------------------------------------------

III. Summary of Comments Received, Bureau Responses, and Resulting 
Policy Statement Changes

    This section provides a summary of the comments received by subject 
matter to the Proposed Policy Statement. It also summarizes the 
Bureau's assessment of the comments by subject matter and, where 
applicable, describes the resulting changes that the Bureau is making 
in the Final Policy Statement including a change to how companies may 
respond publicly to individual complaints. All such changes concern the 
Consumer Complaint Database. There are no policy changes regarding the 
Bureau's issuance of its own complaint data reports, e.g., the Consumer 
Response Annual Report.

A. The Policy Statement Process

    The Bureau is committed to transparency and robust engagement with 
the public regarding its actions. Although not required by law to do 
so, the Bureau voluntarily solicited and received public comments on 
the Proposed Policy Statement. A few commenters requested a 60-day 
response period as opposed to the 30 days originally provided, a 
request the Bureau granted.\7\ The Bureau received substantial public 
feedback expressing a range of viewpoints, and it has carefully 
considered the comments received, as described in detail below. As 
stated in the Final Policy Statement, the Bureau plans to monitor the 
effectiveness of its policy on an ongoing basis and to continue to 
engage with the public, including regulated entities, as it assesses 
the efficacy of the Final Policy Statement.
---------------------------------------------------------------------------

    \7\ Disclosure of Consumer Complaint Narrative Data, 79 FR 45183 
(Aug. 4, 2014).
---------------------------------------------------------------------------

    Several commenters commended the Bureau on providing the 
opportunity to comment on the Proposed Policy Statement. A number of 
trade associations commented that the proposal could not be finalized 
in a general statement of policy and was instead a binding legislative 
rule subject to the procedural requirements of notice and comment 
rulemaking.\8\ Several of these groups argued that rulemaking was 
required because the policy would obligate companies to provide public 
responses or else suffer reputational harm from unanswered complaint 
narratives. Some groups stated that the policy would impose new duties 
on the Bureau to verify the details contained in the narratives or to 
protect consumer privacy by removing information that could lead to 
consumer re-identification. Two groups commented that Sec.  
1022(c)(6)(A) of the Dodd-Frank Act, which requires the Bureau to issue 
rules concerning the confidential treatment of information, dictates 
that any decision involving confidential information has to be enacted 
as a legislative rule.\9\ These groups also commented that the proposal 
would effectively amend the Bureau's existing privacy regulations by 
releasing confidential information and therefore had to be enacted 
through notice and comment. Two groups pointed to the example of the 
Consumer Product Safety Commission, which provided details about its 
statutorily mandated database of consumer product safety complaints via 
a legislative rule. The groups argued that the Bureau was required to 
follow the same process in announcing this policy. Finally, several of 
these groups suggested that the importance of releasing consumer 
narratives or the interest in transparency meant that full notice and 
comment procedures were required.
---------------------------------------------------------------------------

    \8\ The Administrative Procedure Act exempts general statements 
of policy from notice and comment. 5 U.S.C. 553(b)(A).
    \9\ 12 U.S.C. 5512(c)(6)(A).
---------------------------------------------------------------------------

    The Final Policy Statement is meant to inform the public about the 
Bureau's intended use of its discretionary authority to release certain 
de-identified information. The planned addition of narratives to the 
Consumer Complaint Database is properly the subject of a policy 
statement and does not require formal rulemaking.\10\ The Bureau has 
made minor changes to the Final Policy Statement to clarify its nature 
as a general statement of policy. The policy neither binds private 
parties with any legal responsibilities nor creates any legal rights. 
As the Final Policy Statement makes clear, companies are under no 
obligation to recommend public-facing responses and will face no legal 
consequences by declining to do so. That some companies may decide it 
is worthwhile to recommend a public response does not rise to the level 
of a legal obligation.\11\ For their part, consumers are under no 
obligation to opt in to sharing their stories, as the consent language 
will make clear by stating that the decision whether to provide consent 
for public disclosure does not otherwise affect how the Bureau handles 
the complaint.
---------------------------------------------------------------------------

    \10\ To the extent any features of this policy were considered 
binding on any party, the Bureau believes they would constitute 
procedural rules, which are likewise exempt from the requirements of 
notice and comment. 5 U.S.C. 553(b)(A).
    \11\ See Ctr. for Auto Safety v. Nat'l Highway Traffic Safety 
Admin., 452 F.3d 798 (D.C. Cir. 2006) (agency's general statement of 
policy was not a binding legislative rule simply because it had 
practical effects, rather than legal consequences, for private 
parties). Several commenters rely on Electronic Privacy Information 
Center v. Department of Homeland Security, 653 F.3d 1 (D.C. Cir. 
2011), but the Bureau does not believe that case supports their 
argument. The agency action in that case, in the court's view, 
imposed legally binding requirements on airline passengers to go 
through heightened security procedures or be barred from entering 
airport boarding areas. The opportunity to provide a public response 
narrative does not impose any similar binding requirement.
---------------------------------------------------------------------------

    The Bureau is also not binding itself with new legal duties. As 
explained below, the Bureau is not committing to verify the details 
contained in each complaint narrative. Although the Bureau plans to 
scrub identifying information from the consumer narratives, it intends 
to do so in order to assist consumers and ensure its compliance with 
existing laws, rather than through the assumption of such a duty 
through the present Final Policy Statement. The addition of narratives 
to the Consumer Complaint Database is also in keeping with the Bureau's 
stated intent to continue refining the way it receives, shares, and 
makes use of consumer complaint information as well as with its past 
practice of making improvements to the Database.\12\ As part of 
advancing that effort, and in response to comments it received in 
response to the Proposed Policy Statement, the Bureau is also 
publishing a Request for Information on how it might create or enhance 
opportunities for consumers to share accounts of positive experiences 
they have had with providers of consumer financial products and 
services.
---------------------------------------------------------------------------

    \12\ See 2013 Notice of Final Policy Statement, 78 FR at 21226 
(announcing planned changes to Public Complaint Database and stating 
Bureau's intention to study and solicit further public feedback on 
the efficacy of its complaint policies)(April 10, 2013); 2012 Notice 
of Final Policy Statement, 77 FR at 37568 (same)(June 22, 2012).
---------------------------------------------------------------------------

    The suggestion that Sec.  1022(c)(6)(A) requires the Bureau to 
finalize this policy as a legislative rule is unpersuasive. That 
provision mandates that the Bureau ``prescribe rules regarding the 
confidential treatment of information'' it obtains in exercising its 
authorities. The Bureau has previously prescribed rules regarding the

[[Page 15575]]

confidential treatment of information.\13\ The disclosure contemplated 
by this policy is consistent with those rules, and therefore does not 
require an amendment to those rules. Finally, as noted previously, 
several commenters contend that the past practice of the Consumer 
Product Safety Commission, the general interest in transparency, or the 
importance of releasing consumer narratives require the Bureau to 
proceed via legislative rulemaking. None of these factors provides a 
legal basis for concluding that notice and comment rulemaking is 
required under the Administrative Procedure Act. The Bureau also notes 
that it has made the policy process transparent by voluntarily 
soliciting public comment and extending the comment period from 30 to 
60 days.
---------------------------------------------------------------------------

    \13\ Disclosure of Records and Information, 78 FR 11484 (Feb. 
15, 2013).
---------------------------------------------------------------------------

B. Legal Authority for Consumer Complaint Database

    In the Bureau's previous notices of its policy statements 
establishing and expanding the Consumer Complaint Database, the Bureau 
addressed in detail several comments related to the Bureau's authority 
to establish a Database.\14\ Several comments in response to the 
Proposed Policy Statement implicate the same or similar arguments 
concerning the Bureau's legal authority. The Bureau directs readers to 
and incorporates its prior discussions, and clarifies portions here.
---------------------------------------------------------------------------

    \14\ 2012 Notice of Final Policy Statement, 77 FR at 37560-61 
(June 22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 
21220 (April 10, 2013).
---------------------------------------------------------------------------

    As was true with respect to the Bureau's prior two policy 
statements, commenters contend that the Dodd-Frank Act expressly 
delineates the circumstances and manner in which the Bureau may 
collect, resolve, and share consumer complaints with others, and that a 
public-facing database is not explicitly included. Therefore, by 
adverse inference, they assert that the Dodd-Frank Act does not 
authorize the Database.
    Similarly, as was true with respect to the Bureau's prior policy 
statements, commenters argue that Sec.  1034 of the Dodd-Frank Act, 
which requires the Bureau to establish ``reasonable procedures to 
provide a timely response to consumers . . . to complaints against, or 
inquiries concerning, a covered person,'' \15\ does not authorize the 
creation of a public-facing complaint database that, instead of aiding 
complainants, enables data mining and market research. Commenters also 
make arguments, similar to past comments, that Sec.  1021 and Sec.  
1022 do not expressly grant authority for the Bureau to establish a 
public-facing database or disclose consumer complaint narratives to the 
public.\16\ They also contend that the Dodd-Frank Act's restrictions on 
publishing confidential information block the implementation of such a 
database, including narratives.
---------------------------------------------------------------------------

    \15\ 12 U.S.C. 5534(a).
    \16\ Two commenters point to American Petroleum Institute v. 
SEC, 953 F. Supp. 2d 5 (D.D.C. 2013), in support of the argument 
that the Bureau lacks authority for the Database. In that case, the 
SEC contended that a statutory provision unambiguously required 
public disclosure of certain annual reports from regulated entities. 
The court held that the provision did not unambiguously require 
public disclosure and that the SEC had improperly cabined its 
discretion. Id. at 12-18. The Bureau believes American Petroleum 
Institute does not suggest the Bureau lacks authority to disclose 
consumer complaint narratives. That case addressed statutory 
provisions not at issue here. Moreover, the Bureau acknowledges its 
discretion with respect to the public disclosure described in the 
Policy Statement, and it does not believe that such disclosure is 
unambiguously required under the statute.
---------------------------------------------------------------------------

    The Bureau has considered these comments and concluded that the 
Database is authorized by the Dodd-Frank Act. Among other things, Sec.  
1013(b)(3) authorizes the establishment of a unit ``whose functions 
shall include establishing a single, toll-free telephone number, a Web 
site, and a database or utilizing an existing database to facilitate 
the centralized collection of, monitoring of, and response to consumer 
complaints regarding consumer financial products or services.'' \17\ 
Section 1034(a) directs the Bureau to establish ``reasonable procedures 
to provide a timely response to consumers, in writing where 
appropriate, to complaints against, or inquiries concerning, a covered 
person . . .,'' and Sec.  1034(b) provides that ``[a] covered person 
subject to supervision and primary enforcement by the Bureau pursuant 
to section 1025 shall provide a timely response, in writing where 
appropriate, to the Bureau, the prudential regulators, and any other 
agency having jurisdiction over such covered person concerning a 
consumer complaint or inquiry. . . .''\18\ These provisions require and 
establish conditions for specific methods of disclosure and responses, 
but do not express or imply any limit on the Bureau's authority to 
disclose consumer complaint information in other ways. The Database as 
described would facilitate and supplement, not contravene, these 
provisions. The Database is reasonably encompassed within the Bureau's 
authorities, especially in light of the Bureau's other statutory 
objectives and functions, including promoting financial education, 
providing timely information, and ensuring that markets operate 
transparently.\19\ In addition, with prescribed limitations, the Bureau 
has broad discretionary authority to release information obtained 
during the exercise of its statutory functions and the Database, as 
described in the Proposed Policy Statement, would not contravene any 
legal constraints on the Bureau.
---------------------------------------------------------------------------

    \17\ 12 U.S.C. 5493(b)(3)(A).
    \18\ 12 U.S.C. 5534(a) & (b).
    \19\ 12 U.S.C. 5511.
---------------------------------------------------------------------------

    Publication of such information would also be authorized by the 
Bureau's express authority pursuant to Sec.  1022 to make certain 
information, including information from consumer complaints, public: 
Section 1022(c)(3)(B) states that the Bureau ``may make public such 
information obtained by the Bureau under this section as is in the 
public interest, through aggregated reports or other appropriate 
formats designed to protect confidential information in accordance with 
paragraphs (4), (6), (8), and (9).'' \20\ This subparagraph permits the 
Bureau to disclose consumer complaint information in a non-aggregated 
format as long as the format is designed to protect confidential 
information in accordance with other specific provisions of Sec.  
1022(c). The Database would satisfy those criteria.
---------------------------------------------------------------------------

    \20\ 12 U.S.C. 5512(c)(3)(B) (emphasis added).
---------------------------------------------------------------------------

    The disclosure of information contemplated by this policy is also 
consistent with subpart D of the Bureau's Final Rule on the Disclosure 
of Records and Information,\21\ which the Bureau promulgated pursuant 
to Sec.  1022(c)(6). Commenters are correct to point out that subpart D 
generally restricts the authority of the Bureau to publicly disclose 
``confidential information,'' including ``confidential consumer 
complaint information.'' \22\ However, such disclosure restrictions 
only apply to the extent that consumer complaint information is 
confidential in nature. The Bureau's regulations define ``confidential 
consumer complaint information'' to mean ``information received or 
generated by the [Bureau], pursuant to [sections 1013 and 1034 of the 
Dodd-Frank Act], that comprises or documents consumer complaints or 
inquiries concerning financial institutions or consumer financial 
products and services and responses thereto, to the extent that such 
information is exempt from disclosure

[[Page 15576]]

pursuant to 5 U.S.C. 552(b) [FOIA].'' \23\Because the information to be 
disclosed in the public database is disclosed with the consumer's 
express consent and not exempt from disclosure under FOIA, such 
information does not constitute ``confidential consumer complaint 
information.'' Accordingly, Sec.  1022(c)(6)(A)'s grant of authority to 
issue rules regarding when the Bureau will treat information 
confidentially does not limit the Bureau's discretion to disclose 
information consistent with those rules, but provides further authority 
for the policy.
---------------------------------------------------------------------------

    \21\ 12 CFR 1070.40 through 1070.47.
    \22\ 12 CFR 1070.41 (prohibiting Bureau employees from 
disclosing confidential information other than as provided in 
subpart D); 12 CFR 1070.2 (defining ``confidential information'' to 
include ``confidential consumer complaint information'').
    \23\ 12 CFR 1070.2(g).
---------------------------------------------------------------------------

    Furthermore, the Bureau intends to obtain consent from consumers to 
publish their complaint narratives. Obtaining written consent for 
disclosure aligns with requirements of 1022(c)(8), FOIA, the Privacy 
Act, and the Bureau's confidentiality rules. The Bureau does not intend 
to release a narrative until the consumer expressly consents to 
publication and the Bureau has determined that the narrative has been 
de-identified according to a robust scrubbing standard.

C. The Impact of the Disclosure of Consumer Complaint Narratives on 
Consumers

    Comments from consumer groups, open government groups, privacy 
groups, and individual commenters asserted that the publication of 
narratives would empower consumers to better understand the context of 
the data currently provided in the Consumer Complaint Database. The 
Reporters Committee for Freedom of the Press, on behalf of nine major 
news organizations and press trade associations, supported the 
publication of all narratives regardless of consent, stating that the 
Database is an invaluable resource for journalists as the experiences 
reflected in the narratives contribute to the public's understanding of 
the relationships between consumers and financial institutions and 
inform the ongoing democratic debate regarding financial regulation. 
Consumer groups added that consumer narratives would be a valuable 
resource for researchers to identify trends in the business practices 
of companies, particularly as they relate to traditionally underserved 
consumers.
    Some commenters noted that narratives would encourage companies to 
address the sources of common complaints. Consumer groups stated that 
the publication of narratives would allow companies to better compete 
through customer service, further increasing the improvement in 
customer care resulting from the introduction of the Database. Other 
consumer groups commented that narratives would aid consumer advocacy 
and legal aid groups in serving their communities by helping to 
identify local trends.
    Industry commenters, by contrast, asserted that the publication of 
narratives in the Database would mislead consumers because the data is, 
in the commenters' words, unverified and unrepresentative. And despite 
the fact that the Bureau confirms the existence of a commercial 
relationship before publishing complaints, multiple commenters 
expressed concern that complaints, and thus narratives, from 
individuals without a commercial relationship with the relevant company 
would appear in the Database.
    In general, the Bureau believes that greater transparency of 
information does tend to improve customer service and identify patterns 
in the treatment of consumers, leading to stronger compliance 
mechanisms and customer service. These have been features of the 
Consumer Complaint Database since its inception. In addition, 
disclosure of consumer narratives will provide companies with greater 
insight into issues and challenges occurring across their markets, 
which can supplement their own company-specific perspectives and lend 
more insight into appropriate practices. Other issues raised in the 
comments received by the Bureau are addressed below.
1. Consumer Narratives
a. Verification
    In its 2012 Notice of Final Policy Statement, the Bureau addressed 
several comments related to the disclosure of unverified consumer 
complaints. In response to the Proposed Policy Statement, several trade 
associations and companies continued to express concern, stating that 
unverified complaint narratives are likely to mislead consumers. Some 
trade associations suggested that the Bureau should only disclose 
narratives after a substantive investigation by the Bureau had been 
completed on that particular complaint. Some industry comments 
recommended distinguishing between unverified and verified complaints. 
Consumer groups and privacy groups, on the other hand, commented that 
the lack of verification presented minimal risk of misleading 
consumers.
    The Bureau incorporates its previous statements and analysis on 
this issue.\24\ The Bureau acknowledges that the Complaint System does 
not adjudicate the merits of each individual complaint disclosed in the 
Consumer Complaint Database, specifically stating on the Bureau's Web 
site that it does not ``verify the accuracy of all facts alleged in 
complaints.'' However, the Bureau does screen each complaint according 
to various criteria. The complaint is reviewed to determine whether it 
should be routed to another regulator. A determination is made whether 
each submission is a complaint, an inquiry, or feedback. Submissions in 
the latter two categories are not forwarded to the identified company 
for handling as complaints. Importantly, the commercial relationship 
between the company and the consumer is verified before disclosing it 
in the Database. The Bureau also verifies that the complaint is 
submitted by the identified consumer or by his or her specifically 
authorized representative before disclosure in the Database. Lastly, 
complaints are only forwarded to companies when they contain the 
required fields, including the complaint narrative, the consumer's 
requested resolution, and the consumer's contact information. The 
Bureau believes that with the information currently made public, 
supplemented by the contextual richness of the de-identified 
narratives, the public and the marketplace will have the capacity to 
assess all the data with the appropriate level of confidence.
---------------------------------------------------------------------------

    \24\ 2012 Notice of Final Policy Statement, 77 FR at 37561 (June 
22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21221 
(April 10, 2013).
---------------------------------------------------------------------------

b. Manipulation
    Several trade associations and companies commented that third 
parties like debt negotiation companies could use complaint submission 
as a strategic tool to unfairly aid their clients. A company commenter 
claimed that at least one outside party has been using the company's 
name unlawfully to defraud consumers, and that several complaints have 
been mistakenly lodged against the company as a result. Specifically, a 
third party was contacting consumers under the name of the other 
company to collect money and defraud consumers, and subsequently, 
several consumers lodged complaints against the other company.
    The Complaint System has a number of protections against 
manipulation. These protections were addressed in the 2012 Notice of 
Final Policy Statement.\25\ For example, while the process of 
submitting a complaint is designed to be user-friendly and 
straightforward, it does require deliberate action and a moderate time 
commitment by the consumer. According to the Bureau's

[[Page 15577]]

own calculations, the average amount of time required to complete a 
complaint submission via the Web site is eight minutes. Consumers must 
also affirm to the government that the information they provide is true 
to the best of their knowledge and belief. Again, the commercial 
relationship between the consumer and company is confirmed by the 
company before any complaint data is disclosed in the Consumer 
Complaint Database. With regard to the example provided regarding 
fraudulent use of a company's identity: (1) Companies have the ability 
to alert the Bureau via an administrative response of any suspected 
fraud; (2) if properly identified by the company, such complaints do 
not appear in the Database; (3) if the Bureau finds any pattern of 
fraud by any entity within its jurisdiction, the Bureau can bring 
appropriate enforcement actions; and (4) in sending such complaints to 
the company, the Bureau is assisting company operations in quickly 
identifying and addressing instances of potential fraud.
---------------------------------------------------------------------------

    \25\ 2012 Notice of Final Policy Statement, 77 FR at 37562 (June 
22, 2012).
---------------------------------------------------------------------------

c. Misidentification
    Several trade associations and companies commented that consumers' 
confusion about consumer financial products and services would lead to 
mistaken identification of the company against which the complaint is 
lodged. For example, one company commented that a consumer is likely to 
lodge a complaint against a credit reporting agency, when the 
consumer's complaint should be against the data furnisher. Trade 
associations and other commenters suggested the inclusion of company 
relationships. For example, one consumer group recommended including 
the parent company when that company has multiple subsidiaries against 
which complaints are lodged.
    As previously noted, companies have the ability to notify the 
Bureau if no commercial relationship exists between the consumer and 
the company; such complaints are not suitable for disclosure in the 
Consumer Complaint Database. Regarding the credit reporting example 
that was provided, the Bureau empowers the consumer to elect whom to 
submit a complaint against (dependent, as noted, on an existing 
commercial relationship). Specific to the suggestion regarding inter- 
and intra-company relationships, the Bureau is exploring expansion of 
the Database to include additional company relationship information.
d. Positive Feedback
    Several trade associations and companies commented that the 
Consumer Complaint Database should include positive narratives about 
companies in conjunction with complaint narratives. One commenter 
suggested that if the Database is to function as a marketplace of 
ideas, then it should reflect the entire market and not solely 
consumers submitting complaints. Several trade associations stated that 
if the Database is to be likened to private web-based review sites, 
then positive feedback is necessary.
    Consistent with these comments, the Bureau believes that the Bureau 
should share data that provides an unbiased perspective on company 
behavior toward consumers. At present, the Bureau already collects and 
shares some elements of positive feedback regarding company complaint 
handling. For example, the Consumer Complaint Database currently 
discloses information that can be used to highlight positive company 
behavior, e.g., companies with timely responses or low consumer dispute 
rates. However, the Bureau intends to further explore ways in which 
positive company behavior may be highlighted. Concurrent with the Final 
Policy Statement, the Bureau is publishing a Request for Information to 
solicit and collect input from the public on the potential collection, 
identification, and sharing of data and feedback specific to positive 
interactions with providers of consumer financial products and 
services.
e. Language Access
    Several consumer groups commended the accessibility of the Bureau's 
contact center, with translation available in over 180 languages. These 
groups requested that the Bureau make the online complaint submission 
form available in multiple languages.
    In addition to telephone support for non-English speaking 
consumers, the Bureau plans over time to make its online complaint 
intake form on consumerfinance.gov available in Spanish, and 
subsequently to explore making the form available in other languages as 
well. The Bureau is committed to providing persons with limited English 
proficiency meaningful access to its programs and services.
f. Third Party Submissions and Referrals
    Several trade associations and companies raised concerns that 
narratives from third parties without authority to make a complaint on 
behalf of a consumer nevertheless would be published, and companies 
would be compelled to respond publicly. The Conference of State Bank 
Supervisors requested clarification on whether narratives within 
complaints referred from other government agencies would be disclosed.
    This Final Policy Statement does not apply to complaints submitted 
by any third parties or via agency referral, and the Bureau does not 
intend to disclose such narratives at this time. The Complaint System 
affords companies the opportunity to alert the Bureau if they are 
unable to verify the commercial relationship with the consumer who 
submitted the complaint before the complaint is disclosed in the 
Consumer Complaint Database.
2. Company Responses
    In its Proposed Policy Statement, the Bureau stated that:

Where the consumer provides consent to publish their narrative, the 
related company will be given the opportunity to submit a narrative 
response for inclusion in the Consumer Complaint Database. The 
company will be instructed not to provide direct identifying 
information in its public-facing response, and the Bureau will take 
reasonable steps to remove personal information from the response to 
minimize (but not eliminate) the risk of re-identification. The 
Company Portal will include a data field into which companies have 
the option to provide narrative text that would appear next to a 
consumer's narrative in the Consumer Complaint Database.\26\
---------------------------------------------------------------------------

    \26\ Disclosure of Consumer Complaint Narrative Data, 79 FR at 
42768 (July 23, 2014).

    The Bureau received comments from companies and trade associations 
arguing that, because of business and legal considerations, they would 
be limited in their ability to provide meaningful public-facing 
unstructured narrative responses and that such responses would be 
impracticable or unhelpful. In response, the Bureau intends to adopt an 
alternative approach based on structured company responses, as 
discussed below.
a. Quality of Company Responses
    Trade associations and companies both questioned the fairness of 
publicly disclosing consumer narratives because they argued that, under 
the Bureau's proposal, companies would be limited in their ability to 
provide public-facing unstructured narrative responses. Several 
companies, trade associations and individual commenters expressed 
concern that their ability to provide meaningful public-facing 
unstructured narrative responses would be limited by laws such as the 
Gramm-Leach-Bliley Act and Regulation P, the Fair Credit Reporting Act 
and Regulation V, and the Fair Debt Collection Practices Act. 
Commenters argued that, under the

[[Page 15578]]

Bureau's proposal to permit voluntary narrative company responses, they 
might not be able to provide any public-facing response at all due to 
legal, business, and reputational considerations. These commenters 
argued that frank responses may be viewed negatively by the public and 
companies would be discouraged from attempting to articulate 
individualized responses. They argued that, in practice, voluntary 
public-facing company responses would not provide the balance suggested 
in the Proposed Policy Statement. Some commenters suggested various 
ways the Bureau could mitigate these concerns, including providing 
specific interpretive guidance. Consumer groups stated that making 
consumer narratives and company responses public would allow for 
consumers to make individual determinations regarding the quality of 
the company's service.
    Responsive to company and trade association feedback, the Bureau 
acknowledges that unstructured company narratives may not effectively 
provide companies with a mechanism to balance a consumer's narrative. 
Therefore, the Bureau intends to provide companies with a finite list 
of optional structured responses from which they can choose. Within the 
secure web portal companies use to respond to complaints, the Bureau 
intends to add a set list of company responses, giving companies the 
ability to recommend a public-facing response addressing the substance 
of the consumer's complaint. Companies will be under no obligation to 
avail themselves of this opportunity. The Bureau plans to adopt company 
recommendations as a general matter, but it reserves discretion to 
assess whether there are good-faith bases for the recommendations. In 
addition, the Bureau plans to assess its review process over time. The 
Bureau plans for this functionality to apply to all consumer complaints 
disclosed via the Consumer Complaint Database (and not only those with 
consumer consent to disclose the associated narrative).
    Although this approach was not specifically proposed by commenters, 
the Bureau believes that it should eliminate or significantly mitigate 
the concerns, raised by companies, arising from the risk of public 
disclosure of protected confidential information. Companies that 
voluntarily decide to provide a public-facing response will not be put 
in a position of assessing what level of detail will address a 
complaint while protecting confidential information. The Bureau 
believes companies will be more likely to recommend public-facing 
structured responses than they would be to provide unstructured public-
facing responses, and that the reputational risks of recommending 
structured responses will be lower. The Bureau also believes that this 
approach will lead to more standardized information that may facilitate 
the Bureau's other functions and goals with respect to the Consumer 
Complaint System, such as monitoring and reporting on complaints.
    Companies are ultimately responsible for ensuring their compliance 
with all legal requirements. The Bureau believes that its approach of 
making public-facing structured responses voluntary allows companies 
sufficient flexibility to assess legal, business, reputational, and 
other considerations relevant to the decision of whether to provide 
public-facing responses. Finally, while providing an opportunity for 
public-facing structured company responses offers significant benefits, 
the Bureau notes that the benefits of publicly disclosing unstructured 
consumer complaint narrative data, as explained in this Final Policy 
Statement, justify such disclosures, even absent an opportunity for 
public-facing company responses.
b. Public and Private Company Responses
    The Bureau solicited feedback on whether any potentially public-
facing company response should be distinct and in addition to the 
response companies currently send directly to the consumer. Several 
companies and trade associations commented that it should be distinct 
as the public response will have to be adapted to conform to applicable 
privacy laws. Several consumer groups and one company, on the other 
hand, commented that the same response, but in redacted form, should be 
publicly displayed in order to provide the public with the necessary 
context to interpret the data. Some trade associations commented that 
it would be operationally burdensome to create two separate responses.
    The Bureau plans to ensure that companies have the option to 
provide both a private (to-consumer) response and recommended public-
facing structured (to be shared via the Database) response to a 
consumer's complaint. One of the principal benefits for consumers of 
the Bureau's complaint handling services is the requirement that 
companies respond to the consumer and the Bureau remains committed to 
keeping the focus on assisting consumers with their complaints. Based 
on data available in the Consumer Complaint Database, approximately 62% 
of complaints are ``closed with explanation'' and the majority of those 
(75%) are not disputed by the consumer. The Bureau is concerned that 
mandating that the to-consumer company responses be made public could 
have a chilling effect on well-received, detailed responses to 
consumers, potentially leading to higher consumer dispute rates. Based 
on comments received by companies on this issue, this concern would 
appear to be well founded. Allowing the company the choice to provide 
one very detailed private communication to its consumer, as well as a 
separate public-facing response, would address the Bureau's, companies' 
and consumers' interests on this issue.
c. Response Time
    Currently, companies have 15 days to provide an initial response to 
a consumer complaint. Several trade associations and companies 
commented that the response time should be extended in order to 
accommodate the drafting of a separate, public-facing response. Some 
comments recommended extending the initial response time to as many as 
60 days.
    The Bureau believes that the marginal increase in burden associated 
with voluntarily recommending a separate structured public response 
does not necessitate a deviation from the current complaint handling 
requirements, which themselves are designed to provide the complaining 
consumer with a timely response.
d. Timing of Narrative and Response Posting
    Trade associations, consumer groups, and individual commenters 
supported the simultaneous posting of the consumer narrative and 
company response. One consumer group recommended posting the consumer 
narrative after 15 days, and posting the company's public response as 
it becomes available. Several commenters recommended 45 days; one 
company recommended 60 days. One commenter recommended publication 
after 35 days, to align generally with timing provided under the Fair 
Credit Reporting Act for consumer reporting agencies to reinvestigate 
and respond to consumer disputes.
    There are at least three timing options regarding the disclosure of 
the consumer narrative and company response: (1) Disclose the consumer 
narrative and company response (if available) when the company provides 
an initial response, but no later than 15 days after the complaint is 
routed to the company (the system currently in place

[[Page 15579]]

for non-narrative complaint data), (2) disclose the consumer narrative 
and company response (if available) 15 days after the complaint is 
routed to the company, or (3) disclose the consumer narrative when the 
company provides its public-facing response, but no later than 60 days 
after the complaint is routed to the company. Under all three options, 
the complaint's structured closure responses would continue to follow 
the current disclosure timing (option number 1) and the consumer 
narrative would only be disclosed once it is scrubbed of personal 
information. However, only option three guarantees that a public-facing 
company response, to the extent one is provided within the 60-day 
period, would be disclosed contemporaneously with the consumer 
narrative.
    After careful consideration, therefore, the Bureau intends to adopt 
option number three. Option number one could force the company to 
choose between its desire to respond to and close complaints quickly 
versus its desire to provide an appropriate public facing response. 
Option number two may result in instances in which the company 
legitimately needs additional time, has appropriately communicated to 
the Bureau an ``in progress'' response (allowing for up to 60 days to 
respond), and yet the consumer narrative is made public on day 15 and 
possibly without an accompanying company response. Option three carries 
a similar risk to option number one, potentially creating the incentive 
for companies to delay providing an optional public-facing response for 
the full 60-day allowance (and thus delaying disclosure of the consumer 
narrative). However, erring on the side of fairness to companies by 
ensuring contemporaneous release, the Bureau plans to implement option 
three.
3. Maintaining the Complaint Database
a. Updates to Published Narratives
    Several consumer groups commented that consumers should be allowed 
to update narratives to inform the public of the status of the 
complaint. Some trade associations asked that consumers be provided the 
ability to remove their narratives if they are satisfied with the 
complaint resolution.
    Once given, at any point in the process, consumers will have the 
ability to withdraw their consent regarding publication of their 
narrative in the Consumer Complaint Database. At such time the 
consumer's narrative will be removed from the Database. However, data 
already downloaded by the public cannot be recalled by the Bureau. 
Based on the Bureau's experience to date reviewing consumer complaints, 
company responses, and ensuing resolutions, the Bureau believes that no 
additional back-and-forth functionality is necessary at this time.
b. Removal of Old Narratives
    Several trade associations and one company commented that 
complaints and narratives should be removed from the database after a 
given step in the process or given amount of time, e.g., quarterly.
    The Bureau believes that consumers and the marketplace are capable 
of independently assessing the value of complaints based in part on 
when those complaints were submitted and therefore has no plans to 
remove complaints from the Consumer Complaint Database based on their 
age or status.
c. Normalization
    Several trade associations and companies commented that the 
unstructured narrative data should be accompanied by information 
providing context to the company's profile, including how many 
transactions the company conducts per year, how many complaints are 
received, and how many complaints are satisfactorily resolved.
    The Bureau notes the general agreement by commenters that 
normalization would improve the quality of the data in the Consumer 
Complaint Database. As discussed in the Bureau's notices of its 
previous policy statements, data normalization is a complicated issue, 
and one that the Bureau is continuing to explore.\27\ The Bureau also 
notes that market participants, news organizations, and consumer groups 
can and have created normalized results.
---------------------------------------------------------------------------

    \27\ 2012 Notice of Final Policy Statement, 77 FR at 37564 (June 
22, 2012); 2013 Notice of Final Policy Statement, 78 FR at 21222 
(April 10, 2013).
---------------------------------------------------------------------------

d. Protected Group Information
    Several consumer groups requested the inclusion of protected group 
information, such as sex, ethnicity, race, age, disability, marital 
status, or national origin, on complaint submissions. These comments 
noted that it would be helpful to have this information to identify 
trends in companies' business practices.
    The Bureau agrees that the collection and public disclosure of 
protected group data has the potential to increase the quality of the 
dataset made available via the Consumer Complaint Database. However, 
there remain many open questions that the Bureau must first explore 
before moving forward on this suggestion, including the appropriateness 
of collecting protected group data, its representativeness, and the 
potential challenges with disclosing protected group data given the 
Bureau's sensitivity to re-identification risk.
    Furthermore, as discussed elsewhere, the Bureau's Database 
scrubbing standard would remove demographic information such as gender, 
age, and race, and ethnicity provided by consumers in the text of their 
narratives.

D. Consumer Consent to Disclose Narratives

1. Opt-in Consumer Consent
    Trade associations, consumer groups, and individual commenters 
supported the proposed opt-in feature requiring a consumer's consent in 
order for narratives to be eligible for publication. A trade 
association representing news organizations asserted its view that 
narratives are subject to disclosure under FOIA regardless of consumer 
consent. Based on this viewpoint, it urged that at most the Bureau 
should permit consumers to opt-out of publication as opposed to having 
to opt-in. Commenters also generally agreed that consumers should 
maintain the right to revoke their consent at any time.
    A central tenet of the Bureau's work is to empower consumers; 
providing them with the option to opt-in (as opposed to requiring them 
to opt-out) and the right to withdraw their consent to publication of 
their narrative in the Consumer Complaint Database at any time advances 
that end.\28\ With respect to the comment about the application of the 
FOIA to narratives, the Chief FOIA Officer is authorized to grant or 
deny any request for a record of the CFPB, in accordance with the 
requirements of the FOIA and the Bureau's regulations. 12 CFR 1070.15. 
If the Bureau receives FOIA requests for records that are not published 
in the Consumer Complaint Database pursuant to this Final Policy 
Statement, the Chief FOIA Officer will determine whether to grant the 
request, or to deny it due to the applicability of FOIA exemptions.
---------------------------------------------------------------------------

    \28\ ``Our Mission'' https://www.consumerfinance.gov/strategic-plan/.
---------------------------------------------------------------------------

2. Placement and Design of Consent
    Some commenters discussed the appearance of the opt-in form. 
Consumer groups requested that the opt-in be presented to the consumer 
early in the complaint process so that consumers can consider the 
implications as they draft their complaints. One company recommended 
providing the option to opt-in only once the consumer has received a 
response and has had the

[[Page 15580]]

opportunity to consider the implications of publication. Some consumer 
groups recommended that, to encourage publication, the opt-in option be 
displayed prominently on the consent form. Additionally, some 
commenters requested that consumers have a distinct field on the form 
in which they can specify what personal information they want excluded 
from their narrative.
    The Bureau plans to place the opt-in consent at the submission 
phase of the complaint. The Bureau believes the decision whether or not 
to consent is most appropriate at the actual time of complaint 
submission. This decision is consistent with the practice of the 
Consumer Product Safety Commission, which also obtains consent to 
disclose complaint narratives in its public-facing database.
3. Elements of Informed Consent
    Some commenters recommended including disclaimers with the opt-in 
feature that notify consumers of what the commenters perceived to be a 
risk of defamatory speech. Some trade associations and companies 
commented that the Bureau should inform consumers of the risks of 
narrative publication, including the possibility of re-identification. 
Trade associations and companies generally commented that the consumer 
should be notified of the company response procedure and risks of 
consenting to publication. One press group commented that the consumer 
should be notified that his or her narrative is subject (in the 
commenter's view) to FOIA disclosure. One consumer group commented that 
consumers should be notified that consenting to publication may provide 
additional assistance to other consumers facing similar issues. The 
Bureau agrees that when a consumer is making the decision whether or 
not to opt-in, it is essential that the consumer have the information 
to weigh appropriately the risks of consenting to the disclosure of 
their de-identified narrative against individual and public benefits of 
doing so. In support of that goal, in addition to the consent language, 
the Bureau intends to provide clear, easily understandable material 
describing the scrubbing standard, methodology, and publication 
process, the remaining risk to privacy, and the possibility of re-
identification. The Bureau is committed to continuously improving these 
materials over time to empower the consumer to make the most 
appropriate choice for his or her individual needs and circumstances.
    However, consumers do not waive any privacy interests they may have 
in the information merely by submitting it to the Bureau.\29\
---------------------------------------------------------------------------

    \29\ The Bureau emphasizes that the consent procedure described 
in the text for authorizing public disclosure of narratives may not 
be adequate to satisfy consent requirements under other statutes and 
regulations that the Bureau administers or enforces.
---------------------------------------------------------------------------

E. Personal Information Scrubbing Standard and Methodology

1. Scrubbing Standard and Methodology
    The Bureau requested feedback on the standard and methodology it 
intends to utilize for scrubbing personal information in the 
narratives. This scrubbing standard would be applied comprehensively to 
all data shared via the Consumer Complaint Database. Consumer groups 
offered comments supporting the proposed use of modified Health 
Insurance Portability and Accountability Act (``HIPAA'') standards for 
scrubbing narratives. Some companies expressed concern that significant 
identifiers associated with major life events may remain, 
notwithstanding the scrubbing process. One company commented that 
scrubbing should be applied to all identifying information, including 
references to third parties. Another company noted the differences 
between health data and unstructured narratives, expressing concern 
that a HIPAA-based methodology would not be effective and that the 
Bureau has not provided sufficient detail on the scrubbing mechanism to 
be used. One privacy organization recommended that the Bureau scrub 
company responses.
    The Bureau's Database scrubbing standard is modeled after the HIPAA 
Safe Harbor Method, which is generally considered to represent a best 
practice for de-identifying data. In addition to adopting most of the 
specific HIPAA identifiers, the Bureau also plans to remove: (1) 
Demographic information such as gender, age, race, and ethnicity; (2) 
appropriate analogues to HIPAA identifiers in the consumer financial 
domain, e.g., credit card numbers; and (3) identifiers which the Bureau 
knows appear in complaints and could reasonably be used to identify 
individuals, e.g., references to third parties other than the company 
that is the subject of the complaint. The scrubbing methodology 
contemplates a computer-based automated step and a quality assurance 
step or steps performed by human reviewers.
2. ZIP Codes
    The Bureau requested feedback on whether to disclose 5-digit ZIP 
codes alongside redacted narratives.\30\ By and large the responses 
that were received supported two options. The majority of commenters 
suggested the Bureau disclose 5-digit ZIP codes, except where 
population in the ZIP code contains fewer than 10,000 people. The 
second most cited option recommended disclosing full 5-digit ZIP codes, 
regardless of population. On the other extreme, one commenter suggested 
that ZIP codes should be excluded altogether, with state or county 
being used as the geographic identifier.
---------------------------------------------------------------------------

    \30\ Disclosure of Consumer Complaint Narrative Data, 79 FR at 
42769 (July 23, 2014).
---------------------------------------------------------------------------

    While the Bureau acknowledges the unique value of detailed 
geographic data, it is also acutely aware of the heightened risk 5-
digit ZIP codes can create for re-identification. Accordingly, the 
Bureau plans to disclose 5-digit ZIP codes, except where the population 
in the ZIP code contains fewer than 20,000 people. In such cases, the 
Bureau plans to disclose the 3-digit ZIP code, except where the 3-digit 
ZIP code population contains fewer than 20,000 people, in which case 
the Bureau does not intend to disclose any ZIP code data. While this 
approach represents a different approach than those suggested by most 
commenters, the Bureau believes that this option appropriately balances 
the utility of geographic data with the associated risk to individual 
consumer privacy. As with all elements of its scrubbing standard, the 
Bureau intends to make adjustments in the future guided by the goal of 
simultaneously maximizing data utility and individual privacy.
3. Re-identification
    Several trade associations and companies commented that despite the 
proposed scrubbing methodology, an unacceptably high risk of re-
identification will remain. Some commented that in areas with small 
populations, even scrubbed narratives could lead to re-identification 
based on other details not covered by HIPAA standards. One company also 
commented that the risk of narrative content being repeated through 
social media raises the possibility of re-identification by individuals 
familiar with the consumer. Consumer and privacy groups commented that 
the risk of re-identification is minimal, and offset by the benefits of 
the policy and rigor of the scrubbing standard.
    As the Bureau stated in the Proposed Policy Statement, sharing data 
containing any personal information presents a tension between data 
utility and individual privacy. As a particular

[[Page 15581]]

personal information scrubbing standard becomes more or less stringent, 
the utility of a given de-identified dataset may become respectively 
less or more useful. The publication of narratives involves risks, 
including the potential harm associated with the re-identification of 
actual consumers within the Consumer Complaint Database. The Bureau 
believes that it is appropriate to publish only those narratives for 
which opt-in informed consumer consent has been obtained, that have 
also been subjected to scrubbing under a robust personal information 
scrubbing standard and methodology.

F. Impact of Narrative Publication on Companies and the Marketplace

1. Reputational Harm
    Trade associations commented that the public disclosure of 
unverified narratives would result in reputational harm to companies. 
Some comments argued that any perceived benefit to consumers through 
narrative publication would be outweighed by the reputational harm 
suffered by companies.
    The Bureau takes seriously company and trade association concerns 
that financial institutions could incur intangible reputational damage 
as a result of the disclosure of narratives. As stated in previous 
policy statements, to a large extent, this risk is inherent in any 
release of complaint data. In deciding to release the structured 
complaint data, the Bureau considered this concern and concluded that, 
while there is always a risk that market participants will draw 
erroneous conclusions from available data, the marketplace of ideas 
would on the whole be able to determine what the data show and their 
relative importance. The Bureau believes this to be equally true with 
respect to narratives, and that consumer narrative publication will in 
fact make it easier for the marketplace to evaluate the rest of the 
complaint data by providing more information and context. Likewise, the 
Bureau also believes that the option for companies to provide public-
facing structured responses will enhance the effectiveness of the 
Database and provide an opportunity for companies to enhance their 
reputation and mitigate potential concerns.
    Consistent with these comments, the Bureau believes that the 
Database should include data that provides an unbiased perspective on 
company behavior toward consumers. Accordingly, in parallel to the 
finalization of the instant Final Policy Statement, the Bureau intends 
to further explore ways in which positive company behavior may be 
highlighted. Concurrent with the Final Policy Statement, the Bureau is 
publishing a Request for Information to solicit and collect input from 
the public on the potential collection, identification, and sharing of 
data and feedback specific to positive interactions with providers of 
consumer financial products and services.
2. Effect on Consumer Relations
    Several companies, trade associations, and a public interest 
organization commented that publicly posting narratives could create 
disincentives for consumers to deal directly with companies to resolve 
their disputes. Some commenters requested that narratives only be 
posted after the consumer has directly contacted the company. A few 
trade associations commented that narrative publication would cause 
general harm to customer relations by making the process more 
adversarial.
    The data collected from the Bureau's credit card intake form and 
survey work shows that the vast majority of consumers have already 
attempted, often several times, to resolve the complained-about issue 
with the company before seeking assistance from the Bureau. As 
previously stated, a central element of the Bureau's mission is to 
empower consumers; the Bureau believes that requiring consumers to 
contact the company before engaging the Bureau would work against that 
goal. Such an additional procedural hurdle may also discourage some 
number of consumers from submitting complaints, which would have the 
effect of depriving the Bureau of the information underlying the 
complaint. This could serve to undermine Bureau functions that rely, at 
least in part, on complaint data to inform their respective activities.
    Similarly the Bureau is skeptical of concerns that disclosing 
narratives would create disincentives for consumers to deal directly 
with the company and would cause general harm to customer relations by 
making the process more adversarial. Feedback the Bureau has received 
suggests the introduction of the Consumer Complaint Database and the 
Bureau's activities generally have caused greater investment by 
companies in their customer service operations, which includes company 
complaint handling. The Bureau views this development as a positive 
step for customer service at companies that are making such 
investments.
3. The Appearance of Validating Complaints by the Act of Disclosing 
Them
    Several trade associations, companies, and individual commenters 
stated that by including unverified comments on a government Web site, 
the narratives will be portrayed as being validated by the Bureau.
    Similar concerns were previously raised and addressed by the Bureau 
in the 2012 Notice of Final Policy Statement.\31\ The Bureau 
acknowledged the possibility that some consumers may (or may be led to) 
draw erroneous conclusions from the data. That is true, however, for 
any market data. In recognition of this risk the Bureau provides the 
following disclaimer on the Consumer Complaint Database: ``We don't 
verify all the facts alleged in these complaints but we take steps to 
confirm a commercial relationship between the consumer and company. 
Complaints are listed here after the company responds or after they 
have had the complaint for 15 calendar days, whichever comes first. We 
remove complaints if they don't meet all of the publication criteria. 
Data is refreshed nightly.'' The Bureau believes this disclaimer to be 
sufficient to address the risk identified by commenters.
---------------------------------------------------------------------------

    \31\ 2012 Notice of Final Policy Statement, 77 FR at 37562 (June 
22, 2012).
---------------------------------------------------------------------------

    As discussed elsewhere, it is noteworthy that several other 
government agencies make consumer complaint narratives available, 
including the Consumer Product Safety Commission, the National Highway 
Transportation Safety Administration, and, pursuant to FOIA requests, 
the Federal Trade Commission.
4. Consumer Confusion and Lack of Context
    Several trade associations commented that unstructured narrative 
data provides minimal benefit to consumers as required scrubbing would 
remove any useful information from the narrative and responses. Some 
trade association comments added that the Bureau's resources would be 
better utilized by providing more context for data already provided in 
the Database. Some consumer groups requested better organization of the 
data provided in the Database.
    As noted previously, sharing data containing personal information 
presents a tension between data utility and individual privacy. The 
Bureau believes, based on the comments received from various consumer 
and privacy groups, that it is possible to strike a balance between 
these two

[[Page 15582]]

important interests and still disclose a dataset that provides 
significant benefit to the marketplace. The Bureau will continually 
monitor this balance for opportunities to adjust its personal 
information scrubbing standard, which the Bureau intends to describe on 
its Web site. Furthermore, the Bureau is committed to the continuous 
improvement of the Consumer Complaint Database, which includes the 
addition of increasing levels of context, organization, and data 
normalization.
5. Increased Litigation
    A few companies and trade associations commented that the 
publication of narratives would lead to increased litigation, either 
through potentially ``defamatory'' narratives posted by consumers or as 
a result of additional information available to prospective plaintiffs. 
One company expressed the concern that complaints and narratives could 
be sources of information appropriately left to be obtained during the 
discovery process. One trade association also commented that the 
privacy risks of published narratives could increase the risk of legal 
liability and heighten litigation costs. One legal aid organization 
commented that the availability of complaint narratives would help 
consumer advocacy groups to identify local trends of unlawful behavior 
and target legal efforts more effectively.
    The Bureau believes the risk of increased litigation following the 
disclosure of narratives to be low. The closest analogs to the Bureau's 
plan for narrative disclosure are the Consumer Product Safety 
Commission's public-facing complaint database and the Federal Trade 
Commission's disclosures pursuant to FOIA requests; the Bureau is not 
aware of any information that those disclosures have increased 
litigation against companies. Ultimately, the Bureau believes there is 
significant value in making available Bureau complaint data to help in 
the identification of and calling attention to potentially unlawful 
behavior.
6. Increased Company Costs
    Several trade associations and companies commented that the 
additional procedure of creating a second, public-facing response, and 
ensuring its compliance with potentially applicable laws, would 
increase operational costs for companies. Some of these commenters also 
emphasized the increased costs to the Bureau resulting from additional 
infrastructure necessary to publish narratives. One public interest 
group also highlighted the financial burden of producing additional 
responses to narratives.
    As noted above, and in light of the comments received, the Bureau 
intends to provide companies with a finite list of optional structured 
responses that will allow them to recommend to the Bureau an optional 
public response to address the substance of consumers' complaints. The 
Bureau believes that this approach significantly decreases the 
operational costs of providing independent public-facing responses, as 
compared to the Bureau's proposal of providing separate narrative 
responses. Still, the Bureau acknowledges that additional effort and 
expense may be borne by companies in connection with preparing public-
facing responses to consumer narratives. The Bureau has weighed these 
factors, in addition to the increased burdens on the Bureau's own 
complaint handling operation. The Bureau considers it a matter of 
fairness to provide companies with the opportunity to address publicly 
consumer complaints from the company's perspective. It is important to 
recognize that no company will be required to recommend a public-facing 
response, and it is entirely up to the company whether it wants to take 
advantage of this forum. The Bureau does not believe that the 
additional burden a company may bear in taking advantage of this 
opportunity, particularly given the Bureau's movement to structured 
responses and away from unstructured narrative company responses, 
outweighs the benefit of publicly disclosing narratives to consumers 
and the marketplace.
7. Confidentiality Agreements
    One individual commented that the public posting of consumer 
narratives would create an incentive for companies to require consumers 
to sign non-disclosure agreements when creating an account. This 
commenter recounted an experience in which he submitted a complaint to 
the Bureau and when settling the matter with the company, the company 
asked him to sign a confidentiality agreement.
    The Bureau's experience to date has not uncovered widespread 
company use of non-disclosure agreements in connection with the 
Consumer Complaint Database, and no company comments on the proposed 
Policy have indicated that companies intend to utilize non-disclosure 
agreements as gag orders in the way envisioned by this comment. The 
Bureau's market monitoring will remain alert to developments along 
these lines. However, the Bureau would likely look disfavorably upon 
agreements that require a consumer to withdraw his or her consent to 
have a narrative published as a condition of settlement.

IV. Implementing the Final Policy Statement

    Following publication of the Final Policy Statement, the Bureau 
will turn to implementation of the policy. The Bureau intends to modify 
its Web site and online complaint intake form to collect informed opt-
in consumer consent. In conjunction with the collection of consumer 
consent, the Bureau intends to finalize and post on its Web site the 
Consumer Complaint Database scrubbing standard. The Bureau will also 
modify the company web portal to add functionality to allow companies 
to provide the recommended public-facing responses, reach out to 
companies on the company web portal to offer training and provide 
technical support related to the policy. The Bureau will finalize its 
automated and manual review processes and then begin scrubbing 
narratives.
    The Bureau will not disclose any scrubbed and consented-to 
narratives until sufficient time has elapsed to allow the Bureau to 
adequately complete and assess the above actions.

V. Final Policy Statement

    The Bureau hears directly from the American public about their 
experiences with the nation's consumer financial marketplace. An 
important element of the Bureau's mission is the handling of individual 
consumer complaints regarding consumer financial products and services.
    In June 2012, the Bureau began making de-identified individual-
level complaint data available via its web-based, public-facing 
database (the ``Consumer Complaint Database''). Since launch, the 
Consumer Complaint Database has been expanded to include additional 
consumer financial products and data fields as products have been added 
to its complaint handling system. Consistent with its strategic vision, 
the Bureau is committed to the continued growth and refinement of the 
Consumer Complaint Database in a manner that helps inform consumers and 
the marketplace while still protecting privacy and incorporating 
appropriate security controls.

A. Consumer Narratives

    The Bureau plans to provide consumers who submit their complaints 
directly to the Bureau the opportunity to share their individual 
stories with other consumers and the marketplace by including consumer 
complaint narratives in the Consumer Complaint

[[Page 15583]]

Database where consent for publication is first obtained from the 
consumer. Only those narratives for which opt-in consumer consent is 
obtained and a robust personal information scrubbing standard and 
methodology is applied will be eligible for disclosure.

B. Consumer Consent To Disclose Narratives

    The Bureau intends to disclose only narratives for which informed 
consent has been obtained and that have been scrubbed for personal 
information. To obtain informed consumer consent, the Bureau plans to 
give consumers who submit a complaint the opportunity to check a 
consent box, with accompanying language that will state, among other 
things, and in plain language, that: (1) Whether or not consent is 
given will not otherwise impact how the Bureau handles the complaint; 
(2) if given, the consumer may thereafter inform the Bureau that the 
consumer withdraws consent at any time and the narrative will be 
removed from the Consumer Complaint Database; and (3) the Bureau will 
take reasonable steps to remove personal information from the complaint 
to address risk of re-identification.

C. Personal Information Scrubbing Standard and Methodology

    Sharing data containing personal information presents a tension 
between data utility and individual privacy. As a particular personal 
information scrubbing standard becomes more or less stringent, the 
utility of a given de-identified dataset may become respectively less 
or more useful.
    Within its judgment and discretion, and in order to address the 
risk of re-identification, the Bureau intends to apply to all publicly-
disclosed narratives a robust personal information scrubbing standard 
and methodology. In designing its scrubbing standard, the Bureau relied 
heavily on guidance by the Department of Health and Human Services 
regarding de-identification of health data, as outlined in the Health 
Insurance Portability and Accountability Act (``HIPAA'') Privacy 
Rule.\32\ The Bureau's current scrubbing standard is modeled after the 
HIPAA Safe Harbor Method, which is generally considered to represent a 
best practice for de-identifying data. In addition to adopting (and 
removing) most of the specific HIPAA identifiers, the Bureau also plans 
to remove: (1) Demographic information such as gender, age, race, and 
ethnicity; (2) appropriate analogues to HIPAA identifiers in the 
consumer financial domain, e.g., credit card numbers; and (3) 
identifiers which the Bureau knows appear in complaints and could 
reasonably be used to identify individuals, e.g., personal information 
pertaining to third parties other than the company that is the subject 
of the complaint. All consumer complaint data shared via the Consumer 
Complaint Database will be subject to this standard and methodology, 
including, e.g., ZIP code. The Bureau plans to make this scrubbing 
standard available on the Bureau's Web site. The scrubbing methodology 
contemplates a computer-based automated step and a quality assurance 
step or steps performed by human reviewers.
---------------------------------------------------------------------------

    \32\ 45 CFR 164.514.
---------------------------------------------------------------------------

D. Company Response

    The Bureau plans to give companies the opportunity to respond 
publicly to the substance of the consumer complaints they receive from 
the Bureau. Within the secure web portal companies use to respond to 
complaints, the Bureau intends to add a set list of structured company 
response options; a responding company will be given an opportunity to 
recommend to the Bureau which option, if any, it would like included as 
a public-facing response to address the substance of the consumer's 
complaint. Companies will be under no obligation to avail themselves of 
this opportunity.

E. Continuous Improvement

    The Bureau plans to implement a testing and continuous improvement 
process to ensure that as applied, the Bureau's standard and 
methodology for scrubbing personal information adequately protects 
consumers. The Bureau intends to continue to adjust its scrubbing 
standard and methodology, guided by the goal of simultaneously 
maximizing data utility and individual privacy.

VI. Effect of Policy Statement

    This Policy Statement is intended to provide information regarding 
the Bureau's plans to exercise its discretion to publicly disclose 
certain data derived from consumer complaints. The Policy Statement 
does not impose any legal obligations on third parties, nor does it 
create or confer any substantive or procedural rights on third parties 
that could be enforceable in any administrative or civil proceeding.

    Dated: March 12, 2015.
Richard Cordray,
Director, Bureau of Consumer Financial Protection.
[FR Doc. 2015-06722 Filed 3-23-15; 8:45 am]
BILLING CODE 4810-AM-P